CP-01 Ransomware Containment

Control PlanCP-01Ransomware Containment

One compromised device.How much of your business could it reach?

Ransomware does not have to stay where an attack begins. Connected systems can give it routes into critical operations, sensitive records and other parts of your business. Control by Firevault lets you physically interrupt selected network connections, helping contain an incident before it spreads further.

Build your Control Plan See Control in Action

Plan: CP-01
Prevents: Ransomware spreading between zones
Controlled crossings: 4, plus recovery access
Modules: EX · FB · IS · RE · LO · UN
Applies to: Any organisation, any sector

What is at stake

It rarely stays where it starts. It follows the connections.

It usually begins with one laptop: a convincing email, a reused password. From there it moves along the same connections your teams use every day. The question is not only whether you will spot it. It is whether the route to everything else is still there.

Threats this plan addresses

RansomwareLateral movementAttacks on backupsCompromised admin accountsSystems you cannot patch

0min

average time for an attacker to move from a first foothold into other systems. The fastest was 27 seconds.

CrowdStrike 2026 Global Threat Report

£0m

estimated hit to Marks & Spencer’s operating profit after ransomware paused its online shopping in 2025.

BleepingComputer, reporting M&S

nationally significant cyber incidents handled by the NCSC in the year to August 2025, up from 89.

NCSC Annual Review 2025

It is happened to businesses you know.

Each one started with a single way in. Each one ended in disruption customers could see.

Lost revenue

Marks & Spencer2025

Ransomware stopped online orders for 46 days. Click and collect took 15 weeks to come back.

ESM Magazine · Business Insurance

Downtime

Asahi2025

A ransomware attack halted ordering and shipping across its business in Japan.

Security Affairs

Interrupted service

Collins Aerospace2025

Ransomware in shared check-in software disrupted Heathrow, Brussels, Berlin and Dublin. Brussels cancelled 140 of 276 departures in a day.

TechRepublic

The problem today

You’ll recognise at least one of these.

In most organisations, a few permanent connections and inherited trust turn one infected laptop into a business-wide outage.

The flat office networkEvery laptop can reach every server, all the time. Nothing physical stands between them.

Admin access that never closesAdmin tools reach critical systems around the clock, whether or not anyone is working.

Backups on the same networkThe backups sit where the attacker already is, reachable with the same stolen password.

Systems you cannot patchOlder servers that still run key processes, and cannot take modern security tools.

One site infected, every site downLinks between offices and plants are permanent, so ransomware travels with the data.

The weekend attackRansomware often runs overnight, when nobody is there to pull a cable.

What Firevault changes

One laptop. Not the whole business.

Your security tools raise the alarm. Following the agreed authorisation, Execute initiates a command to withdraw selected connections. Containment depends on command delivery, processing, the physical response and any other routes still available.

Item	Detect and respond	Pull the plug	CP-01
How quickly it is contained	Minutes to hours	Minutes, if someone is on site	On authorisation, once the command is delivered and processed, with no site visit
What stops	One device at a time	Whole sites, all or nothing	Only the crossings you chose in advance
Works if security tools are disabled	No	Yes	Yes, a physical path
Critical systems and backups	Reachable until isolated	Offline with everything else	Cut off from the infection, still running
A record for your board	Alerts only	No	Yes, for configured actions

What physically changes at each crossing
Item	Today	With CP-01	During an incident
File sync Business network to critical systems	Always connected	Connected, Firebreak® ready	Cut at Layer 1
Admin route	Always connected	Disconnected. Opened for booked work	Stays disconnected
Backup route	Always connected	Disconnected outside the backup window	Stays disconnected
Order flow Critical systems to operations	Always connected	Connected, Firebreak® ready	Cut at Layer 1
Clean recovery copy	On the network, if one exists	In Offline Secure Storage®, physically disconnected	Untouched

What keeps operating: critical systems, operations and backups. Only the crossings in the plan change state.

Control in Action

Watch the crossings change state.

Step through a normal day, a booked admin window, a ransomware incident and recovery. Every change you see is physical, at a crossing agreed in advance.

