Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control and Cyber Essentials

Go beyond the UK baseline with physical isolation evidence.

Cyber Essentials establishes baseline security requirements for UK organisations. Control adds physical boundary evidence on top of the baseline. Firevault is Cyber Essentials Plus certified.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The problem

Baseline certification is necessary, and only the start.

Cyber Essentials certifies baseline controls at a point in time. Contracts and threats increasingly ask for more.

  1. Physical network boundaries on top of the Cyber Essentials boundary firewall requirement.

  2. Multi-party authorisation provides access control evidence beyond the baseline.

  3. Automated logging generates continuous compliance evidence between assessments.

Problem 1

Baseline vs reality.

Cyber Essentials certifies baseline controls at a point in time, and control effectiveness can degrade between assessments.

Answered byPhysical boundary protection

Problem 2

Boundary device limitations.

Cyber Essentials requires boundary firewalls, but firewalls can be misconfigured, bypassed or compromised.

Answered byGoverned access control

Problem 3

Supply chain requirements.

Government and enterprise contracts increasingly require Cyber Essentials Plus, and stronger evidence helps a bidder stand out.

Physically disconnected Offline Secure Storage: server, three drives and a padlock
Answered byContinuous evidence

The mapping

Where the Cyber Essentials controls meet Control modules.

The five Cyber Essentials technical controls, each mapped to the modules that add physical evidence.

Cyber Essentials control Control modules How Control helps
CE 1Firewalls and boundary protection
  • Fracture
  • Isolate
 The boundary is physical, not a configurable rule. Severed by default.
CE 2Secure configuration
  • Anchor
  • Validate
 Configurations and golden images sit in tamper-evident offline storage.
CE 3User access control
  • Lock
  • Unlink
  • Relay
 Reach is named, scoped and time-bound, with revocation at the boundary.
CE 4Malware protection
  • Transfer
  • Validate
 Removable media and inbound paths are governed Transfer events with validation.
CE 5Security update management
  • Relay
  • Execute
 Updates apply through named, time-bound Relay sessions with multi-party approval.

Alignment, not certification. Control can help support these measures; your assessor decides what satisfies them.

The scenario

Scenario: a supply chain tender with physical evidence.

When every bidder holds Cyber Essentials Plus, the evidence behind it is what differs. Step through it, or play it through.

Step 1 of 2

Without physical evidence

A government department evaluates three suppliers, all holding Cyber Essentials Plus.

Two rely on software-based boundary controls, with past configuration incidents.

Boundaries
Logical, configured in software
Evidence
Point-in-time, at each audit

An illustrative scenario.

Capabilities

What you get with every deployment.

Six things Control gives a Cyber Essentials programme, from the first boundary to the audit afterwards.

Cyber Essentials

Physical boundary protection

Physical network boundaries on top of the Cyber Essentials boundary firewall requirement.

Cyber Essentials

Governed access control

Multi-party authorisation provides access control evidence beyond the baseline.

Cyber Essentials

Continuous evidence

Automated logging generates continuous compliance evidence between assessments.

Cyber Essentials

Secure configuration support

Physical zone separation helps keep secure configurations in place.

Cyber Essentials

Assessment-ready logs

Tamper-evident logs give audit trails ready for Cyber Essentials Plus technical verification.

Cyber Essentials

Clean recovery capability

Verified control-plane baselines support clean system restoration.

Adoption guide

From gap assessment to continuous evidence.

  1. 1

    Baseline assessment

    Review your current Cyber Essentials controls and identify where physical enforcement adds most.

  2. 2

    Physical boundary design

    Design physical boundary enforcement for your network perimeter and internal zone boundaries.

  3. 3

    Pre-assessment deployment

    Deploy Control before your next Cyber Essentials Plus assessment.

  4. 4

    Full boundary enforcement

    Organisation-wide physical boundary enforcement with continuous evidence.

Questions

What teams ask about Control and Cyber Essentials

It is the UK baseline, and a good start. Whether it is enough depends on your risk and your contracts; physical boundary evidence adds to it where the risk calls for it.

It adds physical boundary evidence and tamper-evident logs that support the technical verification.

No. Your Cyber Essentials controls stay. Control adds a physical layer and evidence on top.

Many contracts require Cyber Essentials Plus. Physical boundary evidence helps a supplier show more than the certificate.

All questions

Map Control to your regulator’s language.

Walk through Cyber Essentials with the Firevault team and see where physical evidence fits your programme. Alignment, not certification.