Recent Breaches
Breaches
View All →
OSS, Compliance & Risk

ISO 27001 with Offline Secure Storage

ISO 27001 requires a systematic approach to information security. Offline Secure Storage (OSS) maps directly to Annex A physical and environmental controls.

We Think This Is Hard to Ignore

M&S had ISO 27001 certification when DragonForce ransomware bypassed their certified controls via a third-party compromise. At Firevault, classified information assets live on hardware with no network connection, because Annex A.11 physical security means nothing if the data is always online.

£14M

ICO fine to Capita, ISO 27001 certified at time of breach

ICO, October 2025

6M+

People affected despite Capita holding ISO 27001

ICO, October 2025

277 days

Average time to identify and contain a breach

IBM Cost of a Data Breach 2024

£4.5M

Average cost of a data breach globally

IBM Cost of a Data Breach 2024

The Gap

ISO 27001 requires physical security controls.

Annex A.11 Physical Security

Physical security perimeters and environmental controls are mandatory, not optional.

Asset Management

Critical information assets must be identified, classified, and appropriately protected.

Access Control

Logical and physical access controls must be proportional to asset sensitivity.

The Reality

Certification alone does not prevent breaches.

Capita: £14M Fine Despite Holding ISO 27001 Certification

Capita held ISO 27001 certification at the time of its breach. The ICO still fined the company £14 million, demonstrating that certification without physical protection is insufficient.

ICO, October 2025

LastPass: £1.2M Fine Despite Security Company Status

LastPass, a company whose entire business is security, was fined £1.2 million by the ICO for failures that allowed hackers to steal personal data of 1.6 million UK customers.

ICO, December 2025

M&S: Third-Party Compromise Bypassed Certified Controls

Attackers bypassed M&S security controls by compromising a third-party provider, demonstrating that ISO 27001 supply chain controls must extend to physical protection.

Reuters, 2025

How OSS Maps

Direct mapping to ISO 27001 controls.

Offline Secure Storage (OSS) provides physical infrastructure that directly satisfies multiple Annex A controls.

  • Physical security perimeters (A.11.1), purpose-built secure facilities
  • Equipment security (A.11.2), tamper-evident, monitored environments
  • Access control (A.9), authenticated, audited access sessions
  • Operations security (A.12), controlled processing environments

Take Classified Assets Off Standard Infrastructure

Step 1 of 3

Classified information assets are taken off standard infrastructure and written to physically disconnected RAID 1 drives inside a Firevault Bunker. This directly satisfies Annex A.11 physical security perimeter controls.

Featured In

TechRadar ProSecurity BuyerYahoo FinanceSecurityBriefChannel Insider

Choose Your Protection

Which OSS Fits?

300GB

Low Use Vault, Deep Cold Storage

From £74.99/mo

inc. VAT · £0 due today

Offline Secure Storage for Offline Secure Storage, low use vault, deep cold storage.

What 300GB holds

~60,000 high-res photos
~150,000 PDF documents
~1,200 hours of voice recordings
~75 hours of HD video

Specifications

Capacity

300GB

Access

2 windows/week

Authentication

Identity-locked

Commitment

36 months

Security & Compliance

NATO-Approved FacilityDSIT-ReferencedGDPR Art. 32Cyber Essentials Plus

How to Get Started

Step 1

Discovery Call

Understand what you need to protect and how you operate.

Step 2

Vault Configuration

Select your tier, capacity, and access model.

Step 3

Identity Verification

Complete KYC/AML and set up multi-factor authentication.

Step 4

Go Live

Data ingestion, access policy activation, and ongoing support.

Commercial Advantage

Win Business, Earn Trust, and Build Reputation with Butterfly

Butterfly is an operational model that helps organisations structure sensitive data to close deals faster, strengthen client relationships, and demonstrate the governance maturity that wins enterprise contracts.

Built on the VPPP framework (Vault, Policy, Permissions, Purpose), Butterfly maps your sensitive data and assigns dedicated Vaults by role, relationship, and purpose, turning data stewardship into a competitive advantage.

Deal Readiness

Governed materials ready to share with confidence

Client Trust

Demonstrate stewardship that earns loyalty

Board Confidence

Clear governance that inspires stakeholders

Enterprise Scale

Structure data governance across your organisation

Butterfly deployment model

Who Uses Butterfly?

  • Sales Teams

    Secure client proposals, pricing, and commercial intelligence

  • Service Providers

    Exchange sensitive documents with clients through governed Vaults

  • Businesses

    Protect strategic plans, IP, and competitive intelligence

  • Family Offices

    Structure data governance across principals, staff, and advisors

Questions

Frequently Asked

Ready to take the next step?

See how Firevault can protect your most sensitive data with physically disconnected storage.

    Your privacy matters

    We use cookies to keep the site running smoothly and to understand how you use it. You are in control. Privacy Charter · Cookie Policy

    Firevault

    Firevault is Offline Secure Storage. Hardware you own, physically disconnected by default, with KYC-verified access. Ransomware-proof by design, not by patch.

    © 2026 Firevault Limited. Disconnect to Protect®