--- title: "Firevault" url: https://fire-vault.com/control-plan/stop-kill-chain-ransomware description: "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you." lang: en-GB --- CP-01 Ransomware Containment Control Plan **CP-01**Ransomware Containment # One compromised device. How much of your business could it reach? Ransomware does not have to stay where an attack begins. Connected systems can give it routes into critical operations, sensitive records and other parts of your business. Control by Firevault lets you physically interrupt selected network connections, helping contain an incident before it spreads further. Build your Control Plan See Control in Action Plan CP-01 Prevents Ransomware spreading between zones Controlled crossings 4, plus recovery access Modules EX · FB · IS · RE · LO · UN Applies to Any organisation, any sector What is at stake ## It rarely stays where it starts. It follows the connections. It usually begins with one laptop: a convincing email, a reused password. From there it moves along the same connections your teams use every day. **The question is not only whether you will spot it. It is whether the route to everything else is still there.** Threats this plan addresses Ransomware Lateral movement Attacks on backups Compromised admin accounts Systems you cannot patch **0 min** average time for an attacker to move from a first foothold into other systems. The fastest was 27 seconds. CrowdStrike 2026 Global Threat Report **£0 m** estimated hit to Marks & Spencer’s operating profit after ransomware paused its online shopping in 2025. BleepingComputer, reporting M&S (https://www.bleepingcomputer.com/news/security/marks-and-spencer-faces-402-million-profit-hit-after-cyberattack/) **0 ** nationally significant cyber incidents handled by the NCSC in the year to August 2025, up from 89. NCSC Annual Review 2025 (https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly) ### It is happened to businesses you know. Each one started with a single way in. Each one ended in disruption customers could see. _Lost revenue_ #### Marks & Spencer2025 Ransomware stopped online orders for **46 days**. Click and collect took 15 weeks to come back. ESM Magazine (https://www.esmmagazine.com/technology/ms-resumes-online-orders-after-46-day-cyberattack-pause-290083) · Business Insurance (https://www.businessinsurance.com/britains-ms-restores-click-and-collect-15-weeks-after-systems-hacked/) _Downtime_ #### Asahi2025 A ransomware attack **halted ordering and shipping** across its business in Japan. Security Affairs (https://securityaffairs.com/183131/cyber-crime/qilin-ransomware-claimed-responsibility-for-the-asahi-attack.html) _Interrupted service_ #### Collins Aerospace2025 Ransomware in shared check-in software disrupted Heathrow, Brussels, Berlin and Dublin. Brussels cancelled **140 of 276** departures in a day. TechRepublic (https://www.techrepublic.com/article/news-eu-airport-ransomware/) The problem today ## You’ll recognise at least one of these. In most organisations, a few permanent connections and inherited trust turn one infected laptop into a business-wide outage. **The flat office network**Every laptop can reach every server, all the time. Nothing physical stands between them. **Admin access that never closes**Admin tools reach critical systems around the clock, whether or not anyone is working. **Backups on the same network**The backups sit where the attacker already is, reachable with the same stolen password. **Systems you cannot patch**Older servers that still run key processes, and cannot take modern security tools. **One site infected, every site down**Links between offices and plants are permanent, so ransomware travels with the data. **The weekend attack**Ransomware often runs overnight, when nobody is there to pull a cable. What Firevault changes ## One laptop. Not the whole business. Your security tools raise the alarm. Following the agreed authorisation, Execute initiates a command to withdraw selected connections. Containment depends on command delivery, processing, the physical response and any other routes still available. | Item | Detect and respond | Pull the plug | CP-01 | | --- | --- | --- | --- | | How quickly it is contained | Minutes to hours | Minutes, if someone is on site | On authorisation, once the command is delivered and processed, with no site visit | | What stops | One device at a time | Whole sites, all or nothing | Only the crossings you chose in advance | | Works if security tools are disabled | No | Yes | Yes, a physical path | | Critical systems and backups | Reachable until isolated | Offline with everything else | Cut off from the infection, still running | | A record for your board | Alerts only | No | Yes, for configured actions | | Item | Today | With CP-01 | During an incident | | --- | --- | --- | --- | | File sync Business network to critical systems | Always connected | Connected, Firebreak® ready | Cut at Layer 1 | | Admin route | Always connected | Disconnected. Opened for booked work | Stays disconnected | | Backup route | Always connected | Disconnected outside the backup window | Stays disconnected | | Order flow Critical systems to operations | Always connected | Connected, Firebreak® ready | Cut at Layer 1 | | Clean recovery copy | On the network, if one exists | In Offline Secure Storage®, physically disconnected | Untouched | **What keeps operating:** critical systems, operations and backups. Only the crossings in the plan change state. Control in Action ## Watch the crossings change state. Step through a normal day, a booked admin window, a ransomware incident and recovery. Every change you see is physical, at a crossing agreed in advance. Control in Action Stage Every crossing is permanently connected. Without Control, the routes between zones are always on. One infected laptop has a path to everything, including the backups.**10 of 10 systems reached, backups included.** **10**reached by the attack **0**still running Physical crossings - File sync _Always connected_ - Admin route _Always connected_ - Backup route _Always connected_ - Order flow _Always connected_ - Recovery access (OSS) _Not in place_ 1. _!_**Infected** · Laptops 2. _+_**Spread to** · File shares, Logins 3. _+_**Spread to** · Admin tools, Orders and stock 4. _+_**Spread to** · Backup server, Finance, Warehouse 5. _+_**Spread to** · Online shop, Sites Concept only, with time compressed. An actual Control Plan accounts for approved connection states, dependent systems, safe failure behaviour and operating constraints. Offline Secure Storage® is deployed separately, with its own access. The modules involved ## Three Control modules. One clear job each. Execute initiates the approved command. Fracture withdraws the selected crossing through Firebreak® hardware after command delivery and processing; Isolate defines the zone separation. Relay, Lock and Unlink manage the admin window. Select a module to see what it does. ### CP-01Ransomware Containment Z0 Internet and email Z1 Business network Z2 Critical systems Held in Offline Secure Storage® Clean recovery copies Out-of-band command path This Control Plan #### Stop ransomware spreading from the business network into the systems you cannot run without. Primary modules: Fracture, Isolate and Execute. Read the specification Module in this plan Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png) #### Fracture Controls the path Physically open or close the path. Controls whether a connection path exists at all. It cuts the physical link, so an attack has no route to spread, rather than inspecting traffic or relying on rule settings. Explore the Fracture module (https://fire-vault.com/control/modules/fracture) Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery. Control Plans that work alongside CP-01 CP-02**Incident Containment**When an attacker is already active, contain them at the physical layer. Read CP-02: https://fire-vault.com/control-plan/contain-active-breaches CP-03**Third-Party Access**Supplier and vendor access that is open only for booked work. Read CP-03: https://fire-vault.com/control-plan/control-third-party-access CP-04**Physical Segmentation**Boundaries between zones that you can physically enforce. Read CP-04: https://fire-vault.com/control-plan/enforce-physical-segmentation See all Control Plans: https://fire-vault.com/control#blueprints How Control works: https://fire-vault.com/control As featured in - Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough - Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html - Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/ - Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/ - Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks The Control Plan specification ## Every crossing, written down. The connection register defines each protected route: its normal state, who can change it, how the command gets there, what happens in an incident and what evidence is kept. File syncBusiness network to critical systems_Connected · ready to cut_ Protected route The file sync link from the business network to critical systems Normal state Connected, with Firebreak® in place Authorisation Selected cuts may be pre-authorised for defined high-confidence alerts. Other requests need the incident owner. Action follows delivery and processing of an authenticated command Enforcement Firebreak® at the physical crossing between the two zones Control signal Authenticated API from your security tools, out of band. SMS, the web panel or a physical key as fallback Incident response Cut on a high-confidence alert, as agreed in the plan Reconnection After agreed security