Offline Secure Storage®
Protect the asset.
A physically disconnected recovery copy for backup management, continuity and incident recovery, with every access session recorded.
Physically disconnected storage and governed access.
Explore OSSUnderstand the rules. Control the exposure.
The requirements are different for every organisation. The fundamentals are not. Understand the frameworks that matter, then see where physically disconnected storage and deliberately controlled connectivity can contribute.
One place for the requirement, the technical response and the evidence.
Why it matters
A framework tells you what to achieve. Not always how.
Compliance requirements are written around outcomes: protect information, limit exposure, govern access and prepare for disruption.
But the technical choices are yours. The important question is where your existing architecture leaves something continuously reachable, and which controls can change that.
Understand
What the framework expects and which organisations it concerns.
Align
See where Offline Secure Storage®, Control or both provide relevant technical measures.
Evidence
Identify what an organisation still needs to implement, document and test.
Find your industry
Your industry changes the requirements.
Start with the environment you operate in. We bring the relevant frameworks forward, then show their requirements alongside Firevault’s technical contribution.
Select your industry
Then your country or region
Explore the full framework library, then select the area most relevant to your organisation.
47 frameworks brought forward in the explorer below.
Digital operational resilience, ICT third-party dependency, information security and access governance.
OSS® for financial servicesBanking Blueprint
47 frameworks brought forward in the explorer below.
Sensitive patient records, essential services and controlled access to clinical and care infrastructure.
OSS® for healthcare dataHealthcare Blueprint
47 frameworks brought forward in the explorer below.
Client confidentiality, privileged documents and the records a firm must be able to recover.
47 frameworks brought forward in the explorer below.
Industrial continuity, operational boundaries and the systems behind essential services.
OSS® for OT recoveryEnergy BlueprintWater Blueprint
47 frameworks brought forward in the explorer below.
Industrial networks, external maintenance and protected engineering information.
OSS® for OT recoveryICS Control
47 frameworks brought forward in the explorer below.
Critical communication networks, shared facilities, service continuity and controlled operational access.
Data Centres BlueprintTelecommunications Blueprint
47 frameworks brought forward in the explorer below.
Public service information, essential operations and accountable security measures.
OSS® for public servicesPublic Sector Blueprint
47 frameworks brought forward in the explorer below.
Customer and payment information, business systems and third-party maintenance pathways.
OSS® for retail dataRetail Blueprint
47 frameworks brought forward in the explorer below.
Model, agent and supplier pathways that must stay under human control, with the records an AI system depends on held offline.
47 frameworks brought forward in the explorer below.
Suppliers handling controlled information, and systems that must stay available and provably untouched.
47 frameworks brought forward in the explorer below.
Flight operations, ground handling and passenger systems that must be recoverable and provably controlled.
47 frameworks brought forward in the explorer below.
Ship, port and terminal systems with limited connectivity, where recovery cannot depend on the shore network.
47 frameworks brought forward in the explorer below.
Competitive data, factory systems and garage networks that must stay private and recoverable.
47 frameworks brought forward in the explorer below.
Field, plant and pipeline control systems where a connected copy is a production risk.
47 frameworks brought forward in the explorer below.
International standards appear for every country. National and regional rules appear only for the country or region you choose.
Industry and country selection indicate potential relevance, not a determination that a particular regulation applies. Rules from one jurisdiction can also reach organisations elsewhere, for example when they provide services into the EU. Organisational activity and legal scope must be assessed separately.
The framework explorer
The framework first. The technology second.
Choose a regulation, standard or assessment framework. See what it means, who it concerns and the relevant contributions from both Firevault platforms.
Explore frameworks
United Kingdom
European Union
United States
North America
Australia
Middle East
Singapore
Canada
International
No frameworks in this library match that industry and country. Choose all countries to see the wider set.
Select any framework to see its detail without leaving this page.
EU directiveEU / essential and important entities
NIS2
Network and Information Security Directive, Directive (EU) 2022/2555
What is it?
Cybersecurity risk-management measures, management accountability and incident reporting for essential and important entities in the EU. UK organisations are covered by the NIS Regulations 2018 unless they provide services in the EU.
Who does it concern?
Essential and important entities in the sectors the Directive lists, as defined in each EU member state's national law. Size thresholds apply, with some exceptions.
