Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control Module FV-06

Array Multi-boundary critical asset protection

Array applies physical connection control around multiple diode-protected paths serving a named critical asset or tightly defined group of assets. It makes the permitted connection arrangement explicit rather than treating asset protection as a single switch.

Protect the asset across the paths that matter.

Incident

Path exposed

Outcome

Control taken

The problem

The problem Array addresses.

Critical assets may depend on several data flows, engineering routes and operational interfaces. Protecting only one crossing can leave the essential boundary exposed elsewhere.

What it does

Array applies physical connection control around multiple diode-protected paths serving a named critical asset or tightly defined group of assets. It makes the permitted connection arrangement explicit rather than treating asset protection as a single switch.

Before a connection changes

Every deployment starts with a named physical boundary, a defined normal state, mapped dependencies, an agreed decision-maker, failure behaviour and a tested restoration method. Disconnecting one controlled link does not remove alternative routes outside the design.

The physical-control arrangement

Several diode-protected paths, each with its own control point. Agreed before it is needed.

A multi-overlay pattern used around separately assessed diode arrangements, with each pathway, dependency and permitted operational state recorded.

  1. Name the asset

    Identify the named protected asset.

  2. Map its pathways

    Map its diode-protected pathways and essential services.

  3. Specify each overlay

    Specify each controlled overlay and its normal state.

  4. Change only the assessed path

    Authorise and apply changes only to the assessed path.

  5. Verify every boundary

    Verify the state of each boundary without disrupting required local operation.

What it does

  • Protect a named critical asset through multiple assessed, diode-protected connection boundaries.
  • Acts only on the registered crossings in the agreed design.
  • Records the command, the reported state and any independent verification separately.

What it does not claim

  • Array is not offline data storage, archive, backup or a guarantee that all critical-asset interfaces are unreachable. A diode's directionality comes from the diode design, not a switching command.
  • Act on routes outside the registered design.

See it work

One critical asset. Several diode-protected paths.

A named critical asset served by distinct diode-protected pathways, each with its own physical-control point. A change on one path does not change the others.

Outbound paths

Named critical asset

Inbound path

Monitoring centreReceives telemetry through diode A
Business historianReceives reports through diode B
Critical assetFor example a protection system
Update stagingSends approved updates through diode C

Stage

The asset and its pathways

The named asset is served by three distinct diode-protected pathways, each recorded with its essential services and normal state.

Recorded by the asset and security owners.

Commanded
No change.
Reported by the control point
A and B connected. C held disconnected.
Independently verified
Matches the state confirmed at the last test.

Selected boundary

Array module emblem: magenta and slate diamond around a white ring, for keeping assets within physical boundariesArray · FV-06 Diode-protected path ACritical asset to monitoring centre, one-way by diode design · OT, CNI
Normal state
Connected for outbound telemetry.
What changes it
An authorised change to this path only.
What Array does
Array controls the physical connection around diode A. The diode, not Array, provides the one-way behaviour.

Concept illustration. A diode’s directionality comes from the diode design, not a switching command. Array is not offline data storage, archive or backup.

Operational boundaries and tests

Agreed in advance. Tested before it counts.

Every deployment starts with a named physical boundary, a defined normal state, mapped dependencies, an agreed decision-maker, failure behaviour and a tested restoration method. Disconnecting one controlled link does not remove alternative routes outside the design.

Before you rely on it

What has to be true first.

  • The design names each boundary, its normal state and who can change it.
  • Dependencies are mapped, including what must keep running.
  • In OT and CNI, the process reaches a safe state before a route is withdrawn.
  • Failure behaviour and the restoration method are agreed and tested.
  • Wireless, cellular and other routes outside the design need their own controls.

Acceptance tests

Prove the operating conditions, not just the command.

  • Command, device-reported state and independent verification are recorded as separate observations.
  • Safe disconnection and restoration are tested in a planned window.
  • Each diode-protected pathway is tested on its own, without disrupting required local operation.
  • Alternative physical, wireless and cellular paths remain in scope for architecture review.

No guaranteed timing or universal fail-closed state is implied. Observed timings belong to the tested installation.

Related Control Plans

Adopt Array through a Control Plan.

The methods. CP-01 to CP-20 combine the appropriate Modules with a connection register, authorisation rules, runbooks and acceptance tests.

CP-05 Control Plan

CP-05 Critical Asset Protection Control Plan iconCritical Asset Protection

Separate business access from essential systems, with planned isolation boundaries.

Open CP-05

CP-15 Control Plan

CP-15 Operational Technology Protection Control Plan iconOperational Technology Protection

Industrial controllers behind a physical network boundary.

Open CP-15

Industry Blueprints adapt the Plans to each sector's systems, suppliers, continuity requirements and safety constraints. Explore the Blueprints.

Questions

Straight answers.

For security, network and operations owners.

What does Array do?

Array applies physical connection control around multiple diode-protected paths serving a named critical asset or tightly defined group of assets. It makes the permitted connection arrangement explicit rather than treating asset protection as a single switch.

What problem does it address?

Critical assets may depend on several data flows, engineering routes and operational interfaces. Protecting only one crossing can leave the essential boundary exposed elsewhere.

How is the physical control arranged?

A multi-overlay pattern used around separately assessed diode arrangements, with each pathway, dependency and permitted operational state recorded.

What does it not claim?

Array is not offline data storage, archive, backup or a guarantee that all critical-asset interfaces are unreachable. A diode's directionality comes from the diode design, not a switching command.

How does Array relate to Control Plans?

Modules are the physical control patterns. Control Plans combine the appropriate Modules with a connection register, authorisation rules, runbooks and acceptance tests. Array is used in CP-05 Critical Asset Protection and CP-15 Operational Technology Protection.

Is this a validated installation?

No. It is a reference arrangement. Deployment drawings, interlock behaviour, approvals, link-state verification and failure modes are confirmed for your estate in discovery and acceptance testing.

Your next step

Start with one critical connection.

We will help you identify the boundary, assess its dependencies and select the right Modules and Control Plans.

Discuss a critical connectionOr see all nine Modules