---
title: "CP-11 Supply Chain Isolation | Control by Firevault"
url: https://fire-vault.com/control-plan/supply-chain-isolation
description: "Keep supplier networks separate from your own environment."
lang: en-GB
---

Control Plan **CP-11**Supply Chain Isolation

Proposed Control Plan. Subject to technical and publication approval.

# One supplier compromised. How far into your environment could it reach?

Image: CP-11 Supply Chain Isolation Control Plan icon (https://fire-vault.com/__l5e/assets-v1/cb5ee537-ae2e-42ff-8e48-4d14fc8a2b11/CP-11_supply-chain-isolation.png)

Keep supplier networks separate from your own environment.

Book a briefing: https://fire-vault.com/demo
See Control in Action

Plan

CP-11

Purpose

Supply Chain Isolation

Selected connections

8

Modules

Fracture · Isolate · Relay · Execute · Validate · Lock

Scope

Supplier support, partner integrations and physical crossings into internal services.

What is at stake

## Why supply chain isolation matters.

Trust in a partner is not a reason to leave every network crossing available.

**Service dependency**Internal services may depend on a supplier route that must be suspended during an investigation.

**Unintended reach**Shared supplier connectivity can expose systems unrelated to the agreed purpose.

**Suspended work**Support and integration work may pause while the supplier and service owners establish scope.

**Accountability**Named owners need a record of the crossing, authorisation and restoration checks.

The problem today

## Where you are IP connected today.

CP-11 reviews eight IP-connected paths in your business. While a path stays connected over IP, it is a route that can be reached, misused or exploited. Each path below carries its own risk to agree with its owner.

**8**IP-connected paths reviewed

**8**Risks to agree with owners

**6**Control modules applied

1. _Risk 1_**Supplier crossing**
   Supplier support network to the engagement zone, including every redundant physical member.
   Whenever this path is open over IP, it is a route that can be reached, misused or exploited.
   **Agreed state:** Disconnected by default
2. _Risk 2_**Partner remote entry**
   Remote access gateway to the supplier-facing zone.
   Whenever this path is open over IP, it is a route that can be reached, misused or exploited.
   **Agreed state:** Disconnected by default
3. _Risk 3_**Support management path**
   Engagement zone to approved internal management interfaces.
   Whenever this path is open over IP, it is a route that can be reached, misused or exploited.
   **Agreed state:** Disconnected by default
4. _Risk 4_**Internal service crossing**
   Engagement zone to the internal services needed for the agreed work.
   Whenever this path is open over IP, it is a route that can be reached, misused or exploited.
   **Agreed state:** State subject to dependency review
5. _Risk 5_**Partner integration path**
   Partner integration gateway to the agreed internal endpoint.
   Whenever this path is open over IP, it is a route that can be reached, misused or exploited.
   **Agreed state:** Disconnected by default
6. _Risk 6_**Secondary supplier route**
   Alternative supplier circuit or site link, including failover.
   Whenever this path is open over IP, it is a route that can be reached, misused or exploited.
   **Agreed state:** Disconnected by default
7. _Risk 7_**Operational support conduit**
   Supplier-facing zone to operational support interfaces, where present.
   Whenever this path is open over IP, it is a route that can be reached, misused or exploited.
   **Agreed state:** Disconnected by default
8. _Risk 8_**Shared supplier hub**
   Aggregated supplier connectivity serving several internal service owners.
   Whenever this path is open over IP, it is a route that can be reached, misused or exploited.
   **Agreed state:** State subject to dependency review

Matching industry Blueprints

What Firevault changes

## What changes with this Plan.

Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.

| Connection | Agreed normal state | Control action |
| --- | --- | --- |
| Supplier crossing | Disconnected by default | Validate checks the request; Relay bounds the window; Isolate groups all supplier entry conduits. |
| Partner remote entry | Disconnected by default | Lock holds access behind supplier identity, role and policy; Fracture withdraws the gateway link on approval. |
| Support management path | Disconnected by default | Relay bounds approved support access; Execute applies the authorised closure through Fracture. |
| Internal service crossing | State subject to dependency review | Fracture withdraws the service crossing; Execute applies the service-owner decision. |
| Partner integration path | Disconnected by default | Relay bounds approved transfers; Fracture closes the defined integration connection. |
| Secondary supplier route | Disconnected by default | Isolate includes the alternate supplier conduit in the same suspension group. |
| Operational support conduit | Disconnected by default | Validate checks joint authority; Execute applies the approved Fracture action. |
| Shared supplier hub | State subject to dependency review | Validate checks joint approval; Isolate groups the hub connections agreed in the register. |

Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

Control in Action

## Supply Chain Isolation: see the selected path change.

Control in Action

Stage

Before agreed physical control

Trust in a partner is not a reason to leave every network crossing available.**Connected routes require review. Discovery checks your real dependencies.**

**0**reached by the attack

**10**still running

Physical crossings

- Supplier crossing _Always connected_
- Partner remote entry _Always connected_
- Support management path _Always connected_
- Internal service crossing _Always connected_
- Recovery access (OSS) _Not in place_
1. _FB_**Fracture** · Review the purpose and ownership of each selected connection.

Illustrative selected connections, not an approved deployment. Agree service dependencies and authorised actions before implementation. This illustration does not predict attack reach or service availability. Offline Secure Storage® remains separate.

The modules involved

## The Control modules behind this Plan.

In CP-11: Check the supplier, purpose and approving owner. In CP-11: Limit connectivity to the approved engagement. In CP-11: Separate the supplier-facing environment from internal services.

### CP-11Supply Chain Isolation

Z0 Requesting environment

Z1 Protected systems

Z2 Related operations

Held in Offline Secure Storage® Selected recovery material, held separately

Out-of-band command path

This Control Plan

#### Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.

Primary modules: Fracture, Isolate, Relay, Execute, Validate and Lock.

Read the operational detail

Module in this plan

Image: Fracture module icon (https://fire-vault.com/__l5e/assets-v1/f709a192-16d2-4206-86f3-842a3200db9d/firebreak-icon.png)

#### Fracture

Controls the path

Physically disconnects network paths to prevent unauthorised access, contain threats and stop an attack from progressing.

Explore the Fracture module (https://fire-vault.com/control/modules/fracture)

Concept illustration. Select any module to see what it does. Placement is drawn from your own network in discovery.

Control Plans that work alongside CP-11

**CP-10****Executive Override**Authorised senior intervention that withdraws predefined connections. _Open CP-10_: https://fire-vault.com/control-plan/executive-override
**CP-12 · Proposed****Privileged Access Control**Administrator access through a controlled network entry point. _Open CP-12_: https://fire-vault.com/control-plan/privileged-access-control
**CP-09****Controlled Data Transfer**A controlled exchange path between two separate environments. _Open CP-09_: https://fire-vault.com/control-plan/controlled-data-transfer

See all Control Plans: https://fire-vault.com/control#blueprints
How Control works: https://fire-vault.com/control

As featured in

- Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough
- Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html
- Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/
- Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/
- Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks

The Control Plan specification

## Each selected connection, written down.

Supplier crossingSupplier support network to the engagement zone, including every redundant physical member._Disconnected by default_

Normal state

Disconnected by default

Authorisation

Tier 1 · Validated engagement expires or a named owner suspends the supplier connection.

Module action

Validate checks the request; Relay bounds the window; Isolate groups all supplier entry conduits.

Business effect

Supplier entry pauses; internal production traffic must not depend on this link.

Failure behaviour

Designed to fail disconnected; confirm safe behaviour and test power loss and faults.

Partner remote entryRemote access gateway to the supplier-facing zone._Disconnected by default_

Normal state

Disconnected by default

Authorisation

Tier 2 · Gateway compromise or disputed remote access requires the supplier owner to suspend entry.

Module action

Lock holds access behind supplier identity, role and policy; Fracture withdraws the gateway link on approval.

Business effect

Remote supplier sessions lose connectivity; local engagement work may continue.

Failure behaviour

Support management pathEngagement zone to approved internal management interfaces._Disconnected by default_

Normal state

Disconnected by default

Authorisation

Tier 1 · Support task completes, authority is withdrawn or the approved suspension rule is met.

Module action

Relay bounds approved support access; Execute applies the authorised closure through Fracture.

Business effect

Supplier management access ends; internal management requires its own authorised route.

Failure behaviour

Internal service crossingEngagement zone to the internal services needed for the agreed work._State subject to dependency review_

Normal state

State subject to dependency review

Authorisation

Tier 2 · Internal service owner approves separation after assessing active transactions.

Module action

Fracture withdraws the service crossing; Execute applies the service-owner decision.

