--- title: "Stop Kill-Chain Ransomware by Firevault - Control Blueprint…" url: https://fire-vault.com/control-blueprints/cp-01 description: "Stop ransomware moving, spreading or reaching the crown jewels." lang: en-GB --- FIRE-led · CP-01 # Stop Kill-Chain Ransomware Stop ransomware moving, spreading or reaching the crown jewels. - CP-01 - Controls the path Read the guide: https://fire-vault.com/learn/guides/stopping-kill-chain-ransomware-control-blueprint All Blueprints: https://fire-vault.com/control-blueprints Image: Control Blueprint CP-01, Stop Kill-Chain Ransomware: an isometric diagram of an attack path severed before it reaches protected data (https://fire-vault.com/__l5e/assets-v1/ab81da21-fd7a-4035-8659-2649a317cc07/blueprint-cp-01-hero.webp) 01 At a glance ## What this Blueprint does. Lateral movement prevention across IT and OT What it does Where it fits Who uses it Financial services, Healthcare, Public sector, Defence CP-01 topology ## How CP-01 stops the kill chain. A FIRE-led pattern. The path between any compromised zone and the crown jewels is severed by default, opened only as a named event, and severed again on alert. Grounded in MITRE ATT&CK TA0008, IEC 62443-3-3 SR 5.1 and NCSC ransomware guidance. Z0 User and endpoint zone Where the User and endpoint zone zone Where the foothold typically lands Image: FV-Isolate module icon (https://fire-vault.com/assets/isolate-icon-B9t8fl3o.png) Isolate Image: FV-Lock module icon (https://fire-vault.com/assets/lock-icon-UU3vOaKE.png) Lock Named, scoped reach into core services Z1 Core IT services Identity, file, Core IT services zone Identity, file, mail, collaboration Image: FV-Firebreak module icon (https://fire-vault.com/assets/firebreak-icon-7zSCkB1t.png) Firebreak Image: FV-Execute module icon (https://fire-vault.com/assets/execute-icon-kJl5Gtmk.png) Execute Image: FV-Unlink module icon (https://fire-vault.com/assets/unlink-icon-B8GFAVW1.png) Unlink Severed by default. Restored only as an approved Execute event. Z2 Crown-jewel systems Database, ERP, Crown-jewel systems zone Database, ERP, core record systems OSS Crown jewels · detail callout Offline recovery vault Tamper-evident copies, not reachable on the live network. The ransomware cannot touch them. Modules & symbols Image: FV-Isolate module icon (https://fire-vault.com/assets/isolate-icon-B9t8fl3o.png) Isolate Zone boundary Image: FV-Lock module icon (https://fire-vault.com/assets/lock-icon-UU3vOaKE.png) Lock Named access Image: FV-Firebreak module icon (https://fire-vault.com/assets/firebreak-icon-7zSCkB1t.png) Firebreak Physical sever Image: FV-Execute module icon (https://fire-vault.com/assets/execute-icon-kJl5Gtmk.png) Execute Approved action Image: FV-Unlink module icon (https://fire-vault.com/assets/unlink-icon-B8GFAVW1.png) Unlink Remove trust Conduit Enforced module path ┄┄┄ Crown jewels Offline · detail callout 02 Modules in this Blueprint ## How the CP-01 pattern composes. How the primary modules compose 1. 1 Firebreak FIRE Physically breaks the connection path so the attack cannot continue. https://fire-vault.com/control/modules/firebreak 2. 2 Isolate FIRE Separates the affected environment into a controlled zone. https://fire-vault.com/control/modules/isolate 3. 3 Execute FIRE Fires the control action the moment a signal demands it. https://fire-vault.com/control/modules/execute Supporting modules - Unlink VAULT Removes the persistent dependencies that quietly bypass the control. https://fire-vault.com/control/modules/unlink - Lock VAULT Holds the asset behind identity, role and policy controls. https://fire-vault.com/control/modules/lock 03 How it reads end to end ## The Blueprint in full. Firebreak physically breaks the connection path. Isolate separates the affected environment. Execute triggers the control action the moment risk is detected. Unlink removes the persistent dependencies and Lock holds the crown jewels behind identity controls that ransomware cannot reach. 04 Sector relevance ## Where CP-01 applies. Financial services Healthcare Public sector Defence 05 Related Blueprints ## Compose alongside. See all: https://fire-vault.com/control-blueprints CP-02 FIRE-led ### Contain Active Breaches When prevention fails, containment must be physical, immediate and provable. View Blueprint https://fire-vault.com/control-blueprints/cp-02 CP-04 FIRE-led ### Enforce Physical Segmentation Segmentation should not just be logical. It should be physically enforceable. View Blueprint https://fire-vault.com/control-blueprints/cp-04 CP-07 FIRE-led ### Protect Aviation and Aerospace Networks Block incoming traffic by default. Open the air-lock only for verified, time-bound reach. View Blueprint https://fire-vault.com/control-blueprints/cp-07 Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Image: David Bailey (https://fire-vault.com/assets/david-bailey-Dgqj8eaE.jpg) Image: Kenny Phipps (https://fire-vault.com/assets/kenny-phipps-Dy-CtCjw.jpg) Online Now Get started ## Build control around your environment Talk to our team about composing this Blueprint for your estate. From £360 a month including VAT. 36-month commitment. First payment at checkout. From £360/mo VAT included 36-month plan ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-blueprints/cp-01#webpage", "url": "https://fire-vault.com/control-blueprints/cp-01", "name": "Stop Kill-Chain Ransomware by Firevault - Control Blueprint…", "description": "Stop ransomware moving, spreading or reaching the crown jewels.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/f03f4aaa-5a3b-417e-8ce7-367b76832037/og-blueprint-cp-01.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-blueprints/cp-01#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-blueprints/cp-01#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Blueprints", "item": "https://fire-vault.com/control-blueprints" }, { "@type": "ListItem", "position": 3, "name": "Stop Kill-Chain Ransomware by Firevault - Control Blueprint…", "item": "https://fire-vault.com/control-blueprints/cp-01" } ] }, { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Stop Kill-Chain Ransomware - Control Blueprint CP-01", "description": "Stop ransomware moving, spreading or reaching the crown jewels.", "author": { "@type": "Organization", "name": "Firevault" }, "publisher": { "@type": "Organization", "name": "Firevault", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png" } }, "mainEntityOfPage": "https://fire-vault.com/control-blueprints/cp-01", "about": { "@type": "Thing", "name": "Control Blueprint CP-01" } } ] ```