Vault product icon Compliance · ISO 27001

ISO 27001 with Offline Secure Storage®.

ISO 27001 requires a systematic approach to information security. Offline Secure Storage® supports Annex A physical, access and backup controls with hardware that is physically disconnected between sessions.

Schedule a demo View all compliance

Physical control gaps
Access-control failures
Certified but breached
Third-party control drift

Gold copies
Audit trail
Verified access
Offline

As featured in

The reality

An ISMS manages risk. It cannot remove reachability.

Each incident below happened inside an environment with policies, controls and audits in place. The common factor was data that remained reachable from a live network.

ISO 27001 asks you to treat unacceptable risks. Moving selected records onto physically disconnected hardware removes the risk rather than managing it.
Out-of-band authorisation, session logging and time-bounded access give auditors concrete artefacts instead of assertions.
Every record held offline is one your ISMS no longer has to wrap in compensating controls.

Incident 1

Capita: £14m ICO fine.

The ICO fined outsourcer Capita £14 million over a 2023 cyber attack that affected the personal data of more than 6 million people. ICO, October 2025.

Answered byPhysical security perimeters (A.7.1)

Incident 2

LastPass: £1.2m ICO fine.

The ICO fined LastPass £1.2 million after a 2022 breach in which attackers took encrypted password vaults belonging to up to 1.6 million UK users. ICO, December 2025.

Answered byAccess control (A.5.15)

Incident 3

M&S: online orders paused for 46 days.

Attackers reached Marks and Spencer systems through a third party in spring 2025. Online orders were paused for 46 days, with an expected hit to profit of about £300 million.

Answered byInformation backup (A.8.13)

How OSS helps

A physical control
inside your ISMS.

Selected records are written to dedicated RAID 1 drives inside a Firevault Bunker and held with no network connection while closed. Access is authorised out of band from a registered phone, a physical connection is created for the session, and the drives disconnect when it ends.

Step 1 of 3

Remove

Classified assets are taken off standard infrastructure and written to dedicated RAID 1 drives inside a Firevault Bunker.

No cloud. No shared portal.

Where the records are: Dedicated RAID 1 drives
Live network: No longer holds the archive
Access: Identity-checked

Illustration.

Schedule a demo How OSS works

CAF-aligned

Supporting your ISMS, not certifying it.

Firevault does not certify management systems and OSS is not an ISO 27001 certificate. It is a physical control you can cite in your Statement of Applicability as the treatment for risks that connectivity creates. Full mapping detail is available on request.

Offline Secure Storage® and CAF

Objectives B and D

Physically disconnected gold copies support B3 Data Security, B5 Resilient Networks and Systems, and D1 Response and Recovery Planning.

How OSS works

Control Blueprints and CAF

Objectives A and C

Identity-verified access, session logging and separation of operational and archived data support A2 Risk Management, A4 Supply Chain and C1 Security Monitoring.

See Control Blueprints

Firebreak® and CAF

Objective B at the OT boundary

Physical-layer OT/IT separation supports B2 Identity and Access Control, B4 System Security, and B5 Resilient Networks and Systems.

Explore Firebreak®

The products

Which Offline Secure Storage® fits your ISMS?

Every tier is the same physical principle at a different scale. Choose the access pattern that matches the assets in your risk register and the people who need them.

Vault

On-demand access, 24/7, to a digital safe deposit box. 2TB, 4TB or 8TB, from £360 a month inc VAT.

Create your Vault Explore Vault

LUV

Deep cold storage for classified records and audit evidence accessed periodically. 300GB, with one nominated access day each week within a 12-hour window. £74.99 a month inc VAT, 36-month commitment.

Choose LUV Explore LUV

Storage

Scalable offline capacity from 20TB upwards, designed with the solutions team around your requirement.

Talk to us Explore Storage

Vault

Physically offline between sessions.

Open a session

Ask from your registered phone and confirm it is you.

A session requested from a phone while files open on a desktop

File Manager

Work with your files for up to 120 minutes.

LUV

Opens on a day you choose each week, for 12 hours.

Storage

From 20TB, growing in 20TB steps.

Use cases for certified organisations

What certified organisations take offline first.

The information assets your risk register rates highest, and the ones an attacker would most like to reach.

Records

Classified information assets

Evidence

ISMS audit evidence

Recovery

Backups and gold copies

Access

Access reviews and logs

Suppliers

Supplier assessments

How to get started

From discovery call to go-live.

1
Discovery call

Understand what you need to protect and how you operate.
2
Vault configuration

Select your tier, capacity and access model.
3
Identity verification

Complete KYC/AML and set up multi-factor authentication.
4
Go live

Data ingestion, access policy activation and ongoing support.

Secured Firevault Bunker entrance with biometric entry and monitored access

Every Offline Secure Storage® instance is built on the same four physical principles.

A control that cannot be misconfigured.

Every Offline Secure Storage® instance is built on the same four physical principles.

Physical storage

Offline Secure Storage instances are held on dedicated physical hard drives, not in S3 cloud buckets, shared storage pools or multi-tenant infrastructure. Your selected data is assigned to real hardware, with dedicated RAID 1 drives providing resilience.
Explore physical storage
Physical ownership

Each Offline Secure Storage instance is allocated to a specific customer, with dedicated physical capacity and clearly defined ownership. Your data is not pooled, commingled or held within a shared storage estate.
Explore physical ownership
Physical control

Access begins outside the normal network path. An authorised out-of-band command, such as SMS, controls the physical Layer 1 connection to your #OSS instance. When access is not required, that network path is physically disconnected.
Explore physical control
Physical security

Your #OSS hardware is housed in carefully selected, professionally managed data centres with layered physical security, resilient power and environmental controls. Access is tightly controlled using three-factor authentication, including biometric identification, supported by 24/7 monitoring, restricted access zones and a complete audit trail.
Explore physical security

Explore more

Related routes.

Questions

What ISMS owners ask first

OSS is a risk treatment, not a certificate. You cite it in your Statement of Applicability as the control for selected information assets, and the session logs, out-of-band authorisation and hardware enforcement become audit evidence.

It supports controls around information backup, access control and segregation by holding selected assets on dedicated hardware that is physically disconnected between sessions, with every access logged.

On dedicated hardware in a secure Firevault Bunker. For security, we do not publish Bunker locations.

With a Vault, request a session at any time, 24/7, from your registered phone, sign in with your credentials and MFA, and work in File Share during a session of up to 120 minutes. LUV opens on your nominated access day each week, for 12 hours.

All questions about OSS

Treat the risk your ISMS cannot manage away.

LUV from £74.99 and Vault from £360 a month, including VAT. 36-month commitment, first payment at checkout.

Get started Schedule a demo

Schedule a demo Get started

ISO 27001 with Offline Secure Storage®.