Control in Action

Stage

Every crossing is permanently connected.

Without Control, the routes between zones are always on. One infected laptop has a path to everything, including the backups.10 of 10 systems reached, backups included.

10reached by the attack

0still running

Physical crossings

File syncAlways connected
Admin routeAlways connected
Backup routeAlways connected
Order flowAlways connected
Recovery access (OSS)Not in place

!Infected · Laptops
+Spread to · File shares, Logins
+Spread to · Admin tools, Orders and stock
+Spread to · Backup server, Finance, Warehouse
+Spread to · Online shop, Sites

Concept only, with time compressed. An actual Control Plan accounts for approved connection states, dependent systems, safe failure behaviour and operating constraints. Offline Secure Storage® is deployed separately, with its own access.

The modules involved

Three Control modules. One clear job each.

Execute initiates the approved command. Fracture withdraws the selected crossing through Firebreak® hardware after command delivery and processing; Isolate defines the zone separation. Relay, Lock and Unlink manage the admin window. Select a module to see what it does.

CP-01Ransomware Containment

Z0Internet and email

Z1Business network

Z2Critical systems

Held in Offline Secure Storage®Clean recovery copies

Out-of-band command path

This Control Plan

Stop ransomware spreading from the business network into the systems you cannot run without.

Primary modules: Fracture, Isolate and Execute.

Read the specification

Module in this plan

Fracture

Controls the path

Physically open or close the path.

Controls whether a connection path exists at all. It cuts the physical link, so an attack has no route to spread, rather than inspecting traffic or relying on rule settings.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

Control Plans that work alongside CP-01

CP-02Incident ContainmentWhen an attacker is already active, contain them at the physical layer.Read CP-02

CP-03Third-Party AccessSupplier and vendor access that is open only for booked work.Read CP-03

CP-04Physical SegmentationBoundaries between zones that you can physically enforce.Read CP-04

See all Control Plans How Control works

As featured in

The Control Plan specification

Every crossing, written down.

The connection register defines each protected route: its normal state, who can change it, how the command gets there, what happens in an incident and what evidence is kept.

File syncBusiness network to critical systemsConnected · ready to cut

Protected route: The file sync link from the business network to critical systems
Normal state: Connected, with Firebreak® in place
Authorisation: Selected cuts may be pre-authorised for defined high-confidence alerts. Other requests need the incident owner. Action follows delivery and processing of an authenticated command
Enforcement: Firebreak® at the physical crossing between the two zones
Control signal: Authenticated API from your security tools, out of band. SMS, the web panel or a physical key as fallback
Incident response: Cut on a high-confidence alert, as agreed in the plan
Reconnection: After agreed security and operational checks, signed off by the incident owner
Evidence: Alert, command, observed state, timestamps and restoration, logged locally and to SysLog

Admin routeAdmin tools to critical systemsDisconnected

Protected route: The admin route from admin tools to critical systems
Normal state: Disconnected
Authorisation: Named admin, validated request and approved work window
Enforcement: Firebreak® at the crossing. Relay opens it, Lock restricts it, Unlink removes it
Control signal: Authorised out-of-band command
Incident response: Stays disconnected. Any open window is closed
Reconnection: Only for the next approved window
Evidence: Request, approval, user, open and close commands, observed state and timestamps

Backup routeBusiness network to the backup zoneDisconnected

Protected route: The backup route from the business network to the backup zone
Normal state: Disconnected outside the backup window
Authorisation: The backup schedule agreed in the plan
Enforcement: Firebreak® at the crossing to the backup zone
Control signal: Scheduled, out-of-band command
Incident response: Closed and held closed
Reconnection: After checks confirm the source is clean
Evidence: Each window, command, observed state and timestamp

Order flowCritical systems to operationsConnected · ready to cut

Protected route: The order flow from critical systems to operations
Normal state: Connected, with Firebreak® in place
Authorisation: Selected cuts may be pre-authorised for defined high-confidence alerts. Other requests need the incident owner. Action follows delivery and processing of an authenticated command
Enforcement: Firebreak® at the physical crossing between the two zones
Control signal: Authenticated API, out of band, with the same fallbacks
Incident response: Cut on a high-confidence alert. Operations continues under the fallback agreed in the plan
Reconnection: After agreed checks, signed off by the incident owner and operations
Evidence: Alert, command, observed state, timestamps and restoration

Failure modes and limits

If a crossing is cut by mistake

Only crossings whose loss you have agreed can be cut automatically. The impact is limited to that crossing, for example file sync pausing, and the incident owner can reverse it.

