--- title: "Controlled Post-Incident Reconnection | Control Plan CP-05…" url: https://fire-vault.com/control-plan/post-incident-reconnection description: "Bring withdrawn connections back one at a time, on agreed evidence and authority, instead of all at once." lang: en-GB --- Image: City buildings and business infrastructure at night (https://fire-vault.com/__l5e/assets-v1/0b0e0399-5298-4db1-b040-7f4a677ede65/control-hero-night-city.jpg) # The incident is contained. _Now, what do you reconnect first?_ Bring withdrawn connections back one at a time, on agreed evidence and authority, instead of all at once. Discuss a critical connection: https://fire-vault.com/contact?subject=control See it with Control Cyber Incidents & Containment Validate, Lock, Relay 0 industry Blueprints Assessed for your environment 01 · The problem ## Controlled Post-Incident Reconnection: what goes wrong. After an incident, the pressure to restore everything at once is intense. Reconnecting too early, or all at once, can reintroduce the attacker or reinfect systems that were cleaned. ### Why existing controls may leave it open 1 Recovery plans focus on restoring systems, less on the order in which connections return. 2 Connections are often restored in software from an environment that is still being verified. 3 It is hard to show afterwards who approved each reconnection and on what evidence. 02 · Firevault's approach ## Control the selected connections. Firevault works with your incident and service owners to agree the order in which connections return, the evidence required for each and who must approve it. Each selected connection is reconnected deliberately, one step at a time. FV-05**Validate**Designed around two independent approvals before a connection returns.: https://fire-vault.com/control-module/validate FV-08**Lock**Limits each reconnection to an approved time window until it is confirmed.: https://fire-vault.com/control-module/lock FV-03**Relay**Stages reconnection through an airlock rather than an open end-to-end route.: https://fire-vault.com/control-module/relay 03 · Before and with Control ## See the connections change. The connections that were always available, and their intended state once Control is in place. Your own design depends on your environment. Image: Control Studio (https://fire-vault.com/__l5e/assets-v1/9e2eb851-ed3d-4520-9811-0821708cf916/control-studio-logo.png) Concept view · CP-05 Controlled Post-Incident Reconnection From **Recovered systems** 1. Verified core services Physically disconnected 2. Systems still under review Physically disconnected 3. Essential services Stays connected, assessed To **Live business network** Relevant Control Modules - Validate: https://fire-vault.com/control-module/validate - Lock: https://fire-vault.com/control-module/lock - Relay: https://fire-vault.com/control-module/relay A simplified concept, not a network design. Device placement, connections and operating sequences are designed for your environment in Control Studio. Request a Studio design session (https://fire-vault.com/contact?subject=control) 04 · The outcome ## What changes for you. **What this Plan does not do:** This Plan does not verify that a system is clean. Two-person approval and recording depend on the supporting access and logging systems in the validated design. - Connections return in an agreed order, on agreed evidence. - Systems still under review stay disconnected. - Each reconnection is approved and recorded. 05 · Where it applies ## Industries where this Plan fits. Each industry Blueprint applies this Plan to its own systems, dependencies and safety considerations. ### Other Plans in Cyber Incidents & Containment CP-01Ransomware Containment: https://fire-vault.com/control-plan/stop-kill-chain-ransomware CP-02Live Incident Response: https://fire-vault.com/control-plan/contain-active-breaches CP-03Compromised Device Isolation: https://fire-vault.com/control-plan/compromised-device-isolation CP-04Data Exfiltration Interruption: https://fire-vault.com/control-plan/data-exfiltration-interruption 06 · Your environment ### After an incident, which connection would you trust to reconnect first, and on what evidence? Firevault reviews the connections in your own environment with the people who own them, then designs the Plan for you in Control Studio. Discuss a critical connection: https://fire-vault.com/contact?subject=control About Control Studio: https://fire-vault.com/studio ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/post-incident-reconnection#webpage", "url": "https://fire-vault.com/control-plan/post-incident-reconnection", "name": "Controlled Post-Incident Reconnection", "description": "Bring withdrawn connections back one at a time, on agreed evidence and authority, instead of all at once.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/post-incident-reconnection#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/post-incident-reconnection#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "Controlled Post-Incident Reconnection", "item": "https://fire-vault.com/control-plan/post-incident-reconnection" } ] } ] ```