--- title: "Contain Active Breaches by Firevault - Control Blueprint CP…" url: https://fire-vault.com/control-blueprints/cp-02 description: "When prevention fails, containment must be physical, immediate and provable." lang: en-GB --- FIRE-led · CP-02 # Contain Active Breaches When prevention fails, containment must be physical, immediate and provable. - CP-02 - Controls the path Read the guide: https://fire-vault.com/learn/guides/containing-active-breaches-control-blueprint All Blueprints: https://fire-vault.com/control-blueprints Image: Control Blueprint CP-02, Contain Active Breaches: an isometric diagram of a threat enclosed inside a sealed containment ring (https://fire-vault.com/__l5e/assets-v1/5dae729b-ef1b-4644-b793-7b39dc220d8c/blueprint-cp-02-hero.webp) 01 At a glance ## What this Blueprint does. Live incident containment and recovery What it does Where it fits Live incident containment and recovery Who uses it Financial services, Energy, Public sector, Defence CP-02 topology ## How CP-02 contains a live incident. A FIRE-led pattern for live containment. Affected zones are severed at the conduit, recovery zones are reached only through an authorised Execute event. Grounded in NIST CSF RS.MI-1, IEC 62443-3-3 FR 6 and the CISA Incident Response Playbook. Z0 Affected zone Where the Affected zone zone Where the live incident is unfolding Image: FV-Firebreak module icon (https://fire-vault.com/assets/firebreak-icon-7zSCkB1t.png) Firebreak Image: FV-Isolate module icon (https://fire-vault.com/assets/isolate-icon-B9t8fl3o.png) Isolate Severed on alert. Blast radius bounded. Z1 Unaffected production Operational zones Unaffected production zone Operational zones still running Image: FV-Execute module icon (https://fire-vault.com/assets/execute-icon-kJl5Gtmk.png) Execute Image: FV-Lock module icon (https://fire-vault.com/assets/lock-icon-UU3vOaKE.png) Lock Image: FV-Archive module icon (https://fire-vault.com/assets/archive-icon-B3rc85NY.png) Archive Reach into forensic and recovery only as an approved event. Z2 Forensic and recovery zone Where evidence Forensic and recovery zone zone Where evidence is held and recovery is staged OSS Crown jewels · detail callout Sealed evidence and recovery vault Logs, snapshots and golden images sealed offline for the incident response and any later investigation. Modules & symbols Image: FV-Firebreak module icon (https://fire-vault.com/assets/firebreak-icon-7zSCkB1t.png) Firebreak Physical sever Image: FV-Isolate module icon (https://fire-vault.com/assets/isolate-icon-B9t8fl3o.png) Isolate Zone boundary Image: FV-Execute module icon (https://fire-vault.com/assets/execute-icon-kJl5Gtmk.png) Execute Approved action Image: FV-Lock module icon (https://fire-vault.com/assets/lock-icon-UU3vOaKE.png) Lock Named access Image: FV-Archive module icon (https://fire-vault.com/assets/archive-icon-B3rc85NY.png) Archive Disconnected copy Conduit Enforced module path ┄┄┄ Crown jewels Offline · detail callout 02 Modules in this Blueprint ## How the CP-02 pattern composes. How the primary modules compose 1. 1 Firebreak FIRE Physically breaks the connection path so the attack cannot continue. https://fire-vault.com/control/modules/firebreak 2. 2 Isolate FIRE Separates the affected environment into a controlled zone. https://fire-vault.com/control/modules/isolate 3. 3 Execute FIRE Fires the control action the moment a signal demands it. https://fire-vault.com/control/modules/execute Supporting modules - Archive VAULT Preserves the records, logs and evidence the control produced. https://fire-vault.com/control/modules/archive - Lock VAULT Holds the asset behind identity, role and policy controls. https://fire-vault.com/control/modules/lock 03 How it reads end to end ## The Blueprint in full. Firebreak disconnects the exposed path. Isolate contains the breach area. Execute allows immediate action during a live incident. Archive preserves logs, evidence and recovery points while Lock protects what remains as recovery begins. 04 Sector relevance ## Where CP-02 applies. Financial services Energy Public sector Defence 05 Related Blueprints ## Compose alongside. See all: https://fire-vault.com/control-blueprints CP-01 FIRE-led ### Stop Kill-Chain Ransomware Stop ransomware moving, spreading or reaching the crown jewels. View Blueprint https://fire-vault.com/control-blueprints/cp-01 CP-04 FIRE-led ### Enforce Physical Segmentation Segmentation should not just be logical. It should be physically enforceable. View Blueprint https://fire-vault.com/control-blueprints/cp-04 CP-07 FIRE-led ### Protect Aviation and Aerospace Networks Block incoming traffic by default. Open the air-lock only for verified, time-bound reach. View Blueprint https://fire-vault.com/control-blueprints/cp-07 Image: Mark Fermor (https://fire-vault.com/assets/mark-fermor-DWFWqeWL.jpg) Image: David Bailey (https://fire-vault.com/assets/david-bailey-Dgqj8eaE.jpg) Image: Kenny Phipps (https://fire-vault.com/assets/kenny-phipps-Dy-CtCjw.jpg) Online Now Get started ## Build control around your environment Talk to our team about composing this Blueprint for your estate. From £360 a month including VAT. 36-month commitment. First payment at checkout. From £360/mo VAT included 36-month plan ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-blueprints/cp-02#webpage", "url": "https://fire-vault.com/control-blueprints/cp-02", "name": "Contain Active Breaches by Firevault - Control Blueprint CP…", "description": "When prevention fails, containment must be physical, immediate and provable.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/54ac3d16-ce8e-454f-a400-19637f96605c/og-blueprint-cp-02.webp" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-blueprints/cp-02#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-blueprints/cp-02#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Blueprints", "item": "https://fire-vault.com/control-blueprints" }, { "@type": "ListItem", "position": 3, "name": "Contain Active Breaches by Firevault - Control Blueprint CP…", "item": "https://fire-vault.com/control-blueprints/cp-02" } ] }, { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Contain Active Breaches - Control Blueprint CP-02", "description": "When prevention fails, containment must be physical, immediate and provable.", "author": { "@type": "Organization", "name": "Firevault" }, "publisher": { "@type": "Organization", "name": "Firevault", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png" } }, "mainEntityOfPage": "https://fire-vault.com/control-blueprints/cp-02", "about": { "@type": "Thing", "name": "Control Blueprint CP-02" } } ] ```