What is Control for Water?

Control for Water is the Firevault control model for water and wastewater operations. It governs which connectivity paths may exist, for what purpose, for how long and under whose authority, across the treatment works, pumping stations, remote telemetry sites and the IT/OT boundary that link them.

Where does Firebreak fit in Control for Water?

Firebreak® is the Layer 1 path control module within Control by Firevault. It sits below the firewall and decides whether a physical route exists at all, so a compromised rule, credential or supplier session has no standing path to use. Firewalls, segmentation and monitoring continue to do what they do best above it.

Which control modules does a water operator normally deploy?

Isolate, Validate, Relay and Archive govern what happens while a path is open: who authorised it, what may cross it, what is inspected and what is written to an unreachable copy. Firebreak decides whether the path exists in the first place. Most operators start with the IT/OT boundary and remote sites, then extend to supplier access and legacy systems.

How does Control for Water map onto the Purdue model?

The Control modules map against Purdue levels 0 to 3.5 and the IT/OT boundary, so architects can see exactly where physical path control belongs alongside existing zones and conduits rather than replacing them.

Where does Offline Secure Storage® fit?

Control governs the path; Offline Secure Storage® holds the recovery copy that an incident on that path cannot reach. For water operators that means configuration baselines, control-system backups, historian extracts and engineering records kept physically beyond the reach of the connected estate.

Does Control for Water support NIS2, the Security and Emergency Measures Direction and DORA-style evidence?

Yes. Every path decision becomes an auditable event with a named authoriser, a purpose and a duration, which is the evidence regulators and boards ask for when they question whether connectivity is intentional rather than inherited.

How does an operator pilot this without disrupting supply?

Pilots are scoped by consequence, not by geography: one boundary or one remote site, judged on reach, authority, evidence and recovery. Nothing is removed from the existing architecture during a pilot, so a rollback is a physical decision rather than a change programme.

Can you brief my board or OT team?

Yes. Reply to the delivery email and we will arrange a working session with Mark or David for your board, OT team or architecture group.

Control for Water Playbook

Control for Water
Deployment Playbook

Control the path. Protect the supply. Keep a clean copy.

A 28-page deployment playbook for water boards, CISOs, OT leaders and network architects. Firebreak® Layer 1 path control, the wider Control by Firevault modules and Offline Secure Storage® recovery copies, mapped against the Purdue model.

28 pages

22 min read

Water boards and executive teams

Control for Water: Deployment Playbook cover

Get the playbook

Emailed to you within a minute

First name *

Last name *

Work email *

Personal email addresses such as Gmail or Yahoo are not accepted.

Company *

Sector *

Job title *

I agree to receive the playbook and occasional Firevault briefings. See our privacy policy.

Email-gated GDPR compliant

01Foreword

Written by the people who build the controls.

The water sector's connectivity story has been written by convenience, not by design. Remote sites, third-party support, engineering tools and telemetry now share paths that were never intended to carry them.

Mark Fermor · CTO, CMO & Founder, Firevault

David Bailey · Founder & CEO, Firevault

The doctrine

Control the path. Govern the agent. Protect the asset.

Every Firevault playbook is grounded in the same doctrine behind our Offline Secure Storage® platform, so a decision taken in one chapter still holds in the next.

The Control for Water Playbook is a practical response. It explains, in plain language, how Firebreak Layer 1 physical path control complements existing firewalls and segmentation, where the wider Control by Firevault modules and Offline Secure Storage® recovery copies belong on the Purdue model, and how a water operator can pilot and scale the whole pattern without ripping up what already works.

It is written for the boards, CISOs, OT leaders and architects who now have to prove, to regulators and to themselves, that every connectivity choice is intentional and evidenced.

02What's inside

6 parts. Written for the people who own the decision.

Each chapter opens with the decision it exists to help you make, and closes with the evidence you should expect back.

The water-sector control problem

Why standing connectivity, third-party access and operational consequence sit at the heart of water cyber resilience.

Convenience connectivity is now a systemic risk
Physical path control is missing from most reference architectures

The control layers, Firebreak included

A plain-English explanation of Firebreak Layer 1 path control, the Control modules that sit around it and the offline recovery copy behind them, and how all three complement, never replace, firewalls, segmentation and monitoring.

Firebreak sits below the firewall, not beside it
Isolate, Validate, Relay and Archive govern what happens when a path is open
Offline Secure Storage® holds the copy the incident cannot reach

Control blueprint for water

From bridge to controlled exchange. Where the Control by Firevault modules and offline recovery copies sit across Purdue levels 0–3.5 and the IT/OT boundary.

A defensible reference architecture for OT engineering
Clear ownership boundaries between IT and OT

Deployment use cases

IT/OT boundary, SCADA protection, supplier access, remote sites, legacy systems, isolation and recovery, aviation air-lock, seven patterns end-to-end.

Each use case maps to a named Control module
Every pattern includes an evidence trail for regulators

Adoption model

Ownership, selection and command design: who decides the path, who opens it, and how the evidence is captured.

Path decisions become auditable events
Ownership sits with operations, not the supplier

Pilot to rollout

Four steps from assessment to company-wide deployment, with a pilot acceptance pack the board can sign off.

A pilot is judged on reach, authority, evidence and recovery
Rollout is staged by consequence, not geography

03Who it's for

Read it if you're accountable for the decision.

Water boards and executive teams
CISOs and heads of OT security
Network and control-system architects
Regulators and CNI programme leads

Sectors we hear from

Water & wastewaterEnergy & utilitiesCritical national infrastructureGovernment & defence

04A look inside

Real pages from the playbook.

A short preview of what lands in your inbox.

Control for Water: Deployment Playbook preview, Standing connectivity

Standing connectivity Full page in playbook

Control for Water: Deployment Playbook preview, Physical vs logical control

Physical vs logical control Full page in playbook

Control for Water: Deployment Playbook preview, IT / OT boundary

IT / OT boundary Full page in playbook

Control for Water: Deployment Playbook preview, Isolation and recovery

Isolation and recovery Full page in playbook

05Frequently asked

Questions leaders ask before requesting.

Something else on your mind? Reply to any Firevault email or write to founders@fire-vault.com.

06More Firevault playbooks

Each playbook is written for the people who own the decision, practical, UK-grounded and free to request.

Ready to read it?

Request Control for Water. Access opens on this page straight away, so you can read it here and download the PDF. We email a secure link to the same address as a backup.

Get the playbook Talk to Mark