--- title: "Control Plans" url: https://fire-vault.com/control-plans description: "Firevault Control Plans: proven, repeatable methods for physically controlling network connections, from ransomware containment to supplier access and AI…" lang: en-GB --- Image: Control Plans emblem (https://fire-vault.com/__l5e/assets-v1/e1c1f673-a1f9-41ae-a50c-85edff77a308/control-plans-icon.png) Control Plans **CP-01 to CP-20**The method library # One problem. One plan. A physical answer to each. A Control Plan describes a repeatable method for one security problem: which connections to remove, control, isolate or open only when they are needed, who decides, and how it is checked. Find the plan that matches the problem you are trying to solve. Find your Control Plan Build your Control Plan Control Plans 20 in the library Control modules 9 Every plan includes Register, runbook and acceptance tests Applies to Any organisation, any sector Applied by industry Industry Blueprints: https://fire-vault.com/control-blueprints Find your Control Plan ## Start with the problem. Find the plan. Every plan is built for one problem. Filter by the problem you are facing, or search by module or keyword. Showing 20 Control Plans Image: CP-01 icon (https://fire-vault.com/__l5e/assets-v1/08d01aa5-44c8-40a0-95a0-7f70abc2e21a/CP-01_ransomware-containment.png) **CP-01** ### Ransomware Containment Cut the paths ransomware uses to spread before encryption reaches critical systems. Open CP-01 (https://fire-vault.com/control-plan/stop-kill-chain-ransomware) Image: CP-02 icon (https://fire-vault.com/__l5e/assets-v1/744125a7-a336-4080-b3c1-90918daa5a00/CP-02_live-incident-containment.png) **CP-02** ### Live Incident Containment Physically disconnect the affected path during a live incident while the rest of the operation keeps running. Open CP-02 (https://fire-vault.com/control-plan/contain-active-breaches) Image: CP-03 icon (https://fire-vault.com/__l5e/assets-v1/70ec8e2f-238e-4a06-918b-afb30b4d09a1/CP-03_third-party-access-control.png) **CP-03** ### Third-Party Access Control Supplier and vendor paths that exist only for approved work, in a defined window. Open CP-03 (https://fire-vault.com/control-plan/control-third-party-access) Image: CP-04 icon (https://fire-vault.com/__l5e/assets-v1/169a3eeb-e6af-451d-a864-f124db1e97e0/CP-04_physical-network-segmentation.png) **CP-04** ### Physical Network Segmentation Zones separated at Layer 1, so a boundary holds even when software controls are compromised. Open CP-04 (https://fire-vault.com/control-plan/enforce-physical-segmentation) Image: CP-05 icon (https://fire-vault.com/__l5e/assets-v1/7b5311e0-04ce-497c-b7da-9a1472237891/CP-05_critical-asset-protection.png) **CP-05** ### Critical Asset Protection Separate business access from essential systems, with planned isolation boundaries. Open CP-05 (https://fire-vault.com/control-plan/protect-critical-infrastructure) Image: CP-06 icon (https://fire-vault.com/__l5e/assets-v1/5a737d73-72d7-497a-8f71-2d1609cef83d/CP-06_controlled-access-assurance.png) **CP-06** ### Controlled Access & Assurance Connect approvals and observed control states to agreed record sources, with collection and retention defined for the actions in scope. Open CP-06 (https://fire-vault.com/control-plan/prove-compliance-through-control) Image: CP-07 icon (https://fire-vault.com/__l5e/assets-v1/ba2b5b91-4e13-484a-9de2-fad66e94f56b/CP-07_security-airlock.png) **CP-07** ### Security Airlock A two-stage gateway with independently controlled connections. Open CP-07 (https://fire-vault.com/control-plan/security-airlock) Image: CP-08 icon (https://fire-vault.com/__l5e/assets-v1/46daa836-10e3-4e3e-a517-da2778479709/CP-08_ai-connectivity-control.png) **CP-08** ### AI Connectivity Control Disconnect an AI system from your data and networks when it behaves unexpectedly. Open CP-08 (https://fire-vault.com/control-plan/control-ai-systems) Image: CP-09 icon (https://fire-vault.com/__l5e/assets-v1/1190c240-dd91-4a18-bca7-c0dca25d772c/CP-09_controlled-data-transfer.png) **CP-09** ### Controlled Data Transfer A controlled exchange path between two separate environments. Open CP-09 (https://fire-vault.com/control-plan/controlled-data-transfer) Image: CP-10 icon (https://fire-vault.com/__l5e/assets-v1/89585611-444d-4312-a641-5437ba45f229/CP-10_executive-override.png) **CP-10** ### Executive Override Authorised senior intervention that withdraws predefined connections. Open CP-10 (https://fire-vault.com/control-plan/executive-override) Image: CP-11 icon (https://fire-vault.com/__l5e/assets-v1/cb5ee537-ae2e-42ff-8e48-4d14fc8a2b11/CP-11_supply-chain-isolation.png) **CP-11**Proposed ### Supply Chain Isolation Keep supplier networks separate from your own environment. Open CP-11 (https://fire-vault.com/control-plan/supply-chain-isolation) Image: CP-12 icon (https://fire-vault.com/__l5e/assets-v1/a3ff75de-a878-4eaa-bc4a-c4470c1c600b/CP-12_privileged-access-control.png) **CP-12**Proposed ### Privileged Access Control Administrator access through a controlled network entry point. Open CP-12 (https://fire-vault.com/control-plan/privileged-access-control) Image: CP-13 icon (https://fire-vault.com/__l5e/assets-v1/959bf784-2dd5-41f7-baa4-03fabd5dbbfe/CP-13_maintenance-window-control.png) **CP-13**Proposed ### Maintenance Window Control Connections that exist only for a scheduled maintenance window. Open CP-13 (https://fire-vault.com/control-plan/maintenance-window-control) Image: CP-14 icon (https://fire-vault.com/__l5e/assets-v1/aadc8067-095b-4a19-ab1b-73d917838bc8/CP-14_compromised-device-isolation.png) **CP-14**Proposed ### Compromised Device Isolation Physically isolate one affected device from the network. Open CP-14 (https://fire-vault.com/control-plan/compromised-device-isolation) Image: CP-15 icon (https://fire-vault.com/__l5e/assets-v1/15b8a2eb-b5a0-41e9-aac9-093ff362430d/CP-15_operational-technology-protection.png) **CP-15**Proposed ### Operational Technology Protection Industrial controllers behind a physical network boundary. Open CP-15 (https://fire-vault.com/control-plan/operational-technology-protection) Image: CP-16 icon (https://fire-vault.com/__l5e/assets-v1/53528939-c0c1-4a94-b7bf-db0f96a490e9/CP-16_remote-site-isolation.png) **CP-16**Proposed ### Remote Site Isolation Disconnect the communications link to a remote facility. Open CP-16 (https://fire-vault.com/control-plan/remote-site-isolation) Image: CP-17 icon (https://fire-vault.com/__l5e/assets-v1/b21fcbf4-6f2d-4ce1-a839-0eb67273689b/CP-17_change-window-enforcement.png) **CP-17**Proposed ### Change Window Enforcement Approved changes made through a timed physical connection. Open CP-17 (https://fire-vault.com/control-plan/change-window-enforcement) Image: CP-18 icon (https://fire-vault.com/__l5e/assets-v1/18726064-1a29-4241-9c6f-617e786125e8/CP-18_data-exfiltration-interruption.png) **CP-18**Proposed ### Data Exfiltration Interruption Interrupt outbound paths at a physical boundary. Open CP-18 (https://fire-vault.com/control-plan/data-exfiltration-interruption) Image: CP-19 icon (https://fire-vault.com/__l5e/assets-v1/815349be-891b-4b1f-98e7-dfdbb0601086/CP-19_autonomous-system-intervention.png) **CP-19**Proposed ### Autonomous System Intervention Disconnect the communications of an autonomous system. Open CP-19 (https://fire-vault.com/control-plan/autonomous-system-intervention) Image: CP-20 icon (https://fire-vault.com/__l5e/assets-v1/47c68610-2b0a-443e-bedd-af9d26ed70ae/CP-20_multi-party-authorisation.png) **CP-20**Proposed ### Multi-Party Authorisation Two independent approvals required before a connection opens. Open CP-20 (https://fire-vault.com/control-plan/multi-party-authorisation) All twenty Control Plans have their own page. What every plan includes ## Written the same way, so you can compare them. Every Control Plan is commercially clear at the top and technically credible further down. Your board, your CISO and your engineers each get what they need. _01_**The outcome and the stakes** What the plan achieves, who needs it, and what is at risk without it. _02_**Control in Action** An interactive view of the crossings before control, in normal use, under attack and in recovery. _03_**The connection register** Every protected route: normal state, authorisation, enforcement, response and evidence. _04_**The operational runbook** Who does what in normal conditions, maintenance, an incident and restoration. _05_**Engineering and testing** How it fits your firewalls, SIEM and EDR, and the acceptance criteria it must pass. _06_**Limits and frameworks** What it does not protect against, and the standards it can help support. See it in CP-01 Ransomware Containment: https://fire-vault.com/control-plan/stop-kill-chain-ransomware Modules in each plan ## The modules behind each Plan. The primary modules each plan relies on. Supporting modules are set out in each plan’s specification. ### CP-01 Ransomware Containment Fracture · Isolate · Execute · Validate ### CP-02 Live Incident Containment Fracture · Isolate · Execute · Validate ### CP-03 Third-Party Access Control Fracture · Relay · Execute · Validate ### CP-04 Physical Network Segmentation Fracture · Isolate · Relay · Unlink · Lock ### CP-05 Critical Asset Protection Fracture · Isolate · Relay · Execute · Validate · Anchor · Lock · Transfer ### CP-06 Controlled Access & Assurance Fracture · Relay · Execute · Validate · Anchor · Lock · Transfer ### CP-07 Security Airlock ### CP-08 AI Connectivity Control Fracture · Isolate · Relay · Execute · Validate ### CP-09 Controlled Data Transfer ### CP-10 Executive Override ### CP-11 Supply Chain Isolation Fracture · Isolate · Relay · Execute · Validate · Lock ### CP-12 Privileged Access Control Fracture · Relay · Execute · Validate · Anchor · Lock ### CP-13 Maintenance Window Control Relay · Execute · Validate · Anchor · Lock · Transfer ### CP-14 Compromised Device Isolation Fracture · Isolate · Execute · Validate · Unlink · Lock ### CP-15 Operational Technology Protection Fracture · Isolate · Relay · Execute · Validate · Anchor ### CP-16 Remote Site Isolation ### CP-17 Change Window Enforcement Relay · Validate · Transfer ### CP-18 Data Exfiltration Interruption Fracture · Isolate · Execute ### CP-19 Autonomous System Intervention Fracture · Isolate · Execute · Validate · Anchor · Lock ### CP-20 Multi-Party Authorisation Plans and Blueprints ## The plan is the method. The Blueprint is the application. A ransomware containment plan applies to many organisations. An industry Blueprint shows how it combines with supplier access, IT and OT separation, recovery and safety in a real sector. Control modules**The capabilities** Fracture, Isolate, Relay, Execute, Validate, Anchor, Unlink, Lock and Transfer. Each does one physical job. _Example: Firebreak® cuts a selected crossing at Layer 1._How Control works (https://fire-vault.com/control) Control Plans**The method** How modules combine to solve one problem, written so it can be repeated in any organisation. _Example: CP-01 cuts the routes out of an infected zone on a high-confidence alert._Browse the plans Industry Blueprints**The application** How the relevant plans adapt to a sector’s infrastructure, suppliers, safety requirements and regulators. _Example: Control for Water combines five plans, with Offline Secure Storage® kept separate._Explore Industry Blueprints (https://fire-vault.com/control-blueprints) How a plan becomes yours ## From the library to your network. No plan is installed as-is. Each one is mapped to your own connections, decision makers and constraints, then tested before you rely on it. 1. _1_**Discovery** Map the connections in scope, what must keep running and who decides. 2. _2_**Draft the plan** Write the connection register, decision rules and runbook for your network. 3. _3_**Pilot** Put the first crossing under control in a planned window. 4. _4_**Test and evidence** Run the acceptance criteria and keep the evidence. 5. _5_**Operate and expand** Add crossings and plans, using the same method. **→**Build your Control Plan ## Tell us the problem. We will show you the plan. Tick what sounds familiar. You’ll see which Control Plans your discovery session would start with. **?**Questions worth asking ## Before you choose a plan. The practical answers your board, your CISO and your engineers will want. A Control Plan is a repeatable method for one problem, such as ransomware spreading or supplier access. An industry Blueprint combines the relevant plans and adapts them to a sector’s real infrastructure, suppliers, safety requirements and regulators. Yes. Most organisations start with one plan where the risk is greatest and add others. Plans share the same modules, so they work together. No. Each plan uses only the modules it needs. CP-01, for example, relies on Execute, Firebreak® and Isolate. No. Firewalls, detection and endpoint tools stay. A plan adds a physical layer they can act through, and that an attacker cannot switch off from inside the network. Separately. Control decides which connections exist. Offline Secure Storage® keeps recovery copies, configurations and evidence physically disconnected, with its own access. With a discovery session. We agree the problem, the first crossing to control and who decides, then pilot and test it before you rely on it. See all questions: https://fire-vault.com/learn/faq **→**Your next step ## Pick the problem. We will build the plan. A working session on your network: the problem, the plan that fits, and the first crossing to control. Build your Control Plan (https://fire-vault.com/demo) Prefer to talk first? Speak to the team: https://fire-vault.com/contact Book a demo: https://fire-vault.com/demo Speak to the team: https://fire-vault.com/contact ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plans#webpage", "url": "https://fire-vault.com/control-plans", "name": "Control Plans", "description": "Firevault Control Plans: proven, repeatable methods for physically controlling network connections, from ransomware containment to supplier access and AI…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plans#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plans#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plans", "item": "https://fire-vault.com/control-plans" } ] }, { "@context": "https://schema.org", "@type": "CollectionPage", "name": "Control Plans", "description": "Firevault Control Plans: proven, repeatable methods for physically controlling network connections, from ransomware containment to supplier access and AI connectivity.", "url": "https://fire-vault.com/control-plans" } ] ```