If the command path fails

Each crossing can take commands by authenticated API, SMS, the web panel or a physical key on site. How each crossing behaves if every path is lost is agreed in the plan and tested.

What CP-01 does not protect against

Ransomware inside the zone where it starts, data stolen before a cut, or attacks that never cross a controlled boundary. Detection, endpoint protection and recovery still matter.

Operational runbook

Who does what, and when.

What happens under normal conditions, during maintenance, when an incident is detected and when systems are restored.

StageWhat happensWho decidesOn record

1Normal conditionsNo standing routes

Admin and backup routes stay disconnected. File sync and order flow stay connected, with Firebreak® ready.UnlinkFracture

Set in the plan, signed off by your IT, security and continuity leads.

Crossing states, continuously.

2MaintenanceBooked admin windows

Relay opens the admin route for booked work, Lock limits it to the named admin and Unlink removes it afterwards.RelayLockUnlink

A named admin books each window.

Request, approval, open and close.

3Incident detectedAct on the alert

Your security tools raise a high-confidence alert. Execute starts the agreed action, out of band.Execute

Pre-authorised in the plan. The incident owner is told at once.

The alert and the action taken.

4ContainmentCut and hold

Firebreak® cuts the crossings out of the infected zone at Layer 1. Isolate holds every other zone apart.FractureIsolate

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each configured cut, timestamped.

5RestoreRebuild the infected zone

The infected zone is rebuilt from a clean copy held in Offline Secure Storage®, while the rest of the business keeps running.

Your IT team, with our support.

Each recovery step.

6ReconnectionBack to normal

Crossings are reconnected one at a time, after the checks agreed in the plan.

The incident owner signs off each reconnection.

Each reconnection, approved and recorded.

Exceptions. The incident owner can reverse any automatic action. If remote command paths are unavailable, a physical key on site still works.

Engineering and integration

Works with what you have. Enforced at Layer 1.

CP-01 does not replace your firewalls, SIEM or endpoint tools. It adds a physical layer they can act through, and that an attacker cannot switch off from inside the network.

01Independent zones

Cut off the infected network. Keep everything else.

What we engineered: The business network, critical systems, operations and backups are separate zones. Any one can be cut off without touching the others.

The result: One infected laptop does not become a company-wide outage.

Stopping lateral movement

02Out-of-band command path

Take control through an independent command path.

What we engineered: An independently governed command path for authorised connection changes. Available methods and operating conditions are agreed for the deployment.

The result: Authorised connection decisions do not depend solely on the affected production path. Command availability still needs to be verified.

Protecting the management plane

03An evidential record

Configured actions, on record.

What we engineered: Configured cuts, approvals and reconnections are timestamped and logged locally and, where integrated, to SysLog.

The result: A clear account for your board, insurer and regulator.

Control in a live incident

How it fits your environment

FirewallsStay as they are. Firebreak® sits at the physical crossing and decides whether a path exists. Your firewalls still decide what crosses it.

SIEM and SOARHigh-confidence alerts can trigger Execute by authenticated API. Configured actions can be logged to SysLog for your SIEM.

Endpoint protectionYour EDR still detects and isolates devices. CP-01 limits how far an infection can travel if something gets past it.

Network topologyCrossings sit on the physical links between zones, fibre or copper, chosen with you in discovery.

Change and incident processesBooked windows, named approvers and reconnection sign-off fit the processes you already run.

Installation dependenciesSpace and power at each crossing, a management connection or mobile signal for commands, a SysLog destination and a planned test window.

