Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control PlanCP-06Controlled Access & Assurance

Can you show who approved access and what the control actually did?

CP-06 Controlled Access & Assurance Control Plan icon

CP-06 connects approved access to defined control actions, so the organisation can identify the request, authority, selected connection and observed state for each action in scope.

Plan
CP-06
Purpose
Controlled Access & Assurance
Selected connections
4
Modules
Validate · Lock · Relay · Transfer · Execute · Fracture
Scope
Selected access, administration and evidence exchange connections, with agreed record sources.

What is at stake

Why controlled access & assurance matters.

Auditors, insurers and regulators often ask for more than a policy. They want to understand who approved access, why it existed and what changed when it ended.

Access exceeds its purposeReview, administration or exchange routes can remain available after their purpose has ended.
Records are incompleteApprovals, commands and observed states can sit in different systems or be missed altogether.
Control and evidence are confusedAn action alone does not prove that every record was collected or retained.
Exceptions are undocumentedEmergency access needs its own approval and review route.

The problem today

Where you are IP connected today.

CP-06 reviews four IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

4IP-connected paths reviewed
4Risks to agree with owners
6Control modules applied
  1. Risk 1Requester access to controlled data

    The selected connection used by approved requesters.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected outside approved access

  2. Risk 2Administrative management path

    The route used to manage systems within the controlled environment.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected outside approved windows

  3. Risk 3Evidence exchange path

    The path used to deliver agreed evidence to an approved recipient.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected outside approved exchanges

  4. Risk 4Supporting record sources

    The approval, identity, command and logging systems selected for the deployment.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Configured and tested

Matching industry Blueprints

What Firevault changes

What changes with this Plan.

Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own.

Connection Agreed normal state Control action
Requester access to controlled data Disconnected outside approved access Validate checks the request. Lock applies supporting access controls. Relay opens the connection.
Administrative management path Disconnected outside approved windows Validate checks authority. Relay opens the path. Execute closes it and Fracture withdraws it.
Evidence exchange path Disconnected outside approved exchanges Validate checks approval. Transfer makes the path available. Fracture withdraws it afterwards.
Supporting record sources Configured and tested Supporting systems record the agreed request, approval, command and observed state.

CP-06 does not make an organisation compliant, verify content inside a session or guarantee a complete record. Anchor does not collect or retain records.

Control in Action

Controlled Access & Assurance: see the selected path change.

Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own.

Control in Action

Stage

Before agreed physical control

Auditors, insurers and regulators often ask for more than a policy. They want to understand who approved access, why it existed and what changed when it ended.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack
10still running

Physical crossings

  • Requester access to controlled dataAlways connected
  • Administrative management pathAlways connected
  • Evidence exchange pathAlways connected
  • Supporting record sourcesAlways connected
  • Recovery access (OSS)Not in place
  1. VAValidate · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

Checks the requester, authority, purpose and approval before access or action. Restricts access through defined identities, permissions and policies in supporting systems. Opens an approved access connection for a defined purpose and time. Makes an approved evidence exchange path available. Initiates the approved action on the designated connection. Physically withdraws the selected connection.

CP-06Controlled Access & Assurance

Z0Requesting environment
Z1Protected systems
Z2Related operations
Held in Offline Secure Storage®Selected recovery material, held separately
Out-of-band command path

This Control Plan

Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own.

Primary modules: Fracture, Relay, Execute, Validate, Lock and Transfer.

Read the operational detail

Module in this plan

Fracture module icon

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The Control Plan specification

Each selected connection, written down.

Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own.

Requester access to controlled dataThe selected connection used by approved requesters.Disconnected outside approved access
Normal state
Disconnected outside approved access
Authorisation
Approved request with named requester and purpose
Module action
Validate checks the request. Lock applies supporting access controls. Relay opens the connection.
Business effect
Requester access exists only for the approved purpose and time.
Failure behaviour
Remains disconnected unless an approved recovery procedure is followed.
Administrative management pathThe route used to manage systems within the controlled environment.Disconnected outside approved windows
Normal state
Disconnected outside approved windows
Authorisation
Approved change or administration request
Module action
Validate checks authority. Relay opens the path. Execute closes it and Fracture withdraws it.
Business effect
Administration uses approved windows rather than standing access.
Failure behaviour
Remains disconnected unless an approved recovery procedure is followed.
Evidence exchange pathThe path used to deliver agreed evidence to an approved recipient.Disconnected outside approved exchanges
Normal state
Disconnected outside approved exchanges
Authorisation
Approved evidence request
Module action
Validate checks approval. Transfer makes the path available. Fracture withdraws it afterwards.
Business effect
Evidence delivery happens through an approved path and window.
Failure behaviour
Verify receipt before resuming the exchange.
Supporting record sourcesThe approval, identity, command and logging systems selected for the deployment.Configured and tested
Normal state
Configured and tested
Authorisation
Each action in scope
Module action
Supporting systems record the agreed request, approval, command and observed state.
Business effect
Creates a reviewable record within the agreed collection scope.
Failure behaviour
Collection failures are escalated and reviewed.

CP-06 does not make an organisation compliant, verify content inside a session or guarantee a complete record. Anchor does not collect or retain records.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record
1Normal operationAgreed states held

Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own. Each selected connection sits at its agreed normal state.Transfer

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Validate checks the request. Lock applies supporting access controls. Relay opens the connection.ValidateLockRelay

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own.Fracture

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Review the request, approval, command and observed state before approving a renewed connection.

The operational owner authorises each reconnection.

Each check and each reconnection.

CP-06 does not make an organisation compliant, verify content inside a session or guarantee a complete record. Anchor does not collect or retain records.

Engineering and integration

Fit the control around your existing environment.

Selected access, administration and evidence exchange connections, with agreed record sources.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.
Controlled changeVerify approved opening, closure and the operational impact.
Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Review the request, approval, command and observed state before approving a renewed connection.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

CP-06 does not make an organisation compliant, verify content inside a session or guarantee a complete record. Anchor does not collect or retain records.

What this addressesConnect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own.
What it does not replaceCP-06 does not make an organisation compliant, verify content inside a session or guarantee a complete record. Anchor does not collect or retain records.
Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Start with one access route and list the records an auditor would need to understand it.

Questions worth asking

Before you rely on CP-06.

Practical questions for the people who own these connections.

Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own.

Selected access, administration and evidence exchange connections, with agreed record sources.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

CP-06 does not make an organisation compliant, verify content inside a session or guarantee a complete record. Anchor does not collect or retain records.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Start with one access route and list the records an auditor would need to understand it.

Your next step

Take the next step with controlled access & assurance.

Start with one access route and list the records an auditor would need to understand it.

Book a briefing

Prefer to talk first? Speak to the team