Primary sourceRead the official framework
EU regulationEU / financial sector
DORA
Digital Operational Resilience Act, Regulation (EU) 2022/2554
What is it?
ICT risk management, incident handling, digital operational resilience testing and ICT third-party risk for EU financial entities, applying from 17 January 2025.
Who does it concern?
EU financial entities, including banks, insurers, investment firms and payment institutions, and, for the oversight provisions, critical ICT third-party service providers.
Primary sourceRead the official framework
UK sector ruleUK / financial services
FCA operational resilience
FCA operational resilience rules, SYSC 15A
What is it?
Firms identify important business services, set impact tolerances for severe but plausible disruption and show they can remain within them (SYSC 15A).
Who does it concern?
Firms within the scope of SYSC 15A, including banks, building societies, insurers, enhanced scope SM&CR firms, and payment and e-money institutions.
Primary sourceRead the official framework
UK sector ruleEngland / health and care
NHS DSPT
NHS Data Security and Protection Toolkit
What is it?
The Data Security and Protection Toolkit, the annual self-assessment for organisations with access to NHS patient data and systems. From 2024, it is aligned to the NCSC CAF for many organisations.
Who does it concern?
Organisations with access to NHS patient data and systems, including NHS trusts, GP practices, care providers and their suppliers.
Primary sourceRead the official framework
UK sector ruleEngland and Wales / legal
SRA standards
SRA Standards and Regulations, Code of Conduct
What is it?
Solicitors Regulation Authority standards, including the duty in paragraph 6.3 of the Code of Conduct to keep the affairs of current and former clients confidential.
Who does it concern?
Solicitors, firms and other individuals regulated by the Solicitors Regulation Authority.
Primary sourceRead the official framework
UK regulationUK / personal data
UK GDPR
UK General Data Protection Regulation and the Data Protection Act 2018
What is it?
Appropriate technical and organisational measures for personal data, and breach notification to the ICO within 72 hours where required. Fines can reach £17.5 million or 4% of annual global turnover, whichever is higher.
Who does it concern?
Controllers and processors of personal data subject to UK data protection law. Organisations serving people in the EU may also fall under the EU GDPR.
Primary sourceRead the official framework
International standardInternational / certification
ISO 27001
ISO/IEC 27001:2022, information security management systems
What is it?
Requirements for an information security management system (ISO/IEC 27001:2022), supported by 93 Annex A controls.
Who does it concern?
Any organisation establishing, maintaining or certifying an information security management system. Applicable controls follow from its risk assessment and Statement of Applicability.
Primary sourceRead the official framework
UK certificationUK / baseline certification
Cyber Essentials
Cyber Essentials and Cyber Essentials Plus
What is it?
The UK government-backed scheme covering five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Firevault holds Cyber Essentials Plus; confirm current status, scope and validity with Firevault before relying on it.
Who does it concern?
Organisations certifying voluntarily or because a contract requires it, including many suppliers to UK government.
Primary sourceRead the official framework
UK frameworkUK / essential functions
NCSC CAF
NCSC Cyber Assessment Framework
What is it?
The NCSC Cyber Assessment Framework sets outcomes, under objectives A to D, for organisations responsible for essential functions. Firevault is not certified against CAF; these are outcomes our products can help support in your own assessment.
Who does it concern?
Organisations responsible for essential functions, including operators assessed under the NIS Regulations and bodies whose sector requires it.
Primary sourceRead the official framework
UK guidanceUK / guidance
NCSC backup principles
NCSC principles for ransomware-resistant backups
What is it?
NCSC principles for ransomware-resistant backups, for cloud services and for on-premises solutions. Attackers often go after backups early in a destructive attack.
Who does it concern?
Any organisation designing or buying backup, in the cloud or on premises. The principles are guidance, not a legal requirement.
Primary sourceRead the official framework
Industry standardGlobal / payment card data
PCI DSS
Payment Card Industry Data Security Standard v4.0.1
What is it?
Security requirements (PCI DSS v4.0.1) for organisations that store, process or transmit payment card account data.
Who does it concern?
Merchants, service providers and other organisations that store, process or transmit payment card account data.
Primary sourceRead the official framework
US frameworkUS-led / voluntary
NIST CSF 2.0
NIST Cybersecurity Framework 2.0
What is it?
