--- title: "CP-06 Controlled Access & Assurance | Control by Firevault" url: https://fire-vault.com/control-plan/prove-compliance-through-control description: "CP-06 connects approved access to defined control actions, so the organisation can identify the request, authority, selected connection and observed state for…" lang: en-GB --- Control Plan **CP-06**Controlled Access & Assurance # Can you show who approved access and what the control actually did? Image: CP-06 Controlled Access & Assurance Control Plan icon (https://fire-vault.com/__l5e/assets-v1/5a737d73-72d7-497a-8f71-2d1609cef83d/CP-06_controlled-access-assurance.png) CP-06 connects approved access to defined control actions, so the organisation can identify the request, authority, selected connection and observed state for each action in scope. Book a briefing: https://fire-vault.com/demo See Control in Action Plan CP-06 Purpose Controlled Access & Assurance Selected connections 4 Modules Validate · Lock · Relay · Transfer · Execute · Fracture Scope Selected access, administration and evidence exchange connections, with agreed record sources. What is at stake ## Why controlled access & assurance matters. Auditors, insurers and regulators often ask for more than a policy. They want to understand who approved access, why it existed and what changed when it ended. **Access exceeds its purpose**Review, administration or exchange routes can remain available after their purpose has ended. **Records are incomplete**Approvals, commands and observed states can sit in different systems or be missed altogether. **Control and evidence are confused**An action alone does not prove that every record was collected or retained. **Exceptions are undocumented**Emergency access needs its own approval and review route. The problem today ## Where you are IP connected today. CP-06 reviews four IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner. **4**IP-connected paths reviewed **4**Risks to agree with owners **6**Control modules applied 1. _Risk 1_**Requester access to controlled data** The selected connection used by approved requesters. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected outside approved access 2. _Risk 2_**Administrative management path** The route used to manage systems within the controlled environment. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected outside approved windows 3. _Risk 3_**Evidence exchange path** The path used to deliver agreed evidence to an approved recipient. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Disconnected outside approved exchanges 4. _Risk 4_**Supporting record sources** The approval, identity, command and logging systems selected for the deployment. Whenever this path is open over IP, it is a route that can be reached, misused or exploited. **Agreed state:** Configured and tested Matching industry Blueprints What Firevault changes ## What changes with this Plan. Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own. | Connection | Agreed normal state | Control action | | --- | --- | --- | | Requester access to controlled data | Disconnected outside approved access | Validate checks the request. Lock applies supporting access controls. Relay opens the connection. | | Administrative management path | Disconnected outside approved windows | Validate checks authority. Relay opens the path. Execute closes it and Fracture withdraws it. | | Evidence exchange path | Disconnected outside approved exchanges | Validate checks approval. Transfer makes the path available. Fracture withdraws it afterwards. | | Supporting record sources | Configured and tested | Supporting systems record the agreed request, approval, command and observed state. | CP-06 does not make an organisation compliant, verify content inside a session or guarantee a complete record. Anchor does not collect or retain records. Control in Action ## Controlled Access & Assurance: see the selected path change. Control in Action Stage Before agreed physical control Auditors, insurers and regulators often ask for more than a policy. They want to understand who approved access, why it existed and what changed when it ended.**Connected routes require review. Discovery checks your real dependencies.** **0**reached by the attack **10**still running Physical crossings - Requester access to controlled data _Always connected_ - Administrative management path _Always connected_ - Evidence exchange path _Always connected_ - Supporting record sources _Always connected_ - Recovery access (OSS) _Not in place_ 1. _VA_**Validate** · Review the purpose and ownership of each selected connection. Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate. The modules involved ## The Control modules behind this Plan. Checks the requester, authority, purpose and approval before access or action. Restricts access through defined identities, permissions and policies in supporting systems. Opens an approved access connection for a defined purpose and time. Makes an approved evidence exchange path available. Initiates the approved action on the designated connection. Physically withdraws the selected connection. ### CP-06Controlled Access & Assurance Z0 Requesting environment Z1 Protected systems Z2 Related operations Held in Offline Secure Storage® Selected recovery material, held separately Out-of-band command path This Control Plan #### Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own. Primary modules: Fracture, Relay, Execute, Validate, Lock and Transfer. Read the operational detail Module in this plan Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) #### Fracture Controls the path Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing. Explore the Fracture module (https://fire-vault.com/control/modules/fracture) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-06 **CP-05****Critical Asset Protection**Separate business access from essential systems, with planned isolation boundaries. _Open CP-05_: https://fire-vault.com/control-plan/protect-critical-infrastructure **CP-07****Security Airlock**A two-stage gateway with independently controlled connections. _Open CP-07_: https://fire-vault.com/control-plan/security-airlock **CP-04****Physical Network Segmentation**Zones separated at Layer 1, so a boundary holds even when software controls are compromised. _Open CP-04_: https://fire-vault.com/control-plan/enforce-physical-segmentation