---
title: "ICS Control | Just-in-time access to PLCs and controllers | Firevault"
url: https://fire-vault.com/ics-control
description: "Keep remote routes to PLCs, HMIs, SCADA, refrigeration and building controllers physically disconnected, opening just-in-time access for approved engineering…"
lang: en-GB
---

Control by Firevault (https://fire-vault.com/control) / ICS Control

# ICS Control. Keep remote routes to PLCs closed.

Industrial control systems run on PLCs, controllers, HMIs and SCADA that keep processes, cooling and buildings working around the clock. Control by Firevault keeps selected remote routes to them disconnected, opening just-in-time access for approved engineering work.

Discuss your Control requirements: https://fire-vault.com/contact?subject=control
See where Control applies

Which routes can reach your PLCs, and do they need to stay connected?

Incident

Path exposed

Outcome

Control taken

Why connection control matters

## A connection change is a service decision.

A changed set point can spoil stock, stop a line or put equipment outside safe limits. Cutting communications carelessly can also remove the monitoring and alarms operators rely on.

PLCs and controllers are often reachable through vendor modems, cellular routers, building-management gateways or a standing IT/OT link. Many were never designed to defend themselves, and a remote route can change set points, logic or alarms.

Reported incidents in related sectors

### French supermarket chains

Sector

Retail & Supermarkets

What was reported

A cyber attack was reported to have affected refrigeration equipment at supermarkets in France.

Refrigeration: https://fire-vault.com/control-blueprint/retail
The Guardian: https://www.theguardian.com/world/2026/oct/12/cyber-attack-defrosts-refrigerators-france-supermarket-chains-intermarche-cooperative-u

### South Staffs Water

2022

Sector

Water

What was reported

Attackers were inside the network for nearly two years before they were found. Drinking water stayed safe, but customer data was published and the ICO later fined the company.

Customer data: https://fire-vault.com/control-blueprint/utilities-water
Bitdefender, reporting the ICO: https://www.bitdefender.com/en-au/blog/hotforsecurity/uk-water-1-million-hackers-ransomware

### Ukrainian distribution companies

2015

Sector

Energy

What was reported

Attackers used remote access to open substation breakers, cutting power to around 230,000 customers for several hours.

Grid operations: https://fire-vault.com/control-blueprint/energy
Wikipedia summary of public reporting: https://en.wikipedia.org/wiki/2015_Ukraine_power_grid_hack

These incidents show how a connection path can shape what happens next. They are not claims about what any single control would have prevented.

What Control changes

## Three things you can control physically.

Control complements your network security, detection, identity management and incident response. It does not replace them. **It gives their decisions a physical place to act, on the connections you select.**

Control access

### Govern when selected connections may exist.

Supplier, engineering and partner routes are connected just-in-time for approved work, to named systems, for a set window, and disconnected afterwards. Not open by default.

Control Plans

Control third-party connections: https://fire-vault.com/control-plan/control-third-party-access
Control connections in two approved stages: https://fire-vault.com/control-plan/security-airlock

Control exposure

### Reduce unnecessary standing paths into critical systems.

Each critical system keeps the connections it genuinely needs, inside a defined physical boundary. Paths it does not need are disconnected.

Control Plans

Enforce physical network boundaries: https://fire-vault.com/control-plan/enforce-physical-segmentation
Protect critical system connections: https://fire-vault.com/control-plan/protect-critical-infrastructure

Control intervention

### Physically disconnect selected connections under an agreed authority.

When your response plan calls for it, the selected path is physically disconnected on a decision by the people or rules you agreed in advance, and stays disconnected until an authorised release.

Control Plans

Contain ransomware spread: https://fire-vault.com/control-plan/stop-kill-chain-ransomware
Contain a live incident: https://fire-vault.com/control-plan/contain-active-breaches
Authorise emergency disconnection: https://fire-vault.com/control-plan/executive-override

Where Control applies & Control modules

## ICS Control. The Modules that make a difference.

A refrigeration or automation supplier needs an hour on one PLC. The route opens just-in-time for that booked session, to that controller only, and is physically disconnected again when the work ends.

Where do you need Control?

**Just-in-time controller access**

### Give just-in-time access to PLCs and controllers.

Lock opens a just-in-time route to the named PLC or controller for the approved window, Validate requires two independent approvals, and Relay stages access through an intermediate zone where a three-zone airlock is required. Refrigeration, building controllers and process safety remain separately assessed.

Commanded

Permit the assessed controller task for the approved window only.

Reported by the control point

Illustrative controller route available for the window; other routes disconnected.

