Rule J.9 changed the game. Put your club's records beyond reach.

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

Premier League clubs now face 22 mandatory information security control areas under Rule J.9 and Appendix 11. Our explainer sets out the requirements, the deadlines and the UK GDPR exposure that sits behind them in plain English.

The league now asks for evidence.

Rule J.9 and Appendix 11 expect a club to show how it protects critical systems and data, not simply state that it does.

Ransomware reaches the recovery copy.

If the copy the club depends on sits on a reachable network, an attacker who owns the network owns the recovery plan too.

A match day cannot pause.

Turnstiles, safety systems and broadcast obligations do not wait while a club decides how to contain an incident.

The data outlives the staff.

Registrations, medical files and commercial agreements must remain retrievable long after the people who filed them have moved on.

We map our controls to the outcomes clubs are being asked to evidence. We do not claim certification on a club's behalf, and a vault is not a substitute for the club's wider security programme.

Six areas where offline changes the answer.

Use this as the shortlist before the compliance deadline. Each row states what a club has to show and what a physically disconnected copy contributes.

Backups and recovery

What clubs must show: Clubs must hold recoverable copies of critical data and prove they can restore after an incident.

How OSS helps: A physically disconnected copy of the club's critical records that ransomware on the club network cannot reach, encrypt or delete.

Access control and identity

What clubs must show: Access to club systems and data must be controlled, verified and reviewed.

How OSS helps: One vault, one named user. Every session begins with identity verification and ends with the drives physically disconnected again.

Logging and audit evidence

What clubs must show: Clubs must be able to show who accessed what, and when.

How OSS helps: Every retrieval records the user, the device, the files and the timestamp, giving the club an evidence pack for the league and the ICO.

Supplier and third-party risk

What clubs must show: Clubs are accountable for the suppliers, agencies and platforms that hold club data.

How OSS helps: Contracts, player records and commercial agreements held offline under the club's sole control, rather than spread across supplier clouds.

Incident response and containment

What clubs must show: Clubs must be able to contain an incident and keep operating on a match day.

How OSS helps: Firevault Control adds a governed physical disconnect, so a compromised path is severed without waiting for somebody to reach the hardware.

Data protection and retention

What clubs must show: Player, staff and supporter data carries UK GDPR obligations and retention duties.

How OSS helps: Long-retention records, medical files and academy paperwork stored offline for the retention period, with access on request only.

Keep live match-day, training and commercial platforms exactly where they are. Offline Secure Storage is for the smaller category of club information that must survive an incident, prove a position or satisfy a retention duty.

Player and squad records

Contracts, registrations, medical files, scouting reports and academy paperwork that must survive any incident.

Commercial and broadcast agreements

Sponsorship contracts, image rights, broadcast schedules and settlement paperwork held offline until they are needed.

Supporter and ticketing records

Historic ticketing, membership and hospitality records that no longer need to sit on a live, internet-facing platform.

Stadium and operations technology

Configuration records, plans and evidence for access control, turnstiles, safety systems and match-day operations.

Keep the club running.

• Live match-day and training systems

• Current-season working documents

• Ticketing and retail platforms in active use

• Media assets being edited or published

• Day-to-day collaboration across departments

Put consequence out of reach.

✓ Player contracts, registrations and medical files

✓ Commercial, sponsorship and broadcast agreements

✓ Historic supporter and ticketing records

✓ Board, legal and regulatory correspondence

✓ The recovery set the club cannot afford to lose

A club rarely buys storage. It buys the ability to answer a question from the league, an auditor, a regulator or a board, with a record rather than an assurance.

Chief Operating Officer

Evidence that the club can demonstrate the required control areas before the compliance deadline.

IT and Security Lead

A recovery set the club actually controls, plus a physical containment option for match day.

Club Secretary

Registrations, contracts and league correspondence retained and retrievable on request.

Head of Medical and Performance

Player medical and performance data held offline under strict access rules.

Data Protection Lead

Session-level access evidence for UK GDPR Article 32 and ICO enquiries.

Commercial Director

Sponsorship and broadcast agreements protected from exposure during a supplier incident.

A club should not have to become a security vendor. Firevault changes the state of the selected data itself, so the evidence follows from the design.

Physical hardware

Club records are held on physical storage allocated to the club rather than pooled cloud capacity.

Physical disconnection

When the vault is closed there is no standing network path to the selected club data.

Identity-controlled access

Access is linked to a verified named user, not a shared departmental account.

Evidence by design

Each session is logged, so the club can answer league, auditor and regulator questions with a record.

At Firevault, we have developed a control blueprint that is designed to physically sever power, taking physical control of the network in under six milliseconds. On a match day, that is the difference between a contained incident and a stadium operating blind.

The goal is a defensible position on the records that matter most, not simply more storage.

Online when the club needs it. Offline when it does not. Our team will scope the capacity, the users and the jurisdiction with you.

Vault

On-demand access to a digital safe deposit box for contracts, financial archives and operational records. 2TB, 4TB or 8TB, from £360 a month inc VAT.

Storage

Scalable offline capacity from 20TB upwards, designed with the solutions team around your requirement.

LUV

A low use vault for company essentials, licences and recovery information, reached on a nominated access day. 300GB, £74.99 a month inc VAT.

Vault

Physically offline between sessions.

Open a session

Ask from your registered phone and confirm it is you.

File Share

Work with your files for up to 120 minutes.

LUV

Opens on a day you choose each week, for 12 hours.

Storage

From 20TB, growing in 20TB steps.

20TB40TB60TB80TB+20TB