Six functions for managing cybersecurity risk: Govern, Identify, Protect, Detect, Respond and Recover.
Who does it concern?
Organisations of any size or sector. Use is voluntary, although contracts and sector requirements often reference it.
Primary sourceRead the official framework
International standardInternational / industrial OT
IEC 62443
ISA/IEC 62443, security for industrial automation and control systems
What is it?
Security for industrial automation and control systems, organised into zones and conduits, with system requirements in IEC 62443-3-3.
Who does it concern?
Asset owners, system integrators, product suppliers and service providers for industrial automation and control systems, each according to the relevant part of the series.
Primary sourceRead the official framework
Knowledge baseGlobal / threat knowledge base
MITRE ATT&CK
MITRE ATT&CK for Enterprise and ICS
What is it?
Adversary tactics and techniques observed in real attacks, for Enterprise and ICS environments.
Who does it concern?
Security teams modelling threats, testing defences and describing coverage. It is a knowledge base, not a compliance obligation.
Primary sourceRead the official framework
US regulationUS / health information
HIPAA Security Rule
HIPAA Security Rule, 45 CFR Part 164, Subpart C
What is it?
Administrative, physical and technical safeguards for electronic protected health information, for US covered entities and business associates.
Who does it concern?
US covered entities, such as health plans, clearing houses and most providers, and the business associates that handle electronic protected health information for them.
Primary sourceRead the official framework
North American standardNorth America / bulk electric system
NERC CIP
NERC Critical Infrastructure Protection Reliability Standards
What is it?
Critical Infrastructure Protection standards for the North American bulk electric system.
Who does it concern?
Registered entities that own, operate or use bulk electric system assets in the United States, Canada and parts of Mexico.
Primary sourceRead the official framework
US federalUS / federal systems
FISMA and NIST SP 800-53
Federal Information Security Modernization Act and NIST SP 800-53 Rev. 5
What is it?
US federal information security requirements, implemented through the NIST SP 800-53 Rev. 5 control catalogue.
Who does it concern?
US federal agencies, and contractors operating federal information systems on their behalf.
Primary sourceRead the official framework
EU regulationEU / AI systems
EU AI Act
Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence
What is it?
Harmonised rules for artificial intelligence placed on the EU market or used in the EU, with the strictest obligations for high-risk systems covering human oversight, record-keeping, and accuracy, robustness and cybersecurity.
Who does it concern?
Providers placing AI systems on the EU market and deployers using them there, with additional obligations for general-purpose AI models.
Primary sourceRead the official framework
US voluntary frameworkUS / voluntary
NIST AI RMF
NIST AI Risk Management Framework 1.0 (NIST AI 100-1) and the Generative AI Profile (NIST AI 600-1)
What is it?
Voluntary guidance for understanding and managing risk in AI systems through four functions: Govern, Map, Measure and Manage.
Who does it concern?
Organisations that develop, deploy or use AI systems and want a documented way to identify, assess and manage AI risk.
Primary sourceRead the official framework
International standardInternational / AI management
ISO/IEC 42001
ISO/IEC 42001:2023 Information technology, artificial intelligence, management system
What is it?
Requirements for an AI management system: policy, roles, risk assessment, data governance, lifecycle controls, information for interested parties and monitoring for organisations that develop, provide or use AI systems.
Who does it concern?
Any organisation that develops, provides or uses AI-based products or services and wants a managed, auditable approach to AI.
Primary sourceRead the official framework
Attestation reportUS / service assurance
SOC 2
SOC 2, AICPA Trust Services Criteria (TSP Section 100)
What is it?
An attestation report on a service organisation's controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.
Who does it concern?
Service organisations whose customers rely on them to hold or process information, and the customers who read their reports.
Primary sourceRead the official framework
International standardInternational / continuity
ISO 22301
ISO 22301:2019 Security and resilience, business continuity management systems, requirements
What is it?
Requirements for a business continuity management system: business impact analysis, continuity strategies and solutions, plans and procedures, and an exercise programme.
Who does it concern?
Organisations that need to continue delivering products and services at a predefined capacity during a disruption.
Primary sourceRead the official framework
International standardInternational / controls reference
ISO/IEC 27002
ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection, information security controls
What is it?