Independently verified

Operations must validate process state, safety dependencies and actual connectivity.

Explore ICS Control (https://fire-vault.com/ics-control)

Modules in this example

**Lock**Time-controlled physical connectivity: https://fire-vault.com/control-module/lock
**Validate**Independent two-person connection approval: https://fire-vault.com/control-module/validate
**Relay**Controlled access through a security airlock: https://fire-vault.com/control-module/relay

Explore all nine Modules (https://fire-vault.com/control-modules)Explore adoption approaches (https://fire-vault.com/control-plans)

Concept illustration. Commanded, reported and independently verified states are shown separately because they are not the same thing, and what can be verified depends on your deployment. Disconnecting a selected path changes what can use that path. On its own, it does not contain an incident across a whole environment, and routes outside the plan, such as wireless or cellular links, need their own controls.

Control Blueprints

## Your industry’s connections, mapped and controlled.

How ICS Control applies in the industries where these connections matter most. Each Blueprint maps real systems, suppliers and operating constraints.

Image: Retail & Supermarkets Blueprint icon (https://fire-vault.com/__l5e/assets-v1/7541675b-e803-4825-b41f-8c7753b16d3b/BP-17_retail.png)

### Retail & Supermarkets

Protect the cold chain. Control the connection.

Read the Retail & Supermarkets Blueprint (https://fire-vault.com/control-blueprint/retail)

Image: BP-01 Water Control Blueprint icon (https://fire-vault.com/__l5e/assets-v1/c813ccff-24b8-48e9-8cf9-37bc1872048d/BP-01_water.png)

### Water

Treatment and distribution SCADA.

Read the Water Blueprint (https://fire-vault.com/control-blueprint/utilities-water)

Image: BP-02 Energy Control Blueprint icon (https://fire-vault.com/__l5e/assets-v1/4f1631a8-bbd0-4122-94d4-3dc5305d050b/BP-02_energy.png)

### Energy

Electricity network control systems.

Read the Energy Blueprint (https://fire-vault.com/control-blueprint/energy)

Image: Oil & Gas Blueprint icon (https://fire-vault.com/__l5e/assets-v1/f4e534c3-a09f-4b1e-b266-7e25e6a1986e/BP-03_oil-gas.png)

### Oil & Gas

DCS, SCADA and refinery control paths.

Read the Oil & Gas Blueprint (https://fire-vault.com/control-blueprint/oil-and-gas)

See all industry Blueprints (https://fire-vault.com/control-blueprints)

Fifteen Blueprints are published. Each deployment is designed around your own estate.

Firevault, as featured in

- Read about Firevault on TechRadar Pro: https://www.techradar.com/pro/uk-startup-put-physical-disconnect-switch-in-its-cloud-storage-offering-to-mitigate-ransomware-attacks-but-will-that-be-enough
- Read about Firevault on Yahoo Finance: https://uk.finance.yahoo.com/news/firevault-launches-help-businesses-directors-074500961.html
- Read about Firevault on Channel Insider: https://www.channelinsider.com/security/tools-and-platforms/firevault-security-offline-platform-offering/
- Read about Firevault on Security Buyer: https://securitybuyer.com/uk-cybersecurity-startup-launches-firevault/
- Read about Firevault on SecurityBrief: https://securitybrief.com.au/story/firevault-unveils-offline-digital-vault-to-combat-rising-cyber-risks

How Control works

## Decisions made by people. Enforced physically.

Your tools detect, your people and policies decide, and Control changes the connection state of the selected path. Here is what that rests on.

### Physical enforcement

Control changes the connection state of a selected path at Layer 1: connected, or physically disconnected. It does not inspect or alter the traffic on it.

### An independent command path

Commands reach each control point over a configured command path, kept separate from the network being controlled. How each point behaves if that path is lost is agreed and tested.

### Authorised changes

Who can connect, disconnect or release each path is agreed in advance: named people, more than one approval where it matters, or rules and high-confidence alerts you set.

### Evidence, as configured

Commands, approvals and reported states can be recorded for your deployment, so you can show what changed, when, and on whose authority.

Before you deploy

## Physical control is an operational decision.

Confirm the selected paths, supporting systems and failure behaviour in the actual environment. No generic drawing can substitute for this assessment.

1. **PLCs and field controllers**Inventory every route to each PLC, including vendor modems, cellular routers and building-management gateways.
2. **HMIs, SCADA and engineering workstations**Keep local control, interlocks, safety systems and independent alarms communicating.
3. **Refrigeration, HVAC and building management controllers**Test command loss, power-loss behaviour and restoration in a safe maintenance context.
4. **Vendor remote access, cellular routers and IT/OT crossings**Agree emergency engineering access and override procedures before deployment.

