Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control PlanCP-11Supply Chain Isolation

Proposed Control Plan. Subject to technical and publication approval.

One supplier compromised. How far into your environment could it reach?

CP-11 Supply Chain Isolation Control Plan icon

Keep supplier networks separate from your own environment.

Plan
CP-11
Purpose
Supply Chain Isolation
Selected connections
8
Modules
Fracture · Isolate · Relay · Execute · Validate · Lock
Scope
Supplier support, partner integrations and physical crossings into internal services.

What is at stake

Why supply chain isolation matters.

Trust in a partner is not a reason to leave every network crossing available.

Service dependencyInternal services may depend on a supplier route that must be suspended during an investigation.
Unintended reachShared supplier connectivity can expose systems unrelated to the agreed purpose.
Suspended workSupport and integration work may pause while the supplier and service owners establish scope.
AccountabilityNamed owners need a record of the crossing, authorisation and restoration checks.

The problem today

Where you are IP connected today.

CP-11 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

8IP-connected paths reviewed
8Risks to agree with owners
6Control modules applied
  1. Risk 1Supplier crossing

    Supplier support network to the engagement zone, including every redundant physical member.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  2. Risk 2Partner remote entry

    Remote access gateway to the supplier-facing zone.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  3. Risk 3Support management path

    Engagement zone to approved internal management interfaces.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  4. Risk 4Internal service crossing

    Engagement zone to the internal services needed for the agreed work.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: State subject to dependency review

  5. Risk 5Partner integration path

    Partner integration gateway to the agreed internal endpoint.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  6. Risk 6Secondary supplier route

    Alternative supplier circuit or site link, including failover.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  7. Risk 7Operational support conduit

    Supplier-facing zone to operational support interfaces, where present.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: Disconnected by default

  8. Risk 8Shared supplier hub

    Aggregated supplier connectivity serving several internal service owners.

    Whenever this path is open over IP, it is a route that can be reached, misused or exploited.

    Agreed state: State subject to dependency review

Matching industry Blueprints

What Firevault changes

What changes with this Plan.

Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.

Connection Agreed normal state Control action
Supplier crossing Disconnected by default Validate checks the request; Relay bounds the window; Isolate groups all supplier entry conduits.
Partner remote entry Disconnected by default Lock holds access behind supplier identity, role and policy; Fracture withdraws the gateway link on approval.
Support management path Disconnected by default Relay bounds approved support access; Execute applies the authorised closure through Fracture.
Internal service crossing State subject to dependency review Fracture withdraws the service crossing; Execute applies the service-owner decision.
Partner integration path Disconnected by default Relay bounds approved transfers; Fracture closes the defined integration connection.
Secondary supplier route Disconnected by default Isolate includes the alternate supplier conduit in the same suspension group.
Operational support conduit Disconnected by default Validate checks joint authority; Execute applies the approved Fracture action.
Shared supplier hub State subject to dependency review Validate checks joint approval; Isolate groups the hub connections agreed in the register.

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

Control in Action

Supply Chain Isolation: see the selected path change.

Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.

Control in Action

Stage

Before agreed physical control

Trust in a partner is not a reason to leave every network crossing available.Connected routes require review. Discovery checks your real dependencies.

0reached by the attack
10still running

Physical crossings

  • Supplier crossingAlways connected
  • Partner remote entryAlways connected
  • Support management pathAlways connected
  • Internal service crossingAlways connected
  • Recovery access (OSS)Not in place
  1. FBFracture · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

The Control modules behind this Plan.

In CP-11: Check the supplier, purpose and approving owner. In CP-11: Limit connectivity to the approved engagement. In CP-11: Separate the supplier-facing environment from internal services.

CP-11Supply Chain Isolation

Z0Requesting environment
Z1Protected systems
Z2Related operations
Held in Offline Secure Storage®Selected recovery material, held separately
Out-of-band command path

This Control Plan

Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.

Primary modules: Fracture, Isolate, Relay, Execute, Validate and Lock.

Read the operational detail

Module in this plan

Fracture module icon

Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The Control Plan specification

Each selected connection, written down.

Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.