The reference set of information security controls and implementation guidance that organisations select from, commonly used alongside an ISO 27001 management system.
Who does it concern?
Organisations implementing and operating information security controls, including those preparing a Statement of Applicability.
Primary sourceRead the official framework
US federal requirementUS / defence and federal supply chain
NIST SP 800-171
NIST SP 800-171 Rev. 3 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
What is it?
Security requirements for protecting the confidentiality of controlled unclassified information held in nonfederal systems, applied through federal contracts and their supply chains.
Who does it concern?
Organisations handling controlled unclassified information for US federal contracts, including defence and technology suppliers.
Primary sourceRead the official framework
UK regulationUK / essential services and digital services
UK NIS Regulations 2018
The Network and Information Systems Regulations 2018, SI 2018/506
What is it?
The UK's network and information security rules: security duties for operators of essential services, the duty to notify incidents, and obligations for relevant digital service providers.
Who does it concern?
UK operators of essential services and relevant digital service providers, and the competent authorities that supervise them.
Primary sourceRead the official framework
EU regulationEU / personal data
EU GDPR
Regulation (EU) 2016/679, General Data Protection Regulation
What is it?
Rules for processing personal data and protecting individuals. Applicable from 25 May 2018.
Who does it concern?
Controllers and processors within the territorial scope of Article 3, including certain organisations outside the EU.
Primary sourceRead the official framework
Classification requirementsInternational / maritime
IACS UR E26 and E27
IACS UR E26, Cyber resilience of ships, Rev.1 November 2023, and UR E27, Cyber resilience of on-board systems and equipment, Rev.1 September 2023
What is it?
Ship-wide and equipment-level cyber-resilience requirements, uniformly implemented by IACS societies for applicable ships contracted for construction on or after 1 July 2024. IMO MSC-FAL.1/Circ.3, as revised, provides wider maritime cyber-risk management guidance.
Who does it concern?
Shipowners, shipyards, systems integrators and equipment suppliers for vessels and systems within the requirements’ stated scope. Not every vessel type is subject to mandatory application.
Primary sourceRead the official framework
EU aviation regulationsEU / civil aviation
EASA Part-IS
Commission Delegated Regulation (EU) 2022/1645 and Commission Implementing Regulation (EU) 2023/203, information security requirements with a potential impact on aviation safety
What is it?
Information security management requirements for risks with a potential impact on aviation safety. Regulation 2022/1645 applies from 16 October 2025 and Regulation 2023/203 generally from 22 February 2026.
Who does it concern?
Specified aviation organisations and authorities, subject to the regulations’ exclusions and derogations. These include relevant design, production, aerodrome, maintenance, operational and air navigation organisations.
Primary sourceRead the official framework
EU directiveEU / critical entities
CER Directive
Directive (EU) 2022/2557 on the resilience of critical entities
What is it?
An all-hazards framework for the resilience of designated critical entities. National transposition was due by 17 October 2024, with national measures applying from 18 October 2024.
Who does it concern?
Entities identified by Member States in the sectors listed in the Directive. Identification is due by 17 July 2026, with Chapter III duties generally applying ten months after notification.
Primary sourceRead the official framework
EU regulationEU / products with digital elements
EU Cyber Resilience Act
Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements
What is it?
Cybersecurity requirements for products with digital elements and manufacturer vulnerability handling. Article 14 reporting applies from 11 September 2026 and the main requirements from 11 December 2027.
Who does it concern?
Manufacturers and other economic operators placing covered products with digital elements on the EU market, subject to the regulation’s scope and exclusions.
Primary sourceRead the official framework
Industry frameworkInternational / cross-sector
CIS Controls v8.1
CIS Critical Security Controls v8.1
What is it?
A prioritised set of security safeguards for defending enterprise systems and networks. Version 8.1 updates alignment and safeguard descriptions.
Who does it concern?
Organisations of any size using the CIS Controls, with safeguards selected through the appropriate Implementation Group and risk assessment.
Primary sourceRead the official framework
US regulationUS / defence supply chain
CMMC 2.0
Cybersecurity Maturity Model Certification Program, 32 CFR Part 170, and DFARS, 48 CFR Parts 204, 212, 217 and 252
What is it?
The programme rule took effect on 16 December 2024. Contractual implementation under the DFARS rule began on 10 November 2025, with four phases through 10 November 2028.