See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Each selected connection, written down. Requester access to controlled dataThe selected connection used by approved requesters._Disconnected outside approved access_ Normal state Disconnected outside approved access Authorisation Approved request with named requester and purpose Module action Validate checks the request. Lock applies supporting access controls. Relay opens the connection. Business effect Requester access exists only for the approved purpose and time. Failure behaviour Remains disconnected unless an approved recovery procedure is followed. Administrative management pathThe route used to manage systems within the controlled environment._Disconnected outside approved windows_ Normal state Disconnected outside approved windows Authorisation Approved change or administration request Module action Validate checks authority. Relay opens the path. Execute closes it and Fracture withdraws it. Business effect Administration uses approved windows rather than standing access. Failure behaviour Evidence exchange pathThe path used to deliver agreed evidence to an approved recipient._Disconnected outside approved exchanges_ Normal state Disconnected outside approved exchanges Authorisation Approved evidence request Module action Validate checks approval. Transfer makes the path available. Fracture withdraws it afterwards. Business effect Evidence delivery happens through an approved path and window. Failure behaviour Verify receipt before resuming the exchange. Supporting record sourcesThe approval, identity, command and logging systems selected for the deployment._Configured and tested_ Normal state Configured and tested Authorisation Each action in scope Module action Supporting systems record the agreed request, approval, command and observed state. Business effect Creates a reviewable record within the agreed collection scope. Failure behaviour Collection failures are escalated and reviewed. Operational runbook ## Who does what, and when. What happens under normal conditions, during approved work, when an incident is detected and when connections are restored. Stage What happens Who decides On record _1_Normal operation **Agreed states held** Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own. Each selected connection sits at its agreed normal state.Transfer Set in the Plan, signed off by your operational, security and continuity leads. Connection states, continuously. _2_Approved work **Booked, bounded access** Validate checks the request. Lock applies supporting access controls. Relay opens the connection.Validate Lock Relay The named owner approves each opening in advance. Request, approval, opening and closure. _3_Incident detected **Act on the alert** Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute Pre-authorised in the Plan. The incident owner is told at once. The alert and the action taken. _4_Controlled response **Change the agreed crossings** Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own.Fracture Automatic only for the crossings you agreed. Anything else needs the incident owner. Each action, timestamped. _5_Reconnection **Check before reopening** Review the request, approval, command and observed state before approving a renewed connection. The operational owner authorises each reconnection. Each check and each reconnection. Engineering and integration ## Fit the control around your existing environment. **Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope. **Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes. **Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window. Testing and evidence ## Prove the selected connection before relying on it. Agree acceptance criteria with the service owner, then retain the observed results. **Normal service**Check the agreed service state and alternate paths. **Controlled change**Verify approved opening, closure and the operational impact. **Recovery and failure**Test reconnection checks, loss of power and loss of the command route. Resilience and recovery ## Offline Secure Storage® OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function. Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures. Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage) Frameworks and limitations ## Support your obligations. Keep the boundaries clear. **What this addresses**Connect approved access and control actions to defined records from supporting systems, without treating a connection change as proof on its own. **What it does not replace**CP-06 does not make an organisation compliant, verify content inside a session or guarantee a complete record. Anchor does not collect or retain records. **Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design. Build your Control Plan ## Start with the connections you would cut first. Start with one access route and list the records an auditor would need to understand it. Questions worth asking ## Before you rely on CP-06. Practical questions for the people who own these connections. Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path. Your next step ## Take the next step with controlled access & assurance. Book a briefing (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a briefing: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/prove-compliance-through-control#webpage", "url": "https://fire-vault.com/control-plan/prove-compliance-through-control", "name": "CP-06 Controlled Access & Assurance", "description": "CP-06 connects approved access to defined control actions, so the organisation can identify the request, authority, selected connection and observed state for…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/prove-compliance-through-control#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/prove-compliance-through-control#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "CP-06 Controlled Access & Assurance", "item": "https://fire-vault.com/control-plan/prove-compliance-through-control" } ] }, { "@context": "https://schema.org", "@type": "WebPage", "name": "CP-06 Controlled Access & Assurance", "description": "CP-06 connects approved access to defined control actions, so the organisation can identify the request, authority, selected connection and observed state for each action in scope.", "url": "https://fire-vault.com/control-plan/prove-compliance-through-control" } ] ```