Vault product icon Compliance · Cyber Essentials

Cyber Essentials with Offline Secure Storage®.

Cyber Essentials sets baseline controls. Offline Secure Storage® takes the most sensitive data off the certified perimeter altogether. Confirm current Cyber Essentials Plus status, certificate scope and validity with Firevault before relying on it.

Schedule a demo View all compliance

Baseline-only control gaps
Post-certification breach
Government contract exposure
Sensitive-data over-reach

Gold copies
Audit trail
Verified access
Offline

As featured in

The reality

Certification raises the floor. It does not move the ceiling.

Each incident below is a matter of public record, and each one reached data that sat inside a certified, connected perimeter at the moment of compromise.

The records an attacker most wants leave the certified environment entirely and sit on hardware with no network connection while closed.
Every record moved offline is one the certified perimeter no longer has to protect, monitor or account for in an assessment.
Physical protection layered on top of the Cyber Essentials Plus baseline that many government contracts require.

Incident 1

Capita: £14m ICO fine.

The ICO fined outsourcer Capita £14 million over a 2023 cyber attack that affected the personal data of more than 6 million people. ICO, October 2025.

Answered bySensitive data off the perimeter

Incident 2

M&S: online orders paused for 46 days.

Attackers reached Marks and Spencer systems through a third party in spring 2025. Online orders were paused for 46 days, with an expected hit to profit of about £300 million.

Answered bySmaller certification scope

Incident 3

Co-op: 6.5 million members’ data stolen.

Attackers took personal data belonging to all 6.5 million Co-op members, including names and contact details. Co-op, July 2025.

Answered bySupports contract requirements

How OSS helps

Go beyond baseline
with physical protection.

Selected records are taken off the certified perimeter and written to dedicated RAID 1 drives inside a Firevault Bunker. When authorised staff need access, a physical connection is created after identity verification. When the session ends, the drives disconnect.

Step 1 of 3

Remove

Sensitive data are taken off the certified perimeter and written to dedicated RAID 1 drives inside a Firevault Bunker.

No cloud. No shared portal.

Where the records are: Dedicated RAID 1 drives
Live network: No longer holds the archive
Access: Identity-checked

Illustration.

Schedule a demo How OSS works

CAF-aligned

Mapped to CAF outcomes, not certified against CAF.

Firevault is not certified against the NCSC Cyber Assessment Framework, a self-assessment framework for essential service operators. These are the outcomes our products can help support in your own submission. Full mapping detail is available on request.

Offline Secure Storage® and CAF

Objectives B and D

Physically disconnected gold copies support B3 Data Security, B5 Resilient Networks and Systems, and D1 Response and Recovery Planning.

How OSS works

Control Blueprints and CAF

Objectives A and C

Identity-verified access, session logging and separation of operational and archived data support A2 Risk Management, A4 Supply Chain and C1 Security Monitoring.

See Control Blueprints

Firebreak® and CAF

Objective B at the OT boundary

Physical-layer OT/IT separation supports B2 Identity and Access Control, B4 System Security, and B5 Resilient Networks and Systems.

Explore Firebreak®

The products

Which Offline Secure Storage® fits certified organisations?

Every tier is the same physical principle at a different scale. Pick the access pattern that matches how your team works.

Vault

On-demand access, 24/7, to a digital safe deposit box. 2TB, 4TB or 8TB, from £360 a month inc VAT.

Create your Vault Explore Vault

LUV

Deep cold storage for sensitive records that do not need to sit inside the certified perimeter. 300GB, with one nominated access day each week within a 12-hour window. £74.99 a month inc VAT, 36-month commitment.

Choose LUV Explore LUV

Storage

Scalable offline capacity from 20TB upwards, designed with the solutions team around your requirement.

Talk to us Explore Storage

Vault

Physically offline between sessions.

Open a session

Ask from your registered phone and confirm it is you.

A session requested from a phone while files open on a desktop

File Manager

Work with your files for up to 120 minutes.

LUV

Opens on a day you choose each week, for 12 hours.

Storage

From 20TB, growing in 20TB steps.

Use cases for certified organisations

What certified organisations take offline first.

The records that matter most, and the ones an attacker would most like to reach.

Records

Sensitive personal data

Contracts

Government contract records

Recovery

Gold copies

Evidence

Certification evidence

Governance

Board papers

How to get started

From discovery call to go-live.

1
Discovery call

Understand what you need to protect and how you operate.
2
Vault configuration

Select your tier, capacity and access model.
3
Identity verification

Complete KYC/AML and set up multi-factor authentication.
4
Go live

Data ingestion, access policy activation and ongoing support.

Secured Firevault Bunker entrance with biometric entry and monitored access

Every Offline Secure Storage® instance is built on the same four physical principles.

Physics, not promises.

Every Offline Secure Storage® instance is built on the same four physical principles.

Physical storage

Offline Secure Storage instances are held on dedicated physical hard drives, not in S3 cloud buckets, shared storage pools or multi-tenant infrastructure. Your selected data is assigned to real hardware, with dedicated RAID 1 drives providing resilience.
Explore physical storage
Physical ownership

Each Offline Secure Storage instance is allocated to a specific customer, with dedicated physical capacity and clearly defined ownership. Your data is not pooled, commingled or held within a shared storage estate.
Explore physical ownership
Physical control

Access begins outside the normal network path. An authorised out-of-band command, such as SMS, controls the physical Layer 1 connection to your #OSS instance. When access is not required, that network path is physically disconnected.
Explore physical control
Physical security

Your #OSS hardware is housed in carefully selected, professionally managed data centres with layered physical security, resilient power and environmental controls. Access is tightly controlled using three-factor authentication, including biometric identification, supported by 24/7 monitoring, restricted access zones and a complete audit trail.
Explore physical security

Explore more

Related routes.

Questions

What certified organisations ask first

No. Cyber Essentials and Cyber Essentials Plus remain the baseline for your connected estate. OSS sits alongside them as a separate physical tier for the records that should not be reachable from that estate at all.

It can reduce what the perimeter must protect. Records held on physically disconnected hardware are outside the connected attack surface, which your assessor can take into account when scoping the certification.

On dedicated hardware in a secure Firevault Bunker. For security, we do not publish Bunker locations.

With a Vault, request a session at any time, 24/7, from your registered phone, sign in with your credentials and MFA, and work in File Share during a session of up to 120 minutes. LUV opens on your nominated access day each week, for 12 hours.

All questions about OSS

Take the most sensitive data off the certified perimeter.

LUV from £74.99 and Vault from £360 a month, including VAT. 36-month commitment, first payment at checkout.

Get started Schedule a demo

Schedule a demo Get started

Cyber Essentials with Offline Secure Storage®.