Cyber Essentials with Offline Secure Storage
Cyber Essentials provides baseline security controls. Offline Secure Storage (OSS) goes further, removing your most sensitive data from the attack surface entirely.
We Think This Is Hard to Ignore
The Co-op had Cyber Essentials certification when attackers exfiltrated 6.5 million members' personal data. Baseline controls protect the perimeter, but data inside the perimeter was still reachable. At Firevault, sensitive data is removed from the certified perimeter entirely, because protection beyond baseline starts with physical disconnection.
£14M
ICO fine to Capita, Cyber Essentials certified at time of breach
ICO, October 2025
£300M
Estimated cost of M&S ransomware despite baseline controls
Reuters, 2025
327
Public sector cyber incidents in 2024
NCSC Annual Review, 2025
6.5M
People affected in single Co-op breach
BBC News, 2025
Cyber Essentials is a baseline, not a ceiling.
Baseline Controls
Cyber Essentials covers firewalls, patching, and access controls, but not physical protection.
Beyond the Perimeter
Even with Cyber Essentials Plus, connected data remains reachable by determined attackers.
Government Contracts
Many government contracts now require Cyber Essentials Plus as a minimum.
Baseline certification does not prevent breaches.
Capita: £14M Fine Despite Holding Cyber Essentials Certification
Capita held baseline certifications at the time of its breach. The ICO still fined the company £14 million, demonstrating that Cyber Essentials without physical protection is insufficient for sensitive data.
ICO, October 2025
M&S: £300M Loss Despite Baseline Security Controls
Marks and Spencer had established security controls in place. Attackers bypassed them via a compromised third party and deployed DragonForce ransomware, shutting down online operations for months.
Reuters, 2025
Co-op: 6.5 Million Records Stolen Despite Security Measures
The Co-op had security measures in place but attackers still exfiltrated personal data of all 6.5 million members, demonstrating that connected data remains reachable regardless of baseline controls.
BBC News, 2025
Go beyond baseline with physical protection.
Offline Secure Storage (OSS) complements Cyber Essentials by removing the most sensitive data from the certified perimeter entirely.
- Sensitive data removed from the attack surface entirely
- Reduces scope of Cyber Essentials certification
- Supports government contract requirements
- Physical protection exceeds baseline controls
Take Sensitive Data Off the Certified Perimeter
Step 1 of 3Sensitive data is taken off the certified perimeter and written to physically disconnected RAID 1 drives inside a Firevault Bunker. This reduces the scope of what Cyber Essentials must protect and removes the most sensitive assets entirely.
Featured In
Win Business, Earn Trust, and Build Reputation with Butterfly
Butterfly is an operational model that helps organisations structure sensitive data to close deals faster, strengthen client relationships, and demonstrate the governance maturity that wins enterprise contracts.
Built on the VPPP framework (Vault, Policy, Permissions, Purpose), Butterfly maps your sensitive data and assigns dedicated Vaults by role, relationship, and purpose, turning data stewardship into a competitive advantage.
Deal Readiness
Governed materials ready to share with confidence
Client Trust
Demonstrate stewardship that earns loyalty
Board Confidence
Clear governance that inspires stakeholders
Enterprise Scale
Structure data governance across your organisation
Who Uses Butterfly?
-
Sales Teams
Secure client proposals, pricing, and commercial intelligence
-
Service Providers
Exchange sensitive documents with clients through governed Vaults
-
Businesses
Protect strategic plans, IP, and competitive intelligence
-
Family Offices
Structure data governance across principals, staff, and advisors
Questions
Frequently Asked
CAF-aligned
Mapped to CAF outcomes, not certified against CAF.
Firevault is not certified against the NCSC Cyber Assessment Framework. CAF is a self-assessment framework for essential service operators. The sections below show how our products help you evidence CAF outcomes in your own submission.
Offline Secure Storage and CAF
Using Offline Secure Storage supports CAF Objective B (Protecting against cyber attack) and Objective D (Minimising the impact of incidents). Gold copies live on hardware that is physically disconnected between sessions, giving operators evidence of protective isolation and a recoverable state.
Supports outcomes
Taking Control, deploying Blueprints and CAF
Deploying a Control Blueprint supports CAF Objective A (Managing security risk) and Objective C (Detecting cyber security events). Blueprints document identity-verified access, session logging and segregation between operational and archived data, so the controls can be pointed at CAF outcomes in a self-assessment.
Supports outcomes
Deploying Firebreak and CAF
Deploying Firebreak supports CAF Objective B (Protecting against cyber attack) at the network boundary of operational technology environments. Firebreak enforces physical-layer separation between OT and IT, giving CNI operators evidence of controlled paths for CAF network security outcomes.
Supports outcomes
Firevault maps controls to CAF outcomes to help essential service operators evidence their own self-assessment. Full mapping detail is available on request.