and operational checks, signed off by the incident owner Evidence Alert, command, observed state, timestamps and restoration, logged locally and to SysLog Admin routeAdmin tools to critical systems_Disconnected_ Protected route The admin route from admin tools to critical systems Normal state Disconnected Authorisation Named admin, validated request and approved work window Enforcement Firebreak® at the crossing. Relay opens it, Lock restricts it, Unlink removes it Control signal Authorised out-of-band command Incident response Stays disconnected. Any open window is closed Reconnection Only for the next approved window Evidence Request, approval, user, open and close commands, observed state and timestamps Backup routeBusiness network to the backup zone_Disconnected_ Protected route The backup route from the business network to the backup zone Normal state Disconnected outside the backup window Authorisation The backup schedule agreed in the plan Enforcement Firebreak® at the crossing to the backup zone Control signal Scheduled, out-of-band command Incident response Closed and held closed Reconnection After checks confirm the source is clean Evidence Each window, command, observed state and timestamp Order flowCritical systems to operations_Connected · ready to cut_ Protected route The order flow from critical systems to operations Normal state Connected, with Firebreak® in place Authorisation Enforcement Control signal Authenticated API, out of band, with the same fallbacks Incident response Cut on a high-confidence alert. Operations continues under the fallback agreed in the plan Reconnection After agreed checks, signed off by the incident owner and operations Evidence Alert, command, observed state, timestamps and restoration ### Failure modes and limits #### If a crossing is cut by mistake Only crossings whose loss you have agreed can be cut automatically. The impact is limited to that crossing, for example file sync pausing, and the incident owner can reverse it. #### If the command path fails Each crossing can take commands by authenticated API, SMS, the web panel or a physical key on site. How each crossing behaves if every path is lost is agreed in the plan and tested. #### What CP-01 does not protect against Ransomware inside the zone where it starts, data stolen before a cut, or attacks that never cross a controlled boundary. Detection, endpoint protection and recovery still matter. Operational runbook ## Who does what, and when. What happens under normal conditions, during maintenance, when an incident is detected and when systems are restored. Stage What happens Who decides On record _1_Normal conditions **No standing routes** Admin and backup routes stay disconnected. File sync and order flow stay connected, with Firebreak® ready.Unlink Fracture Set in the plan, signed off by your IT, security and continuity leads. Crossing states, continuously. _2_Maintenance **Booked admin windows** Relay opens the admin route for booked work, Lock limits it to the named admin and Unlink removes it afterwards.Relay Lock Unlink A named admin books each window. Request, approval, open and close. _3_Incident detected **Act on the alert** Your security tools raise a high-confidence alert. Execute starts the agreed action, out of band.Execute Pre-authorised in the plan. The incident owner is told at once. The alert and the action taken. _4_Containment **Cut and hold** Firebreak® cuts the crossings out of the infected zone at Layer 1. Isolate holds every other zone apart.Fracture Isolate Automatic only for the crossings you agreed. Anything else needs the incident owner. Each configured cut, timestamped. _5_Restore **Rebuild the infected zone** The infected zone is rebuilt from a clean copy held in Offline Secure Storage®, while the rest of the business keeps running. Your IT team, with our support. Each recovery step. _6_Reconnection **Back to normal** Crossings are reconnected one at a time, after the checks agreed in the plan. The incident owner signs off each reconnection. Each reconnection, approved and recorded. **Exceptions.** The incident owner can reverse any automatic action. If remote command paths are unavailable, a physical key on site still works. Engineering and integration ## Works with what you have. Enforced at Layer 1. CP-01 does not replace your firewalls, SIEM or endpoint tools. It adds a physical layer they can act through, and that an attacker cannot switch off from inside the network. **01**Independent zones ### Cut off the infected network. Keep everything else. **What we engineered:** The business network, critical systems, operations and backups are separate zones. Any one can be cut off without touching the others. **The result:** One infected laptop does not become a company-wide outage. Stopping lateral movement (https://fire-vault.com/control-plan/stop-kill-chain-ransomware) **02**Out-of-band command path ### Take control through an independent command path. **What we engineered:** An independently governed command path for authorised connection changes. Available methods and operating conditions are agreed for the deployment. **The result:** Authorised connection decisions do not depend solely on the affected production path. Command availability still needs to be verified. Protecting the management plane (https://fire-vault.com/control-plan/privileged-access-control) **03**An evidential record ### Configured actions, on record. **What we engineered:** Configured cuts, approvals and reconnections are timestamped and logged locally and, where integrated, to SysLog. **The result:** A clear account for your board, insurer and regulator. Control in a live incident (https://fire-vault.com/control-plan/contain-active-breaches) ### How it fits your environment **Firewalls**Stay as they are. Firebreak® sits at the physical crossing and decides whether a path exists. Your firewalls still decide what crosses it. **SIEM and SOAR**High-confidence alerts can trigger Execute by authenticated API. Configured actions can be logged to SysLog for your SIEM. **Endpoint protection**Your EDR still detects and isolates devices. CP-01 limits how far an infection can travel if something gets past it. **Network topology**Crossings sit on the physical links between zones, fibre or copper, chosen with you in discovery. **Change and incident processes**Booked windows, named approvers and reconnection sign-off fit the processes you already run. **Installation dependencies**Space and power at each crossing, a management connection or mobile signal for commands, a SysLog destination and a planned test window. Testing and evidence ## Proven before you rely on it. Each crossing is tested in a planned window. These are the acceptance criteria, and the evidence kept for your board, insurer and regulator. | Item | Passes when | Evidence retained | | --- | --- | --- | | The crossing disconnects | No physical path exists across the crossing, confirmed from both sides. | The command, the observed state and timestamps. | | Unauthorised access is prevented | A connection attempt outside an approved window fails. | The attempt and the crossing state at the time. | | Dependent services continue | Critical systems, operations and backups keep running while the crossing is cut. | Service checks taken during the test. | | Approved access opens and closes | The window opens for the named admin only, and the route is removed when it ends. | Request, approval, open and close records. | | Restoration is recorded | Each reconnection follows the agreed checks and sign-off. | Checks, sign-off and timestamps. | Resilience and recovery ## Stop the spread. Keep a clean copy. Stopping ransomware spreading is a Control job. Keeping a recovery copy out of reach belongs to Offline Secure Storage®: a separate, physically disconnected environment with its own access and recovery arrangements. - Clean recovery copies of the systems you would rebuild - Configurations and evidence you will need afterwards - Access authorised for recovery only, then disconnected again Explore Offline Secure Storage®: https://fire-vault.com/offline-secure-storage Frameworks and limitations ## What it supports. What it does not. CP-01 can help support these frameworks. It does not make you compliant on its own, and it is not a substitute for detection or recovery. #### Grounded in recognised frameworks 1. _1_**MITRE ATT&CK**Lateral movement (TA0008) and attacks on recovery (T1490). 2. _2_**IEC 62443-3-3**SR 5.1 network segmentation and SR 5.2 zone boundary protection. 3. _3_**NCSC guidance**Mitigating malware and ransomware attacks. 4. _4_**NIS2 and DORA**Incident handling, business continuity and backups, for the organisations they cover. #### Evidence you keep 1. _1_**Crossing register**Every crossing in scope and its normal state. 2. _2_**Commands and states**Every command, approval and observed state, timestamped and sent to SysLog. 3. _3_**Test results**Results against the acceptance criteria for each crossing. 4. _4_**Reconnection**The checks and sign-off for every restored crossing. Technical guide #### CP-01 Ransomware Containment - The challenge, and where ransomware usually spreads - The control architecture and module placement - The connection register and decision rules - Testing, evidence and reconnection Request the guide (https://fire-vault.com/contact) ### What CP-01 does - **Cuts the crossings you chose**, physically, at Layer 1. - **Keeps critical systems running** while the infected zone is dealt with. - **Works when your network is under attack**, because commands travel out of band. - **Records configured actions** for your board, insurer and regulator. ### What it does not do - **Detect ransomware.