--- title: "CP-05 Critical Asset Protection | Control by Firevault" url: https://fire-vault.com/control-plan/protect-critical-infrastructure description: "CP-05 keeps selected routes into essential systems within planned physical boundaries, while enterprise access, maintenance and transfers remain deliberate…" lang: en-GB --- Control Plan **CP-05**Critical Asset Protection # Protect essential systems without treating the process like office IT. Image: CP-05 Critical Asset Protection Control Plan icon (https://fire-vault.com/__l5e/assets-v1/7b5311e0-04ce-497c-b7da-9a1472237891/CP-05_critical-asset-protection.png) CP-05 keeps selected routes into essential systems within planned physical boundaries, while enterprise access, maintenance and transfers remain deliberate and approved. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-05 Purpose Critical Asset Protection Selected connections 4 Modules Anchor · Validate · Relay · Transfer · Execute · Fracture Scope Selected enterprise, maintenance and exchange routes into an essential environment. What is at stake ## Why critical asset protection matters. Essential systems often depend on legacy equipment, remote sites and specialist support. Sudden disconnection can create its own operational risk, so boundaries must be designed with operations. **Enterprise compromise reaches essential systems**A standing link from business networks can expose systems that keep a service running. **Maintenance access remains open**Engineering and supplier routes can remain available outside approved work. **Legacy systems cannot be patched**Some equipment must keep operating with limited protection of its own. **Unsafe response**An unplanned disconnection can affect operations if local control and safety dependencies are not understood. The problem today ## Where you are IP connected today. CP-05 reviews four IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **4**IP-connected paths reviewed **4**Risks to agree with owners **6**Control modules applied 1. _Risk 1_**Enterprise to essential systems** The selected link between business networks and the essential environment. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Connected only where required for service 2. _Risk 2_**Maintenance route** The route used by engineers or suppliers for approved maintenance. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected outside approved windows 3. _Risk 3_**Approved data exchange** The path used to move reports, configurations or updates across the boundary. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected outside approved exchanges 4. _Risk 4_**Local control and safety functions** The process functions needed to keep the service safe. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Not assumed disconnectable Matching industry Blueprints BP-01 · utilities water (https://fire-vault.com/control-blueprint/utilities-water)BP-02 · energy (https://fire-vault.com/control-blueprint/energy)BP-03 · oil and gas (https://fire-vault.com/control-blueprint/oil-and-gas)BP-04 · rail (https://fire-vault.com/control-blueprint/rail)BP-14 · critical infrastructure (https://fire-vault.com/control-blueprint/critical-infrastructure)BP-19 · utilities gas (https://fire-vault.com/control-blueprint/utilities-gas) What Firevault changes ## What changes with this Plan. Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes. | Connection | Agreed normal state | Control action | | --- | --- | --- | | Enterprise to essential systems | Connected only where required for service | Validate checks both approvals. Execute initiates the action. Fracture withdraws the link. | | Maintenance route | Disconnected outside approved windows | Validate checks the request. Relay opens the route. Fracture withdraws it afterwards. | | Approved data exchange | Disconnected outside approved exchanges | Validate checks the request. Transfer makes the exchange path available. Fracture withdraws it afterwards. | | Local control and safety functions | Not assumed disconnectable | No automatic Control action is assumed. | CP-05 does not change process logic, provide safety functions, detect threats or remove malware. Routes outside the approved register need separate control. Control in Action ## Critical Asset Protection: see the selected path change. Control in Action Stage Before agreed physical control Essential systems often depend on legacy equipment, remote sites and specialist support. Sudden disconnection can create its own operational risk, so boundaries must be designed with operations.