--- title: "Restricted Environment Access | Control Plan CP-07 | Contro…" url: https://fire-vault.com/control-plan/restricted-environment-access description: "Access to sensitive or segregated environments that is staged, deliberate and never left standing open." lang: en-GB --- Loading Firevault Image: City buildings and business infrastructure at night (https://fire-vault.com/__l5e/assets-v1/0b0e0399-5298-4db1-b040-7f4a677ede65/control-hero-night-city.jpg) # Some environments are restricted for a reason. _Access should never be left standing open._ Access to sensitive or segregated environments that is staged, deliberate and never left standing open. Discuss a critical connection: https://fire-vault.com/contact?subject=control See it with Control Access & Third-Party Control Relay, Isolate, Lock 1 industry Blueprints Assessed for your environment 01 · The problem ## Restricted Environment Access: what goes wrong. Sensitive or segregated environments, such as secure enclaves, test ranges and regulated systems, sometimes need to be reached from less trusted networks. A single permanent link undermines the reason they were separated. ### Why existing controls may leave it open 1 Jump hosts and VPNs keep a standing route that can be found and misused. 2 Segregation is often enforced in software that an administrator can change. 3 Access may pass from public to private zones without any intermediate step. 02 · Firevault's approach ## Control the selected connections. Firevault designs access to the restricted environment so it is staged and deliberate. The connection is made in steps, for an approved purpose, and is not left open end to end. FV-03**Relay**Stages access through an airlock between zones.: https://fire-vault.com/control-module/relay FV-02**Isolate**Maintains an assessed double boundary around the environment.: https://fire-vault.com/control-module/isolate FV-08**Lock**Limits access to approved time windows.: https://fire-vault.com/control-module/lock 03 · Before and with Control ## See the connections change. The connections that were always available, and their intended state once Control is in place. Your own design depends on your environment. Image: Control Studio (https://fire-vault.com/__l5e/assets-v1/9e2eb851-ed3d-4520-9811-0821708cf916/control-studio-logo.png) Concept view · CP-07 Restricted Environment Access From **Less trusted network** 1. Direct access route Always connected 2. Staged, approved access Always connected 3. Monitoring out of the environment Always connected To **Restricted environment** Relevant Control Modules - Relay: https://fire-vault.com/control-module/relay - Isolate: https://fire-vault.com/control-module/isolate - Lock: https://fire-vault.com/control-module/lock A simplified concept, not a network design. Device placement, connections and operating sequences are designed for your environment in Control Studio. Request a Studio design session (https://fire-vault.com/contact?subject=control) 04 · The outcome ## What changes for you. **What this Plan does not do:** This Plan does not classify data or replace access control inside the environment. Sequencing between stages requires a validated design. - No standing route into the restricted environment. - Access happens in deliberate, approved steps. - The separation you designed is maintained. 05 · Where it applies ## Industries where this Plan fits. Each industry Blueprint applies this Plan to its own systems, dependencies and safety considerations. BP-05Aviation & Aerospace: https://fire-vault.com/control-blueprint/aviation ### Other Plans in Access & Third-Party Control CP-06Third-Party Access Control: https://fire-vault.com/control-plan/control-third-party-access CP-08Privileged Infrastructure Access: https://fire-vault.com/control-plan/privileged-access-control CP-09Scheduled Critical Maintenance: https://fire-vault.com/control-plan/maintenance-window-control CP-10High-Risk Production Changes: https://fire-vault.com/control-plan/change-window-enforcement 06 · Your environment ### Which restricted environment would you least like to have a standing connection into? Firevault reviews the connections in your own environment with the people who own them, then designs the Plan for you in Control Studio. Discuss a critical connection: https://fire-vault.com/contact?subject=control About Control Studio: https://fire-vault.com/studio ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/control-plan/restricted-environment-access#webpage", "url": "https://fire-vault.com/control-plan/restricted-environment-access", "name": "Restricted Environment Access", "description": "Access to sensitive or segregated environments that is staged, deliberate and never left standing open.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-platform.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/control-plan/restricted-environment-access#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/control-plan/restricted-environment-access#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Control Plan", "item": "https://fire-vault.com/control-plan" }, { "@type": "ListItem", "position": 3, "name": "Restricted Environment Access", "item": "https://fire-vault.com/control-plan/restricted-environment-access" } ] } ] ```