Selected scope
Registered physical paths associated with the named critical asset.
Control Module Control Plan
Anchor · CP-06Named-asset access boundary
Adopt Anchor around the registered access paths of a named critical asset; this is asset-centred scope, not storage or a new hardware configuration product.
The asset owner, operations and security agree the permitted reach and who may change it.
Incident
Path exposed
Outcome
Control taken
Approximately 120–150 ms
Management enable/disable operation
Around 2–3 seconds
SMS round-trip operation, good signal
March 2025 test observations, not guaranteed timings.
01The problem
Keep critical assets within defined physical connection boundaries.
Anchor governs selected physical access paths associated with a defined critical asset, with its required services and operational dependencies assessed first.
Distinction
Isolate separates zones. Anchor centres the scope on a named asset; Lock governs conditions for crossing its protected boundary.
02How Anchor is adopted
Selected-boundary connection control. Agreed before it is needed.
A Firebreak at an agreed firewall or network crossing.
Normal connection behaviour
The selected crossing carries only the connectivity permitted by the operating design.
The physical action
An authorised instruction changes the selected physical connection state.
Restoration
Confirm asset health, local operation, dependencies and all assessed access paths before reopening.
What this Plan defines
- The asset owner and operations or safety authority approve which access paths can change.
- An authorised asset-access or protection decision selects the assessed path state.
- The registered crossing, permitted states and acceptance checks.
What it does not do
- Anchor does not provide storage, archiving, custody of records or a guarantee that every route into an asset is absent.
- Act on crossings outside the registered scope.
- Provide storage, backup, recovery or content inspection.
03See it work
Three illustrative crossings. One authorised Anchor change.
Follow an illustrative Anchor adoption from normal operation to restoration. Only the selected crossing changes; the others keep their assessed states.
Outside
Remote accessVPN and remote desktop gateway
Vendor supportEquipment vendor’s remote support
Corporate IT
Corporate ITUsers, servers and identity
Operations
Control systemsSCADA, PLCs, controllers and HMIs
EngineeringEngineering workstations
Stage
Normal operation
The selected crossing carries only the connectivity permitted by the operating design.
The asset owner and operations or safety authority approve which access paths can change.
- Commanded
- No change.
- Reported by the control point
- C1, C2 and C3 in their registered states.
- Independently verified
- Matches the state confirmed at the last test.
Selected crossing
Anchor · CP-01 Named-asset access boundaryRemote access to corporate IT · Cyber, IT- Normal state
- Connected for staff and administrators.
- What changes it
- An authorised asset-access or protection decision selects the assessed path state.
- What Anchor does
- An authorised instruction changes the selected physical connection state.
Concept illustration. Choose a stage, or a crossing on the map. Commanded, reported and verified states are shown separately because they are not the same thing. Crossings, states and owners are agreed for your estate.
04Before you rely on it
Agreed in advance. Tested before it counts.
This Plan works because the decisions are made in advance: which crossing, which state, who authorises it and what must keep running.
Before you rely on it
What has to be true first.
- The runbook names each crossing, its action and who can order it.
- In OT and CNI, the plant reaches a safe state before a route is withdrawn.
- Routes not in the runbook are not acted on.
- Each action is tested in a planned window before you rely on it.
- Wireless, cellular and other routes outside the plan need their own controls.
Other arrangements to assess
Candidates, not included capabilities.
- Dual-boundary connection control. Separate Firebreak control points at both boundaries of an intermediate network zone.
- Alternate-endpoint access selection. An assessed arrangement selects access to a canary endpoint or a protected asset.
Register redundant, wireless and alternative routes; assess service impact and command delivery.
Authority and trigger
The asset owner and operations or safety authority approve which access paths can change.
An authorised asset-access or protection decision selects the assessed path state.
Conditions to validate
Register redundant, wireless and alternative routes; assess service impact and command delivery.
05Questions
Straight answers.
For incident owners, responders and operations.
Why is Anchor the solution behind this Plan?
Anchor owns the critical asset protection solution. This Plan defines one way to adopt it: A Firebreak at an agreed firewall or network crossing.
Who authorises a change?
The asset owner and operations or safety authority approve which access paths can change.
What triggers it?
An authorised asset-access or protection decision selects the assessed path state.
How is the connection restored?
Confirm asset health, local operation, dependencies and all assessed access paths before reopening.
What does it not do?
Anchor does not provide storage, archiving, custody of records or a guarantee that every route into an asset is absent.
Is this a validated installation?
No. It is an assessment approach informed by documented deployment patterns. Applicability is confirmed for your estate in a discovery session and acceptance tests.
06Your next step
Name the crossing Anchor should govern first.
Bring the connection you are most concerned about. We will map the crossing, agree what must keep running, and tell you plainly whether this Anchor approach fits.
Discuss this adoption approachOr see all nine Modules