Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control PlanCP-16Remote Site Isolation

Proposed Control Plan. Subject to technical and publication approval.

One remote site is affected. Which connections should you withdraw?

CP-16 Remote Site Isolation Control Plan icon

Disconnect the communications link to a remote facility.

Plan
CP-16
Purpose
Remote Site Isolation
Selected connections
8
Modules
Fracture · Isolate · Relay · Execute · Validate
Scope
The assessed remote facility communications boundary, support, management and alternate conduits.

What is at stake

Why remote site isolation matters.

Assess the remote facility communications boundary with the remote site operations owner. Record dependencies, approval conditions and verification evidence before a physical connection is changed.

Unnecessary exposureThe remote site communications links can remain available beyond the approved need.
Service impactCentral services may become unavailable. Local operation must be assessed rather than assumed.
Unclear authorityName the remote site operations owner and the conditions for a connection change.
Unverified closureCheck the observed state of the remote site communications links, including parallel routes.

The problem today

Where you are IP connected today.

CP-16 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

8IP-connected paths reviewed
8Risks to agree with owners
5Control modules applied
  1. Risk 1Primary WAN

    Physical hand-off between the remote facility and central network.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

  2. Risk 2Supplier support

    Support gateway into the facility.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  3. Risk 3Site management

    Dedicated facility management connection.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  4. Risk 4Central service path

    Central network to shared facility services.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

  5. Risk 5Exchange connection

    Approved site data exchange route.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  6. Risk 6Secondary WAN

    Backup carrier hand-off and SD-WAN underlay.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

  7. Risk 7Cellular gateway

    Independent mobile router or wireless bridge.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: To assess

  8. Risk 8Local internet edge

    Facility internet gateway independent of central WAN.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Connected

What Firevault changes

What changes with this Plan.

Keep local facility services within the defined physical boundary.

Connection Agreed normal state Control action
Primary WAN Connected Fracture withdraws the authorised connection.
Supplier support Disconnected by default Relay opens a time-bound window; Validate checks approval.
Site management Disconnected by default Relay governs approved access; Fracture withdraws it.
Central service path Connected Fracture withdraws the selected path.
Exchange connection Disconnected by default Transfer governs what moves; Relay limits the window.
Secondary WAN Connected Isolate operates both site conduits as a group.
Cellular gateway To assess Unlink removes persistent dependencies that bypass the control.
Local internet edge Connected Fracture withdraws the selected edge connection.

Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.

Control in Action

Remote Site Isolation: see the selected path change.

Keep local facility services within the defined physical boundary.

Control in Action

Stage

Before agreed physical control

Assess the remote facility communications boundary with the remote site operations owner. Record dependencies, approval conditions and verification evidence before a physical connection is changed.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack
10still running

Physical crossings

  • Primary WANAlways connected
  • Supplier supportAlways connected
  • Site managementAlways connected
  • Central service pathAlways connected
  • Recovery access (OSS)Not in place
  1. FBFracture · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

In CP-16: group C1 and C6, and any other assessed bypass. In CP-16: withdraw the selected facility hand-off. In CP-16: apply only the operationally approved boundary action.

CP-16Remote Site Isolation

Z0Requesting environment
Z1Protected systems
Z2Related operations
Held in Offline Secure Storage®Selected recovery material, held separately
Out-of-band command path

This Control Plan

Keep local facility services within the defined physical boundary.

Primary modules: Fracture, Isolate, Relay, Execute and Validate.

Read the operational detail

Module in this plan

Fracture module icon

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The Control Plan specification

Each selected connection, written down.

Keep local facility services within the defined physical boundary.

Primary WANPhysical hand-off between the remote facility and central network.Connected
Normal state
Connected
Authorisation
Tier 2Site and incident owner approval
Module action
Fracture withdraws the authorised connection.
Business effect
Central applications become unreachable from the site.
Failure behaviour
Assessed and tested with operations
Supplier supportSupport gateway into the facility.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 2Approved support request
Module action
Relay opens a time-bound window; Validate checks approval.
Business effect
Remote supplier sessions are unavailable outside the window.
Failure behaviour
Assessed and tested with operations
Site managementDedicated facility management connection.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 2Named engineering work
Module action
Relay governs approved access; Fracture withdraws it.
Business effect
Remote administration pauses.
Failure behaviour
Assessed and tested with operations
Central service pathCentral network to shared facility services.Connected
Normal state
Connected
Authorisation
Tier 2Joint service impact decision
Module action
Fracture withdraws the selected path.
Business effect
Shared services are lost; local fallback needs testing.
Failure behaviour
Assessed and tested with operations
Exchange connectionApproved site data exchange route.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 2Approved exchange purpose
Module action
Transfer governs what moves; Relay limits the window.
Business effect
Data queues and reconciliation require local procedures.
Failure behaviour
Assessed and tested with operations
Secondary WANBackup carrier hand-off and SD-WAN underlay.Connected
Normal state
Connected
Authorisation
Tier 2Same approval as C1
Module action
Isolate operates both site conduits as a group.
Business effect
Automatic carrier failover cannot bypass the grouped action.
Failure behaviour
Assessed and tested with operations
Cellular gatewayIndependent mobile router or wireless bridge.To assess
Normal state
To assess
Authorisation
Tier 2Site survey and authority review
Module action
Unlink removes persistent dependencies that bypass the control.
Business effect
Device-level cellular radios require separate controls.
Failure behaviour
Assessed and tested with operations
Local internet edgeFacility internet gateway independent of central WAN.Connected
Normal state
Connected
Authorisation
Tier 2Site and service owner approval
Module action
Fracture withdraws the selected edge connection.
Business effect
Cloud access may fail even when local applications continue.
Failure behaviour
Assessed and tested with operations

Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record
1Normal operationAgreed states held

Keep local facility services within the defined physical boundary. Each selected connection sits at its agreed normal state.

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Fracture withdraws the authorised connection.RelayValidate

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Keep local facility services within the defined physical boundary.FractureIsolate

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Assess the remote facility communications boundary with the remote site operations owner. Record dependencies, approval conditions and verification evidence before a physical connection is changed.

The operational owner authorises each reconnection.

Each check and each reconnection.

Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.

Engineering and integration

Fit the control around your existing environment.

The assessed remote facility communications boundary, support, management and alternate conduits.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.
Controlled changeVerify approved opening, closure and the operational impact.
Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Assess the remote facility communications boundary with the remote site operations owner. Record dependencies, approval conditions and verification evidence before a physical connection is changed.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.

What this addressesKeep local facility services within the defined physical boundary.
What it does not replaceDetection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.
Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

Which routes cross the remote facility communications boundary? Which dependencies fail when they are withdrawn? Who can approve the local operating state? Use the draft register to prepare a review, not as deployment approval.

Questions worth asking

Before you rely on CP-16.

Practical questions for the people who own these connections.

Keep local facility services within the defined physical boundary.

The assessed remote facility communications boundary, support, management and alternate conduits.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Detection, malware removal, device radios and safety-system design. Stored data protection is scoped separately.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Which routes cross the remote facility communications boundary? Which dependencies fail when they are withdrawn? Who can approve the local operating state? Use the draft register to prepare a review, not as deployment approval.

Your next step

Take the next step with remote site isolation.

Which routes cross the remote facility communications boundary? Which dependencies fail when they are withdrawn? Who can approve the local operating state? Use the draft register to prepare a review, not as deployment approval.

Book a briefing

Prefer to talk first? Speak to the team