Testing and evidence

Proven before you rely on it.

Each crossing is tested in a planned window. These are the acceptance criteria, and the evidence kept for your board, insurer and regulator.

Item	Passes when	Evidence retained
The crossing disconnects	No physical path exists across the crossing, confirmed from both sides.	The command, the observed state and timestamps.
Unauthorised access is prevented	A connection attempt outside an approved window fails.	The attempt and the crossing state at the time.
Dependent services continue	Critical systems, operations and backups keep running while the crossing is cut.	Service checks taken during the test.
Approved access opens and closes	The window opens for the named admin only, and the route is removed when it ends.	Request, approval, open and close records.
Restoration is recorded	Each reconnection follows the agreed checks and sign-off.	Checks, sign-off and timestamps.

Resilience and recovery

Stop the spread. Keep a clean copy.

Stopping ransomware spreading is a Control job. Keeping a recovery copy out of reach belongs to Offline Secure Storage®: a separate, physically disconnected environment with its own access and recovery arrangements.

Clean recovery copies of the systems you would rebuild
Configurations and evidence you will need afterwards
Access authorised for recovery only, then disconnected again

Explore Offline Secure Storage®

Frameworks and limitations

What it supports. What it does not.

CP-01 can help support these frameworks. It does not make you compliant on its own, and it is not a substitute for detection or recovery.

Grounded in recognised frameworks

1MITRE ATT&CKLateral movement (TA0008) and attacks on recovery (T1490).
2IEC 62443-3-3SR 5.1 network segmentation and SR 5.2 zone boundary protection.
3NCSC guidanceMitigating malware and ransomware attacks.
4NIS2 and DORAIncident handling, business continuity and backups, for the organisations they cover.

Evidence you keep

1Crossing registerEvery crossing in scope and its normal state.
2Commands and statesEvery command, approval and observed state, timestamped and sent to SysLog.
3Test resultsResults against the acceptance criteria for each crossing.
4ReconnectionThe checks and sign-off for every restored crossing.

Technical guide

CP-01 Ransomware Containment

The challenge, and where ransomware usually spreads
The control architecture and module placement
The connection register and decision rules
Testing, evidence and reconnection

Request the guide

What CP-01 does

Cuts the crossings you chose, physically, at Layer 1.
Keeps critical systems running while the infected zone is dealt with.
Works when your network is under attack, because commands travel out of band.
Records configured actions for your board, insurer and regulator.

What it does not do

Detect ransomware. Your security tools do that, and CP-01 acts on them.
Clean infected machines. That is recovery, from a clean copy.
Stop spread inside the zone where it starts. That zone is rebuilt.
Make you compliant on its own. It can help support your obligations.

Build your Control Plan

Start with the connections you would cut first.

Tick anything that sounds familiar. You’ll see where your discovery session would start, and which modules it would use.

Questions worth asking

Before you rely on CP-01.

Your engineers will want detail. Your board will want evidence. Here are the practical answers.

No. Keep them. Your security tools spot ransomware. CP-01 gives you a physical way to stop it spreading, and keeps admin and backup routes closed until they are needed.

Only high-confidence detections can trigger an automatic action, and only on connections whose loss you have agreed in advance. Your incident owner is told straight away and can reverse it.

No. It cuts only the connections in your plan. Critical systems keep running, and other sites and teams carry on.

The route to your backups stays physically disconnected outside the backup window, and closes on an alert. For a copy that is always out of reach, pair CP-01 with Offline Secure Storage®.

By authenticated API from your security tools, by cellular SMS or the web panel, or with a physical key on site. None of these travel over the network under attack.

No. Firebreak® decides whether a path exists rather than inspecting what travels on it, and it keeps its control and data layers completely separate.

With a discovery session. We agree the first connection to control, who decides and what must keep running, then test it before you rely on it.

See all questions

Your next step

Decide where ransomware stops.

A working session on your network: the crossings you would control first, who decides, and the evidence your board will ask for.

Build your Control Plan

Prefer to talk first? Speak to the team

Book a demo Speak to the team