Business effect

The supported integration or service pauses; use the agreed fallback and reconcile incomplete work.

Failure behaviour

Agree with service and operations owners; no assumed failure state.

Partner integration pathPartner integration gateway to the agreed internal endpoint._Disconnected by default_

Normal state

Disconnected by default

Authorisation

Tier 1 · Integration window ends or the defined partner incident rule is met.

Module action

Relay bounds approved transfers; Fracture closes the defined integration connection.

Business effect

Partner exchanges pause; queue and reconcile transactions before resuming.

Failure behaviour

Secondary supplier routeAlternative supplier circuit or site link, including failover._Disconnected by default_

Normal state

Disconnected by default

Authorisation

Tier 2 · Supplier owner suspends the alternate route together with the primary crossing.

Module action

Isolate includes the alternate supplier conduit in the same suspension group.

Business effect

Alternate supplier access is unavailable; confirm no automatic failover restores reach.

Failure behaviour

Operational support conduitSupplier-facing zone to operational support interfaces, where present._Disconnected by default_

Normal state

Disconnected by default

Authorisation

Tier 3 · Supplier and operations owners approve after the safety and continuity review.

Module action

Validate checks joint authority; Execute applies the approved Fracture action.

Business effect

Operational support pauses; local safe operation and escalation must remain available.

Failure behaviour

Shared supplier hubAggregated supplier connectivity serving several internal service owners._State subject to dependency review_

Normal state

State subject to dependency review

Authorisation

Tier 3 · Joint approvers accept the impact across all services sharing the hub.

Module action

Validate checks joint approval; Isolate groups the hub connections agreed in the register.

Business effect

Several supplier-backed services may pause together; enact the joint continuity plan.

Failure behaviour

Operational runbook

## Who does what, and when.

What happens under normal conditions, during approved work, when an incident is detected and when connections are restored.

Stage What happens Who decides On record

_1_Normal operation **Agreed states held**

Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement. Each selected connection sits at its agreed normal state.

Set in the Plan, signed off by your operational, security and continuity leads.

Connection states, continuously.

_2_Approved work **Booked, bounded access**

Validate checks the request; Relay bounds the window; Isolate groups all supplier entry conduits.Relay Validate Lock

The named owner approves each opening in advance.

Request, approval, opening and closure.

_3_Incident detected **Act on the alert**

Your security tools raise an alert. The agreed action starts out of band, without depending on the network under attack.Execute

Pre-authorised in the Plan. The incident owner is told at once.

The alert and the action taken.

_4_Controlled response **Change the agreed crossings**

Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.Fracture Isolate

Automatic only for the crossings you agreed. Anything else needs the incident owner.

Each action, timestamped.

_5_Reconnection **Check before reopening**

Reconnection needs supplier assurance, internal investigation and a fresh service decision. Closing a crossing does not undo activity that already passed it.

The operational owner authorises each reconnection.

Each check and each reconnection.

Engineering and integration

## Fit the control around your existing environment.

**Map the complete boundary**Confirm cabling, redundant links and alternate routes. A selected physical cut does not remove paths outside its scope.

**Agree an independent command route**Confirm the available command methods for the selected hardware. Command delivery can be affected by coverage, roaming and handshakes.

**Test the effect, not just the command**Verify the observed link state, service dependencies and failure behaviour in an agreed test window.

Testing and evidence

## Prove the selected connection before relying on it.

Agree acceptance criteria with the service owner, then retain the observed results.

**Normal service**Check the agreed service state and alternate paths.

**Controlled change**Verify approved opening, closure and the operational impact.

**Recovery and failure**Test reconnection checks, loss of power and loss of the command route.

Resilience and recovery

## Offline Secure Storage®

OSS protects stored business data, recovery copies and retained evidence through physical disconnection. It is a separate storage service, not a Control module or a network containment function.

Control by Firevault governs selected physical connections. Existing detection tools and authorised operators decide when to act. OSS does not detect incidents, command Control or replace operational safety procedures.

Explore Offline Secure Storage (https://fire-vault.com/offline-secure-storage)

Frameworks and limitations

## Support your obligations. Keep the boundaries clear.

**What this addresses**Keep supplier networks separate from your own environment, with only the crossings needed for an approved engagement.

**What it does not replace**Threat detection, identity remediation, cloud-only routes and unregistered alternate connectivity.