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - Enterprise to essential systems _Always connected_ - Maintenance route _Always connected_ - Approved data exchange _Always connected_ - Local control and safety functions _Connected · ready to cut_ - Recovery access (OSS) _Not in place_ 1. _AR_**Anchor** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. Keeps critical assets within defined physical connection boundaries. Checks authority and purpose before a maintenance, transfer or response action. Opens a selected route for approved maintenance and closes it afterwards. Makes an approved exchange path available between separate environments. Initiates the approved action on the designated connection. Physically withdraws the selected route. ### CP-05Critical Asset Protection Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes. Primary modules: Fracture, Relay, Execute, Validate, Anchor and Transfer. Read the operational detail Module in this plan Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) #### Fracture Controls the path Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing. Explore the Fracture module (https://fire-vault.com/control/modules/fracture) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-05 **CP-04****Physical Network Segmentation**Zones separated at Layer 1, so a boundary holds even when software controls are compromised. _Open CP-04_: https://fire-vault.com/control-plan/enforce-physical-segmentation **CP-06****Controlled Access & Assurance**Connect approvals and observed control states to agreed record sources, with collection and retention defined for the actions in scope. _Open CP-06_: https://fire-vault.com/control-plan/prove-compliance-through-control **CP-03****Third-Party Access Control**Supplier and vendor paths that exist only for approved work, in a defined window. _Open CP-03_: https://fire-vault.com/control-plan/control-third-party-access See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. Enterprise to essential systemsThe selected link between business networks and the essential environment._Connected only where required for service_ Normal state Connected only where required for service Authorisation Incident owner and operations owner approval Module action Validate checks both approvals. Execute initiates the action. Fracture withdraws the link. Business effect Business access pauses. Local operation must be confirmed before approval. Failure behaviour Behaviour agreed with operations and tested. Maintenance routeThe route used by engineers or suppliers for approved maintenance._Disconnected outside approved windows_ Normal state Disconnected outside approved windows Authorisation Approved work order and operational readiness Module action Validate checks the request. Relay opens the route. Fracture withdraws it afterwards. Business effect Maintenance access is available only for the approved work. Failure behaviour Remains disconnected unless an approved recovery procedure is followed. Approved data exchangeThe path used to move reports, configurations or updates across the boundary._Disconnected outside approved exchanges_ Normal state Disconnected outside approved exchanges Authorisation Approved exchange request Module action Validate checks the request. Transfer makes the exchange path available. Fracture withdraws it afterwards. Business effect Exchange runs only through the approved path and window. Failure behaviour Local control and safety functionsThe process functions needed to keep the service safe._Not assumed disconnectable_ Normal state Not assumed disconnectable Authorisation Outside automatic action Module action No automatic Control action is assumed. Business effect Operational and safety dependencies remain with the system owner. Failure behaviour Assess separately with operations and safety owners. Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes. Each selected connection sits at its agreed normal state.Anchor Transfer Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** Validate checks both approvals. Execute initiates the action. Fracture withdraws the link.Validate Relay The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes.Fracture Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** Before reconnection, operations confirm the service state and the security owner confirms the agreed checks. The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Keep essential systems within planned connection boundaries, with maintenance and data exchange routes opened only for approved purposes. **What it does not replace**CP-05 does not change process logic, provide safety functions, detect threats or remove malware. Routes outside the approved register need separate control. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Start with one maintenance route and confirm the local operation and safety dependencies around it. Questions worth asking ## Before you rely on CP-05. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with critical asset protection. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/protect-critical-infrastructure#webpage", "url": "https://fire-vault.com/control-plan/protect-critical-infrastructure", "name": "CP-05 Critical Asset Protection", "description": "CP-05 keeps selected routes into essential systems within planned physical boundaries, while enterprise access, maintenance and transfers remain deliberate…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/protect-critical-infrastructure#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/protect-critical-infrastructure#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-05 Critical Asset Protection", "item": "https://fire-vault.com/control-plan/protect-critical-infrastructure" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-05 Critical Asset Protection", "description": "CP-05 keeps selected routes into essential systems within planned physical boundaries, while enterprise access, maintenance and transfers remain deliberate and approved.", "url": "https://fire-vault.com/control-plan/protect-critical-infrastructure" } ] ```