** Your security tools do that, and CP-01 acts on them. - **Clean infected machines.** That is recovery, from a clean copy. - **Stop spread inside the zone where it starts.** That zone is rebuilt. - **Make you compliant on its own.** It can help support your obligations. Build your Control Plan ## Start with the connections you would cut first. Tick anything that sounds familiar. You’ll see where your discovery session would start, and which modules it would use. Questions worth asking ## Before you rely on CP-01. Your engineers will want detail. Your board will want evidence. Here are the practical answers. No. Keep them. Your security tools spot ransomware. CP-01 gives you a physical way to stop it spreading, and keeps admin and backup routes closed until they are needed. Only high-confidence detections can trigger an automatic action, and only on connections whose loss you have agreed in advance. Your incident owner is told straight away and can reverse it. No. It cuts only the connections in your plan. Critical systems keep running, and other sites and teams carry on. The route to your backups stays physically disconnected outside the backup window, and closes on an alert. For a copy that is always out of reach, pair CP-01 with Offline Secure Storage®. By authenticated API from your security tools, by cellular SMS or the web panel, or with a physical key on site. None of these travel over the network under attack. No. Firebreak® decides whether a path exists rather than inspecting what travels on it, and it keeps its control and data layers completely separate. With a discovery session. We agree the first connection to control, who decides and what must keep running, then test it before you rely on it. See all questions: https://fire-vault.com/learn/faq Your next step ## Decide where ransomware stops. A working session on your network: the crossings you would control first, who decides, and the evidence your board will ask for. Build your Control Plan (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a demo: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/stop-kill-chain-ransomware#webpage", "url": "https://fire-vault.com/control-plan/stop-kill-chain-ransomware", "name": "Firevault", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/stop-kill-chain-ransomware#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/stop-kill-chain-ransomware#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "Firevault", "item": "https://fire-vault.com/control-plan/stop-kill-chain-ransomware" } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "WebPage", "@id": "/control-plan/stop-kill-chain-ransomware#webpage", "url": "/control-plan/stop-kill-chain-ransomware", "name": "CP-01 Ransomware Containment", "inLanguage": "en-GB", "publisher": { "@id": "/#org" } }, { "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Does CP-01 replace our security tools?", "acceptedAnswer": { "@type": "Answer", "text": "No. Keep them. Your security tools spot ransomware. CP-01 gives you a physical way to stop it spreading, and keeps admin and backup routes closed until they are needed." } }, { "@type": "Question", "name": "What if the alert is wrong?", "acceptedAnswer": { "@type": "Answer", "text": "Only high-confidence detections can trigger an automatic action, and only on connections whose loss you have agreed in advance. Your incident owner is told straight away and can reverse it." } }, { "@type": "Question", "name": "Will it shut down the whole business?", "acceptedAnswer": { "@type": "Answer", "text": "No. It cuts only the connections in your plan. Critical systems keep running, and other sites and teams carry on." } }, { "@type": "Question", "name": "What about our backups?", "acceptedAnswer": { "@type": "Answer", "text": "The route to your backups stays physically disconnected outside the backup window, and closes on an alert. For a copy that is always out of reach, pair CP-01 with Offline Secure Storage®." } }, { "@type": "Question", "name": "How is the command sent?", "acceptedAnswer": { "@type": "Answer", "text": "By authenticated API from your security tools, by cellular SMS or the web panel, or with a physical key on site. None of these travel over the network under attack." } }, { "@type": "Question", "name": "Does CP-01 inspect our traffic?", "acceptedAnswer": { "@type": "Answer", "text": "No. Firebreak® decides whether a path exists rather than inspecting what travels on it, and it keeps its control and data layers completely separate." } }, { "@type": "Question", "name": "Where do we start?", "acceptedAnswer": { "@type": "Answer", "text": "With a discovery session. We agree the first connection to control, who decides and what must keep running, then test it before you rely on it." } } ] } ] } ] ```