Selected scope
A named supplier or remote-maintenance crossing to a defined target.
Control Module Control Plan
Relay · CP-03Authorised access windows
Adopt Relay on a selected third-party or remote-work path; existing identity and access systems govern the people and task.
The service owner sponsors access; configured identity and approval systems establish the authorised task and window.
Incident
Path exposed
Outcome
Control taken
Approximately 120–150 ms
Management enable/disable operation
Around 2–3 seconds
SMS round-trip operation, good signal
March 2025 test observations, not guaranteed timings.
01The problem
Connect for authorised work. Withdraw the route afterwards.
Relay makes a selected connection available for authorised third-party or remote work, then withdraws that route under the agreed access procedure.
Distinction
Transfer governs a connection for an approved data-movement job. Relay addresses third-party or remote work; Validate establishes the required approval.
02How Relay is adopted
Just-in-time connection window. Agreed before it is needed.
A Firebreak on the selected maintenance, supplier or change path.
Normal connection behaviour
The path is unavailable outside its just-in-time connection window, where the tested design supports that state.
The physical action
Open just-in-time for the approved task and close or apply an explicitly authorised extension at expiry.
Restoration
Check incomplete maintenance, session evidence and system health before approving a further just-in-time window.
What this Plan defines
- The supplier sponsor, system owner and access approver agree the task, duration and extension rules.
- The just-in-time work window and validated access workflow permit the selected opening.
- The registered crossing, permitted states and acceptance checks.
What it does not do
- Relay is not an identity provider or session-monitoring service. Expiry, emergency support and application readiness depend on the deployment.
- Act on crossings outside the registered scope.
- Provide storage, backup, recovery or content inspection.
03See it work
Three illustrative crossings. One authorised Relay change.
Follow an illustrative Relay adoption from normal operation to restoration. Only the selected crossing changes; the others keep their assessed states.
Outside
Remote accessVPN and remote desktop gateway
Vendor supportEquipment vendor’s remote support
Corporate IT
Corporate ITUsers, servers and identity
Operations
Control systemsSCADA, PLCs, controllers and HMIs
EngineeringEngineering workstations
Stage
Normal operation
The path is unavailable outside its just-in-time connection window, where the tested design supports that state.
The supplier sponsor, system owner and access approver agree the task, duration and extension rules.
- Commanded
- No change.
- Reported by the control point
- C1, C2 and C3 in their registered states.
- Independently verified
- Matches the state confirmed at the last test.
Selected crossing
Relay · CP-01 Authorised access windowsRemote access to corporate IT · Cyber, IT- Normal state
- Connected for staff and administrators.
- What changes it
- The just-in-time work window and validated access workflow permit the selected opening.
- What Relay does
- Open just-in-time for the approved task and close or apply an explicitly authorised extension at expiry.
Concept illustration. Choose a stage, or a crossing on the map. Commanded, reported and verified states are shown separately because they are not the same thing. Crossings, states and owners are agreed for your estate.
04Before you rely on it
Agreed in advance. Tested before it counts.
This Plan works because the decisions are made in advance: which crossing, which state, who authorises it and what must keep running.
Before you rely on it
What has to be true first.
- The runbook names each crossing, its action and who can order it.
- In OT and CNI, the plant reaches a safe state before a route is withdrawn.
- Routes not in the runbook are not acted on.
- Each action is tested in a planned window before you rely on it.
- Wireless, cellular and other routes outside the plan need their own controls.
Other arrangements to assess
Candidates, not included capabilities.
- Externally approved connection change. Physical connection control on a selected path, governed by an assessed external approval workflow.
- Governed diode maintenance access. A separately assessed maintenance connection around an existing data-diode boundary.
Confirm scheduler support, interrupted work, expiry, clock behaviour and lost commands; do not assume immediate closure or non-enumerability.
Authority and trigger
The supplier sponsor, system owner and access approver agree the task, duration and extension rules.
The just-in-time work window and validated access workflow permit the selected opening.
Conditions to validate
Confirm scheduler support, interrupted work, expiry, clock behaviour and lost commands; do not assume immediate closure or non-enumerability.
05Questions
Straight answers.
For incident owners, responders and operations.
Why is Relay the solution behind this Plan?
Relay owns the controlled third-party and remote access solution. This Plan defines one way to adopt it: A Firebreak on the selected maintenance, supplier or change path.
Who authorises a change?
The supplier sponsor, system owner and access approver agree the task, duration and extension rules.
What triggers it?
The just-in-time work window and validated access workflow permit the selected opening.
How is the connection restored?
Check incomplete maintenance, session evidence and system health before approving a further just-in-time window.
What does it not do?
Relay is not an identity provider or session-monitoring service. Expiry, emergency support and application readiness depend on the deployment.
Is this a validated installation?
No. It is an assessment approach informed by documented deployment patterns. Applicability is confirmed for your estate in a discovery session and acceptance tests.
06Your next step
Name the crossing Relay should govern first.
Bring the connection you are most concerned about. We will map the crossing, agree what must keep running, and tell you plainly whether this Relay approach fits.
Discuss this adoption approachOr see all nine Modules