--- title: "Technical Guides: Architecture and Control | Firevault" description: "Technical guides on Zero Trust architecture, backup and recovery design, the Purdue Model and OT network segmentation, written for architects and engineers." lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/learn/guides/technical#webpage", "url": "https://fire-vault.com/learn/guides/technical", "name": "Technical Guides: Architecture and Control", "description": "Technical guides on Zero Trust architecture, backup and recovery design, the Purdue Model and OT network segmentation, written for architects and engineers.", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-learn.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/learn/guides/technical#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/learn/guides/technical#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Technical guides", "item": "https://fire-vault.com/learn/guides/technical" } ] }, { "@context": "https://schema.org", "@type": "CollectionPage", "name": "Firevault Technical Guides", "description": "Technical guides on Zero Trust architecture, backup and recovery architecture, the Purdue Model and OT network segmentation.", "mainEntityOfPage": "/learn/guides/technical", "author": { "@type": "Person", "name": "Mark Fermor" }, "publisher": { "@type": "Organization", "name": "Firevault" }, "hasPart": [ { "@type": "Article", "headline": "Zero Trust Architecture", "url": "https://fire-vault.com/learn/guides/zero-trust-architecture-guide", "about": "Access architecture" }, { "@type": "Article", "headline": "Backup and Recovery Architecture", "url": "https://fire-vault.com/learn/guides/backup-and-recovery-architecture-guide", "about": "Recovery architecture" }, { "@type": "Article", "headline": "The Purdue Model", "url": "https://fire-vault.com/news/the-purdue-model-everything-you-need-to-know", "about": "OT and ICS architecture" }, { "@type": "Article", "headline": "OT Network Segmentation", "url": "https://fire-vault.com/learn/ot-network-segmentation", "about": "OT and ICS architecture" }, { "@type": "Article", "headline": "Purdue Model Diagram", "url": "https://fire-vault.com/learn/purdue-model-diagram", "about": "Reference" }, { "@type": "Article", "headline": "NIST SP 1339 and OT Backup", "url": "https://fire-vault.com/learn/nist-sp-1339-ot-backup-guide", "about": "Recovery architecture" } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) Why OSS # Technical Guides How It Works How the architecture and the controls actually work. Each guide sets out the mechanism, the design decisions, the dependencies that break under attack and the limits worth stating plainly, before it covers where Firevault fits. Book a demo ![Corridor of offline storage racks inside a Firevault bunker](/assets/hero-square-bunker-B6Y7Qt9r.jpg) T1 ## Architecture, boundary by boundary These guides answer a mechanical question rather than a governance one. How does the control operate, what does it depend on, what happens to it when an attacker holds valid administrative credentials, and what does the design leave residual. [ Access architecture · Advanced ### Zero Trust Architecture What NIST SP 800-207 actually requires: the seven tenets, the policy engine, administrator and enforcement point, the four deployment approaches, and the three places Zero Trust reaches its limits. Read the guide ](/learn/guides/zero-trust-architecture-guide)[ Recovery architecture · Intermediate ### Backup and Recovery Architecture 3-2-1 and 3-2-1-1-0 stated precisely, how immutability is actually enforced, why immutable and offline are not synonyms, and how to design a recovery path that survives privileged compromise. Read the guide ](/learn/guides/backup-and-recovery-architecture-guide)[ OT and ICS architecture · Intermediate ### The Purdue Model Levels 0 to 5 boundary by boundary, how Purdue relates to IEC 62443, NIST SP 800-82 and the NCSC CAF, and the architectural question each boundary has to answer. Read the guide ](/news/the-purdue-model-everything-you-need-to-know)[ OT and ICS architecture · Advanced ### OT Network Segmentation Zones, conduits and enforcement in environments where devices cannot authenticate, cannot run an agent and cannot tolerate inline latency. Read the guide ](/learn/ot-network-segmentation)[ Reference · Reference ### Purdue Model Diagram The reference diagram, with each level, the traffic that legitimately crosses it, and the controls that belong at the boundary. Read the guide ](/learn/purdue-model-diagram)[ Recovery architecture · Intermediate ### NIST SP 1339 and OT Backup What the OT backup guidance asks for, and how to evidence recovery capability for control system configuration and process data. Read the guide ](/learn/nist-sp-1339-ot-backup-guide) ## The other two guide families [Role guides](/learn/guides/by-role) cover who is making the decision and what evidence that seat should expect. [Standards and framework guides](/learn/guides/standards) cover what a recognised standard requires and where Firevault can contribute to meeting it. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ![David Bailey](/assets/david-bailey-Dgqj8eaE.jpg) ![Kenny Phipps](/assets/kenny-phipps-CVyooRsR.jpg) Online Now Concierge ## Which offline secure storage solution is right for you? Answer a few quick questions and we will recommend the right solution, whether that is a personal vault or a scalable offline storage system built for your needs. Takes about 2 minutes. No account needed. Find Out Free 2 mins No sign-up