**Evidence agreed for the deployment**Specify the requests, approvals, commands, observed states and test results to retain. Logging capability and retention depend on the selected design.

Build your Control Plan

## Start with the connections you would cut first.

List the supplier entry, support and integration paths. Which can close at expiry, which need a service-owner decision, and which carry shared operational dependencies? Use this draft to scope technical review, not as an approved deployment register.

Questions worth asking

## Before you rely on CP-11.

Practical questions for the people who own these connections.

Not by assumption. Map dependencies and agree the acceptable service impact with the operational owner before selecting a path.

Your next step

## Take the next step with supply chain isolation.

Book a briefing (https://fire-vault.com/demo)

Prefer to talk first? Speak to the team: https://fire-vault.com/contact

Book a briefing: https://fire-vault.com/demo
Speak to the team: https://fire-vault.com/contact

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://fire-vault.com/#organization",
    "name": "Firevault",
    "legalName": "Firevault Limited",
    "url": "https://fire-vault.com",
    "logo": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/logo.png",
      "width": 200,
      "height": 60
    },
    "foundingDate": "2025-03",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "address": {
      "@type": "PostalAddress",
      "addressCountry": "GB",
      "addressLocality": "United Kingdom"
    },
    "contactPoint": [
      {
        "@type": "ContactPoint",
        "contactType": "customer service",
        "email": "hello@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      },
      {
        "@type": "ContactPoint",
        "contactType": "sales",
        "email": "sales@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      }
    ],
    "founder": [
      {
        "@type": "Person",
        "name": "Mark Fermor",
        "jobTitle": "Founder, CTO and CMO"
      },
      {
        "@type": "Person",
        "name": "David Bailey",
        "jobTitle": "Founder and CEO"
      }
    ],
    "areaServed": [
      "United Kingdom",
      "Europe",
      "United States",
      "Middle East"
    ],
    "sameAs": [
      "https://www.linkedin.com/company/firevault",
      "https://x.com/firevaultuk"
    ],
    "slogan": "Disconnect to Protect",
    "brand": [
      {
        "@type": "Brand",
        "name": "Offline Secure Storage"
      },
      {
        "@type": "Brand",
        "name": "Control by Firevault"
      },
      {
        "@type": "Brand",
        "name": "Firebreak"
      }
    ],
    "knowsAbout": [
      "Offline Secure Storage",
      "Physically disconnected data storage",
      "Physical Air Gap Data Protection",
      "Ransomware Protection",
      "Ransomware recovery",
      "3-2-1-1-0 backup rule",
      "AI kill switch",
      "Operational technology security",
      "Critical national infrastructure resilience",
      "Data Sovereignty",
      "GDPR Compliance",
      "NIS2 Compliance",
      "DORA Compliance",
      "NCSC Cyber Assessment Framework"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "@id": "https://fire-vault.com/#website",
    "name": "Firevault",
    "alternateName": [
      "Firevault",
      "Firevault UK",
      "Firevault Limited"
    ],
    "url": "https://fire-vault.com",
    "publisher": {
      "@id": "https://fire-vault.com/#organization"
    },
    "inLanguage": "en-GB",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}"
      },
      "query-input": "required name=search_term_string"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "WebPage",
    "@id": "https://fire-vault.com/control-plan/supply-chain-isolation#webpage",
    "url": "https://fire-vault.com/control-plan/supply-chain-isolation",
    "name": "CP-11 Supply Chain Isolation",
    "description": "Keep supplier networks separate from your own environment.",
    "isPartOf": {
      "@id": "https://fire-vault.com/#website"
    },
    "about": {
      "@id": "https://fire-vault.com/#organization"
    },
    "primaryImageOfPage": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/images/og/og-base-platform.jpg"
    },
    "inLanguage": "en-GB",
    "breadcrumb": {
      "@id": "https://fire-vault.com/control-plan/supply-chain-isolation#breadcrumb"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "@id": "https://fire-vault.com/control-plan/supply-chain-isolation#breadcrumb",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://fire-vault.com"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Control Plan",
        "item": "https://fire-vault.com/control-plan"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "CP-11 Supply Chain Isolation",
        "item": "https://fire-vault.com/control-plan/supply-chain-isolation"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebPage",
    "name": "CP-11 Supply Chain Isolation",
    "description": "Keep supplier networks separate from your own environment.",
    "url": "https://fire-vault.com/control-plan/supply-chain-isolation"
  }
]
```