Recent Breaches
Breaches
View All →
OSS, Compliance & Risk

ISO 27001 with Offline Secure Storage

ISO 27001 requires a systematic approach to information security. Offline Secure Storage (OSS) maps directly to Annex A physical and environmental controls.

View All Compliance

We Think This Is Hard to Ignore

M&S had ISO 27001 certification when DragonForce ransomware bypassed their certified controls via a third-party compromise. At Firevault, classified information assets live on hardware with no network connection, because Annex A.11 physical security means nothing if the data is always online.

£14M

ICO fine to Capita, ISO 27001 certified at time of breach

ICO, October 2025

6M+

People affected despite Capita holding ISO 27001

ICO, October 2025

277 days

Average time to identify and contain a breach

IBM Cost of a Data Breach 2024

£4.5M

Average cost of a data breach globally

IBM Cost of a Data Breach 2024

The Gap

ISO 27001 requires physical security controls.

Annex A.11 Physical Security

Physical security perimeters and environmental controls are mandatory, not optional.

Asset Management

Critical information assets must be identified, classified, and appropriately protected.

Access Control

Logical and physical access controls must be proportional to asset sensitivity.

The Reality

Certification alone does not prevent breaches.

Capita: £14M Fine Despite Holding ISO 27001 Certification

Capita held ISO 27001 certification at the time of its breach. The ICO still fined the company £14 million, demonstrating that certification without physical protection is insufficient.

ICO, October 2025

LastPass: £1.2M Fine Despite Security Company Status

LastPass, a company whose entire business is security, was fined £1.2 million by the ICO for failures that allowed hackers to steal personal data of 1.6 million UK customers.

ICO, December 2025

M&S: Third-Party Compromise Bypassed Certified Controls

Attackers bypassed M&S security controls by compromising a third-party provider, demonstrating that ISO 27001 supply chain controls must extend to physical protection.

Reuters, 2025

How OSS Maps

Direct mapping to ISO 27001 controls.

Offline Secure Storage (OSS) provides physical infrastructure that directly satisfies multiple Annex A controls.

  • Physical security perimeters (A.11.1), purpose-built secure facilities
  • Equipment security (A.11.2), tamper-evident, monitored environments
  • Access control (A.9), authenticated, audited access sessions
  • Operations security (A.12), controlled processing environments

Take Classified Assets Off Standard Infrastructure

Step 1 of 3

Classified information assets are taken off standard infrastructure and written to physically disconnected RAID 1 drives inside a Firevault Bunker. This directly satisfies Annex A.11 physical security perimeter controls.

Featured In

TechRadar ProSecurity BuyerYahoo FinanceSecurityBriefChannel Insider
Commercial Advantage

Win Business, Earn Trust, and Build Reputation with Butterfly

Butterfly is an operational model that helps organisations structure sensitive data to close deals faster, strengthen client relationships, and demonstrate the governance maturity that wins enterprise contracts.

Built on the VPPP framework (Vault, Policy, Permissions, Purpose), Butterfly maps your sensitive data and assigns dedicated Vaults by role, relationship, and purpose, turning data stewardship into a competitive advantage.

Deal Readiness

Governed materials ready to share with confidence

Client Trust

Demonstrate stewardship that earns loyalty

Board Confidence

Clear governance that inspires stakeholders

Enterprise Scale

Structure data governance across your organisation

Butterfly deployment model

Who Uses Butterfly?

  • Sales Teams

    Secure client proposals, pricing, and commercial intelligence

  • Service Providers

    Exchange sensitive documents with clients through governed Vaults

  • Businesses

    Protect strategic plans, IP, and competitive intelligence

  • Family Offices

    Structure data governance across principals, staff, and advisors

Questions

Frequently Asked

    Your privacy matters

    We use cookies to keep the site running smoothly and to understand how you use it. You are in control. Privacy Charter · Cookie Policy

    Iso 27001

    See how offline storage helps you satisfy multiple ISO 27001 Annex A controls, particularly in asset management, physical security, and operations. Discover.

    © 2026 Firevault Limited. Disconnect to Protect®