A Guide to Proving Compliance Through Control with a Control Blueprint

Share

About this guide

This guide is written for security, infrastructure and risk leaders who need to demonstrate control rather than only document it. It explains one Control Blueprint, CP-06, in plain terms: the failure it addresses, the Control Modules it uses, how those modules work together, and how a deployment is scoped.

Control by Firevault is a suite of nine purpose-built modules: a set of tools and techniques that give you physical control over the paths into and across your estate. A Control Blueprint is a proven combination of those modules assembled for a specific outcome. This guide covers one blueprint. The Control overview covers the nine modules and the full set of blueprints.

The problem this blueprint addresses

Audit findings rarely dispute that a policy exists. They dispute whether the policy was enforced on the day in question. Where enforcement lives only in configuration, the evidence trail is reconstructed after the fact rather than produced by the control itself.

CP-06 at a glance

• Lead layer VAULT
• Primary modules Validate, Lock, Archive
• Supporting modules Transfer, Relay, Execute, Firebreak
• Typical sectors Financial services, healthcare, public sector and critical infrastructure

The primary modules

These modules do the work the blueprint is named for.

• Validate checks the request, command or identity before anything opens.
• Lock holds access to the systems that matter behind identity and condition controls.
• Archive preserves logs, records and evidence beyond the reach of the live estate.

The supporting modules

These modules round out the pattern and are usually added as the deployment matures.

• Transfer governs what data is allowed to move, in which direction, and when.
• Relay opens a controlled, time-bound crossing and closes it again on schedule.
• Execute fires the control action on signal, without waiting for a change window.
• Firebreak physically breaks the connection path, so a route only exists when it is deliberately opened.

What good looks like

• Every request is checked before it proceeds, and the check is recorded.
• Access restriction can be demonstrated, not asserted.
• Records, logs and evidence are preserved outside the reach of the estate.
• Auditors are shown control behaviour, not control intent.

How the blueprint is deployed

Control Modules are a suite of tools and techniques deployed within your own estate and applied to the paths they govern: at a boundary, inside a zone, or at a third-party edge. Authorisation and evidence remain local, so losing connectivity to Firevault never opens a path.

Most deployments start with a single boundary or zone, prove the control behaviour, then extend the same blueprint across the estate. Modules can be customer-operated or co-managed.

How to scope it

Scoping starts with the paths, not the product. A short discovery exercise identifies the boundaries that matter, who needs to cross them, how often, and what evidence is required. That produces the module count and placement, which in turn produces the price. Blueprints are combined where an estate has more than one problem to solve.

Next steps

• Read the full blueprint detail: CP-06 blueprint
• See all nine modules and the other blueprints: Control by Firevault
• Talk it through with our team: contact Firevault

How Firevault would handle this

Controls an auditor can physically verify

Firevault gives you physical separation, named custody and evidenced access, so compliance claims about isolation and control are things you can show, not just assert.