Control governs the selected paths in your plan. It does not inspect traffic, and wireless, cellular and other routes outside the plan need their own controls.

### Straight answers

No. They detect, filter and investigate. Control adds a physical way to act on the selected paths when your people, or rules you have agreed, decide to.

No. It changes whether a selected path is connected. It does not read or change what travels on it.

It can, which is why the dependencies, safe states and restoration steps for each path are agreed and tested with your operations and safety owners before anything goes live.

It controls selected connectivity. Disconnecting a path removes the connections an AI system was using and gives people an independent way to intervene. It does not necessarily stop a model or process running locally.

No. Control governs connections. Keeping data physically offline is Offline Secure Storage®, a separate Firevault product that can sit alongside Control.

Yes. Start with one connection: a supplier route, an IT–OT crossing, or the path to one critical system.

Your next step

## Start with one critical connection.

Begin with one engineering connection. Agree its purpose, intervention authority, dependencies and the checks that make restoration acceptable.

Discuss your Control requirements (https://fire-vault.com/contact?subject=control)

Or explore the nine Control Modules first: https://fire-vault.com/control-modules

Discuss requirements: https://fire-vault.com/contact?subject=control
Speak to the team: https://fire-vault.com/contact?subject=control

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://fire-vault.com/#organization",
    "name": "Firevault",
    "legalName": "Firevault Limited",
    "url": "https://fire-vault.com",
    "logo": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/logo.png",
      "width": 200,
      "height": 60
    },
    "foundingDate": "2025-03",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "address": {
      "@type": "PostalAddress",
      "addressCountry": "GB",
      "addressLocality": "United Kingdom"
    },
    "contactPoint": [
      {
        "@type": "ContactPoint",
        "contactType": "customer service",
        "email": "hello@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      },
      {
        "@type": "ContactPoint",
        "contactType": "sales",
        "email": "sales@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      }
    ],
    "founder": [
      {
        "@type": "Person",
        "name": "Mark Fermor",
        "jobTitle": "Founder, CTO and CMO"
      },
      {
        "@type": "Person",
        "name": "David Bailey",
        "jobTitle": "Founder and CEO"
      }
    ],
    "areaServed": [
      "United Kingdom",
      "Europe",
      "United States",
      "Middle East"
    ],
    "sameAs": [
      "https://www.linkedin.com/company/firevault",
      "https://x.com/firevaultuk"
    ],
    "slogan": "Disconnect to Protect",
    "brand": [
      {
        "@type": "Brand",
        "name": "Offline Secure Storage"
      },
      {
        "@type": "Brand",
        "name": "Control by Firevault"
      },
      {
        "@type": "Brand",
        "name": "Firebreak"
      }
    ],
    "knowsAbout": [
      "Offline Secure Storage",
      "Physically disconnected data storage",
      "Physical Air Gap Data Protection",
      "Ransomware Protection",
      "Ransomware recovery",
      "3-2-1-1-0 backup rule",
      "AI kill switch",
      "Operational technology security",
      "Critical national infrastructure resilience",
      "Data Sovereignty",
      "GDPR Compliance",
      "NIS2 Compliance",
      "DORA Compliance",
      "NCSC Cyber Assessment Framework"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "@id": "https://fire-vault.com/#website",
    "name": "Firevault",
    "alternateName": [
      "Firevault",
      "Firevault UK",
      "Firevault Limited"
    ],
    "url": "https://fire-vault.com",
    "publisher": {
      "@id": "https://fire-vault.com/#organization"
    },
    "inLanguage": "en-GB",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}"
      },
      "query-input": "required name=search_term_string"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "WebPage",
    "@id": "https://fire-vault.com/ics-control#webpage",
    "url": "https://fire-vault.com/ics-control",
    "name": "ICS Control",
    "description": "Keep remote routes to PLCs, HMIs, SCADA, refrigeration and building controllers physically disconnected, opening just-in-time access for approved engineering…",
    "isPartOf": {
      "@id": "https://fire-vault.com/#website"
    },
    "about": {
      "@id": "https://fire-vault.com/#organization"
    },
    "primaryImageOfPage": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/images/og/og-base-home.jpg"
    },
    "inLanguage": "en-GB",
    "breadcrumb": {
      "@id": "https://fire-vault.com/ics-control#breadcrumb"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "@id": "https://fire-vault.com/ics-control#breadcrumb",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://fire-vault.com"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "ICS Control",
        "item": "https://fire-vault.com/ics-control"
      }
    ]
  }
]
```