--- title: "Array: Multi-boundary critical asset protection | Firevault" url: https://fire-vault.com/control-module/array description: "FV-06 Array. Protect a named critical asset through multiple assessed, diode-protected connection boundaries. Protect the asset across the paths that matter." lang: en-GB --- Control Module FV-06 # Array Multi-boundary critical asset protection Array applies physical connection control around multiple diode-protected paths serving a named critical asset or tightly defined group of assets. It makes the permitted connection arrangement explicit rather than treating asset protection as a single switch. Discuss a critical connection: https://fire-vault.com/contact?subject=control See it work Protect the asset across the paths that matter. Incident Path exposed Outcome Control taken The problem ## The problem Array addresses. Critical assets may depend on several data flows, engineering routes and operational interfaces. Protecting only one crossing can leave the essential boundary exposed elsewhere. What it does Before a connection changes Every deployment starts with a named physical boundary, a defined normal state, mapped dependencies, an agreed decision-maker, failure behaviour and a tested restoration method. Disconnecting one controlled link does not remove alternative routes outside the design. The physical-control arrangement ## Several diode-protected paths, each with its own control point. Agreed before it is needed. A multi-overlay pattern used around separately assessed diode arrangements, with each pathway, dependency and permitted operational state recorded. 1. ### Name the asset Identify the named protected asset. 2. ### Map its pathways Map its diode-protected pathways and essential services. 3. ### Specify each overlay Specify each controlled overlay and its normal state. 4. ### Change only the assessed path Authorise and apply changes only to the assessed path. 5. ### Verify every boundary Verify the state of each boundary without disrupting required local operation. What it does - Protect a named critical asset through multiple assessed, diode-protected connection boundaries. - Acts only on the registered crossings in the agreed design. - Records the command, the reported state and any independent verification separately. What it does not claim - Array is not offline data storage, archive, backup or a guarantee that all critical-asset interfaces are unreachable. A diode's directionality comes from the diode design, not a switching command. - Act on routes outside the registered design. See it work ## One critical asset. Several diode-protected paths. A named critical asset served by distinct diode-protected pathways, each with its own physical-control point. A change on one path does not change the others. Outbound paths Named critical asset Inbound path **Monitoring centre**Receives telemetry through diode A **Business historian**Receives reports through diode B **Critical asset**For example a protection system **Update staging**Sends approved updates through diode C Stage ### The asset and its pathways The named asset is served by three distinct diode-protected pathways, each recorded with its essential services and normal state. Recorded by the asset and security owners. Commanded No change. Reported by the control point A and B connected. C held disconnected. Independently verified Matches the state confirmed at the last test. Selected boundary _ Image: Array module emblem: magenta and slate diamond around a white ring, for keeping assets within physical boundaries (https://fire-vault.com/assets/archive-icon-B3rc85NY.png) _**Array · FV-06 Diode-protected path A**Critical asset to monitoring centre, one-way by diode design · OT, CNI Normal state Connected for outbound telemetry. What changes it An authorised change to this path only. What Array does Array controls the physical connection around diode A. The diode, not Array, provides the one-way behaviour. Concept illustration. A diode’s directionality comes from the diode design, not a switching command. Array is not offline data storage, archive or backup. Operational boundaries and tests ## Agreed in advance. Tested before it counts. Before you rely on it ### What has to be true first. - The design names each boundary, its normal state and who can change it. - Dependencies are mapped, including what must keep running. - In OT and CNI, the process reaches a safe state before a route is withdrawn. - Failure behaviour and the restoration method are agreed and tested. - Wireless, cellular and other routes outside the design need their own controls. Acceptance tests ### Prove the operating conditions, not just the command. - Command, device-reported state and independent verification are recorded as separate observations. - Safe disconnection and restoration are tested in a planned window. - Each diode-protected pathway is tested on its own, without disrupting required local operation. - Alternative physical, wireless and cellular paths remain in scope for architecture review. No guaranteed timing or universal fail-closed state is implied. Observed timings belong to the tested installation. Related Control Plans ## Adopt Array through a Control Plan. The methods. CP-01 to CP-20 combine the appropriate Modules with a connection register, authorisation rules, runbooks and acceptance tests. CP-05 Control Plan ### Image: CP-05 Critical Asset Protection Control Plan icon (https://fire-vault.com/__l5e/assets-v1/7b5311e0-04ce-497c-b7da-9a1472237891/CP-05_critical-asset-protection.png) Critical Asset Protection Separate business access from essential systems, with planned isolation boundaries. Open CP-05: https://fire-vault.com/control-plan/protect-critical-infrastructure CP-15 Control Plan ### Image: CP-15 Operational Technology Protection Control Plan icon (https://fire-vault.com/__l5e/assets-v1/15b8a2eb-b5a0-41e9-aac9-093ff362430d/CP-15_operational-technology-protection.png) Operational Technology Protection Industrial controllers behind a physical network boundary. Open CP-15: https://fire-vault.com/control-plan/operational-technology-protection Industry Blueprints adapt the Plans to each sector's systems, suppliers, continuity requirements and safety constraints. Explore the Blueprints (https://fire-vault.com/control-blueprints). Questions ## Straight answers. For security, network and operations owners. What does Array do? What problem does it address? How is the physical control arranged? What does it not claim? Array is not offline data storage, archive, backup or a guarantee that all critical-asset interfaces are unreachable. A diode's directionality comes from the diode design, not a switching command. How does Array relate to Control Plans? Modules are the physical control patterns. Control Plans combine the appropriate Modules with a connection register, authorisation rules, runbooks and acceptance tests. Array is used in CP-05 Critical Asset Protection and CP-15 Operational Technology Protection. Is this a validated installation? No. It is a reference arrangement. Deployment drawings, interlock behaviour, approvals, link-state verification and failure modes are confirmed for your estate in discovery and acceptance testing. Your next step ## Start with one critical connection. We will help you identify the boundary, assess its dependencies and select the right Modules and Control Plans. Discuss a critical connection (https://fire-vault.com/contact?subject=control)Or see all nine Modules (https://fire-vault.com/control-modules) ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-module/array#webpage", "url": "https://fire-vault.com/control-module/array", "name": "Array: Multi-boundary critical asset protection", "description": "FV-06 Array. Protect a named critical asset through multiple assessed, diode-protected connection boundaries. Protect the asset across the paths that matter.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-module/array#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-module/array#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Module", "item": "https://fire-vault.com/control-module" }, { "@type": "ListItem", "position": 3, "name": "Array: Multi-boundary critical asset protection", "item": "https://fire-vault.com/control-module/array" } ] } ] ```