Supplier crossingSupplier support network to the engagement zone, including every redundant physical member.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 1 · Validated engagement expires or a named owner suspends the supplier connection.
Module action
Validate checks the request; Relay bounds the window; Isolate groups all supplier entry conduits.
Business effect
Supplier entry pauses; internal production traffic must not depend on this link.
Failure behaviour
Designed to fail disconnected; confirm safe behaviour and test power loss and faults.
Partner remote entryRemote access gateway to the supplier-facing zone.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 2 · Gateway compromise or disputed remote access requires the supplier owner to suspend entry.
Module action
Lock holds access behind supplier identity, role and policy; Fracture withdraws the gateway link on approval.
Business effect
Remote supplier sessions lose connectivity; local engagement work may continue.
Failure behaviour
Designed to fail disconnected; confirm safe behaviour and test power loss and faults.
Support management pathEngagement zone to approved internal management interfaces.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 1 · Support task completes, authority is withdrawn or the approved suspension rule is met.
Module action
Relay bounds approved support access; Execute applies the authorised closure through Fracture.
Business effect
Supplier management access ends; internal management requires its own authorised route.
Failure behaviour
Designed to fail disconnected; confirm safe behaviour and test power loss and faults.
Internal service crossingEngagement zone to the internal services needed for the agreed work.State subject to dependency review
Normal state
State subject to dependency review
Authorisation
Tier 2 · Internal service owner approves separation after assessing active transactions.
Module action
Fracture withdraws the service crossing; Execute applies the service-owner decision.
Business effect
The supported integration or service pauses; use the agreed fallback and reconcile incomplete work.
Failure behaviour
Agree with service and operations owners; no assumed failure state.
Partner integration pathPartner integration gateway to the agreed internal endpoint.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 1 · Integration window ends or the defined partner incident rule is met.
Module action
Relay bounds approved transfers; Fracture closes the defined integration connection.
Business effect
Partner exchanges pause; queue and reconcile transactions before resuming.
Failure behaviour
Designed to fail disconnected; confirm safe behaviour and test power loss and faults.
Secondary supplier routeAlternative supplier circuit or site link, including failover.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 2 · Supplier owner suspends the alternate route together with the primary crossing.
Module action
Isolate includes the alternate supplier conduit in the same suspension group.
Business effect
Alternate supplier access is unavailable; confirm no automatic failover restores reach.
Failure behaviour
Designed to fail disconnected; confirm safe behaviour and test power loss and faults.
Operational support conduitSupplier-facing zone to operational support interfaces, where present.Disconnected by default
Normal state
Disconnected by default
Authorisation
Tier 3 · Supplier and operations owners approve after the safety and continuity review.
Module action
Validate checks joint authority; Execute applies the approved Fracture action.
Business effect
Operational support pauses; local safe operation and escalation must remain available.
Failure behaviour
Agree with service and operations owners; no assumed failure state.
Shared supplier hubAggregated supplier connectivity serving several internal service owners.State subject to dependency review
Normal state
State subject to dependency review
Authorisation
Tier 3 · Joint approvers accept the impact across all services sharing the hub.
Module action
Validate checks joint approval; Isolate groups the hub connections agreed in the register.
Business effect
Several supplier-backed services may pause together; enact the joint continuity plan.
Failure behaviour
Agree with service and operations owners; no assumed failure state.

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

Operational runbook

Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

StageWhat happensWho decidesOn record
1Normal operationAgreed states held

Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement. Each selected connection sits at its agreed normal state.

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

2Approved workBooked, bounded access

Validate checks the request; Relay bounds the window; Isolate groups all supplier entry conduits.RelayValidateLock

The named owner approves each opening in advance.

Request, approval, opening and closure.

3Incident detectedAct on the alert

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

4Controlled responseChange the agreed crossings

Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.FractureIsolate

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

5ReconnectionCheck before reopening

Reconnection needs supplier assurance, internal investigation and a fresh service decision. Closing a crossing does not undo activity that already passed it.

The operational owner authorises each reconnection.

Each check and each reconnection.

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

Engineering and integration

Fit the control around your existing environment.

Supplier support, partner integrations and physical crossings into internal services.

Map the complete boundaryConfirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.
Agree an independent command routeConfirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.
Test the effect, not just the commandVerify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

Normal serviceCheck the agreed service state and alternate paths.
Controlled changeVerify approved opening, closure and the operational impact.
Recovery and failureTest reconnection checks, loss of power and loss of the command route.

Resilience and recovery

Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Reconnection needs supplier assurance, internal investigation and a fresh service decision. Closing a crossing does not undo activity that already passed it.

Explore Offline Secure Storage

Frameworks and limitations

Support your obligations. Keep the boundaries clear.

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

What this addressesKeep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.
What it does not replaceThreat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.
Evidence agreed for the deploymentSpecify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

Start with the connections you would cut first.

List the supplier entry, support and integration paths. Which can close at expiry, which need a service-owner decision, and which carry shared operational dependencies? Use this draft to scope technical review, not as an approved deployment register.

Questions worth asking

Before you rely on CP-11.

Practical questions for the people who own these connections.

Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.

Supplier support, partner integrations and physical crossings into internal services.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

List the supplier entry, support and integration paths. Which can close at expiry, which need a service-owner decision, and which carry shared operational dependencies? Use this draft to scope technical review, not as an approved deployment register.

Your next step

Take the next step with supply chain isolation.

List the supplier entry, support and integration paths. Which can close at expiry, which need a service-owner decision, and which carry shared operational dependencies? Use this draft to scope technical review, not as an approved deployment register.

Book a briefing

Prefer to talk first? Speak to the team