£1.9M
Average cost of OT downtime per ransomware incident
Threats addressed
Why the current setup leaves this data exposed.
Operational Technology recovery fails when the only copies of PLC programs, HMI projects, SCADA configurations and engineering records sit on connected infrastructure. When IT ransomware bridges across to the OT estate, those engineering shares are encrypted alongside production. Without an intact master copy, plant teams cannot prove the safety case is unchanged, cannot rebuild a line at speed, and cannot give regulators the evidence they need.
The scenario, and what physical disconnection changes.
One realistic sequence of events, then the controls that break it.
Scenario
A manufacturer is hit by ransomware on a Friday evening. The intrusion starts in IT, reaches the engineering jump host, and encrypts the shared drive holding PLC backups, HMI projects and SCADA configurations. The on-site NAS sits on the same network and is encrypted too. By Monday the line is still down, the safety officer cannot evidence the last validated state of the controllers, and the insurer is asking for the document trail that no longer exists.
Protection
- Golden image and config recovery: PLC programs, HMI projects and SCADA configurations held on physically disconnected media so a line restart is possible after ransomware or hardware failure.
- Golden image and config recovery: master copies are tamper-evident and verified, with no shared network path between the production estate and the offline store.
- Golden image and config recovery: scalable from a single cell to a multi-site estate, with per-asset versioning so engineers restore the right build for the right controller.
- OT ransomware recovery: master copies of engineering data sit beyond reach when IT bridges into OT, removing the leverage that forces a ransom decision.
- OT ransomware recovery: offline by default, reachable per session, so recovery teams can pull only what they need, when they need it, without re-exposing the archive.
- OT ransomware recovery: clean-room restore path keeps the offline copy isolated from any compromised network during rebuild.
- Safety-case evidence custody: validation records, change logs and HAZOP outputs preserved offline so the safety case survives the incident.
- Safety-case evidence custody: NIS2 and CAF evidence held in tamper-evident storage, ready to hand to auditors and regulators after an event.
- Safety-case evidence custody: long-horizon retention without a cloud account, so engineering records outlast vendor changes and platform churn.
Time to restart the line
Hours, not weeks
With golden images, engineering data and safety-case evidence held in Firevault Offline Secure Storage, the manufacturer restarted production in hours rather than weeks. No ransom was paid, the safety officer could evidence the last validated state of every controller, and the insurer received a complete document trail. Mark Fermor leads the OT custody programme at Firevault.
Hardware
The data sits on Firevault hardware, not a shared cloud tenancy.
Disconnect
Offline by default. No standing network path in or out.
Command
Access opens on your instruction, identity checked and logged.
Location
Held in a Firevault Bunker. Firevault provisions the location unless you request one in writing.
More ways organisations use #OSS.
Every use case follows the same four physical principles, applied to different data.
Which offline secure storage solution is right for you?
Answer a few quick questions and we will recommend the right solution, whether that is a personal vault or a scalable offline storage system built for your needs.
Takes about 2 minutes. No account needed.