Who does it concern?
Defence contractors and subcontractors handling Federal Contract Information or Controlled Unclassified Information, where the contract specifies a CMMC requirement.
Primary sourceRead the official framework
UK defence standardUK / defence suppliers
Def Stan 05-138
Defence Standard 05-138, Issue 4, Cyber Security Standard for Suppliers, 14 May 2024
What is it?
The MOD standard specifies controls for Cyber Security Model version 4. Issue 4 is dated 14 May 2024 and uses four Cyber Risk Profiles, Level 0 to Level 3.
Who does it concern?
MOD suppliers and subcontractors where the standard is invoked by their contractual requirements and assigned Cyber Risk Profile.
Primary sourceRead the official framework
US security directivesUS / designated pipeline operators
TSA pipeline directives
TSA Security Directives Pipeline-2021-02G and Pipeline-2021-01G
What is it?
Pipeline-2021-02G is dated 1 May 2026 and applies from 3 May 2026 to 2 May 2027. Pipeline-2021-01G applies from 16 January 2026 to 15 January 2027 and requires incident reporting to CISA as soon as practicable, no later than 72 hours after identification.
Who does it concern?
Owners and operators of hazardous liquid or natural gas pipelines or liquefied natural gas facilities specifically notified by TSA.
Primary sourceRead the official framework
US regulationUS / New York financial services
NYDFS Part 500
23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies, as amended 1 November 2023
What is it?
The second amendment took effect on 1 November 2023, with phased compliance dates through 1 November 2025. It strengthens cybersecurity, access management and operational recovery requirements.
Who does it concern?
DFS-regulated covered entities, subject to the exemptions in section 500.19 and additional requirements for Class A companies.
Primary sourceRead the official framework
Industry standardInternational / Swift users
SWIFT CSCF 2026
Swift Customer Security Controls Framework, CSCF v2026
What is it?
CSCF v2026 is the framework edition for the 2026 attestation cycle. It contains mandatory and advisory controls whose applicability depends on the user’s Swift architecture.
Who does it concern?
Swift users and the organisations responsible for protecting their Swift-related infrastructure.
Primary sourceRead the official framework
Supervisory standardUK / PRA-regulated financial services
PRA operational resilience
PRA SS1/21, Operational resilience: Impact tolerances for important business services, and SS2/21, Outsourcing and third party risk management
What is it?
SS1/21 took effect on 31 March 2022. Firms had until 31 March 2025 to be able to remain within impact tolerances for important business services, with SS2/21 complementing these expectations for outsourcing and third-party arrangements.
Who does it concern?
Relevant UK banks, building societies, PRA-designated investment firms and insurers, including Lloyd’s. SS2/21 also addresses UK branches of overseas banks and insurers.
Primary sourceRead the official framework
Australian government guidanceAustralia / government and industry
Essential Eight
ASD Essential Eight and Essential Eight Maturity Model, November 2023
What is it?
Eight complementary cyber security mitigation strategies from the Australian Signals Directorate, assessed against a maturity model (November 2023 edition).
Who does it concern?
Organisations protecting internet-connected IT networks. Under PSPF Policy 10, non-corporate Commonwealth entities were required to implement all eight strategies to Maturity Level Two from 1 July 2022.
Primary sourceRead the official framework
Australian government guidanceAustralia / information and operational technology
ASD ISM
Australian Signals Directorate Information Security Manual, September 2026
What is it?
A risk-based cyber security framework for IT and OT systems. The latest official edition located is September 2026, published 7 September 2026.
Who does it concern?
Government and other organisations applying ASD security advice through their risk management and authorisation processes.
Primary sourceRead the official framework
Australian legislationAustralia / critical infrastructure
SOCI Act
Security of Critical Infrastructure Act 2018 (Cth), No. 29, 2018
What is it?
Establishes critical infrastructure risk management, mandatory cyber incident reporting and enhanced cyber security obligations. The 2024 amendment extends asset coverage to qualifying data storage systems holding business critical data.
Who does it concern?
Responsible entities for covered critical infrastructure assets. Part 2A and Part 2B application depends on statutory coverage and rules, while Part 2C concerns declared systems of national significance.
Primary sourceRead the official framework
Supervisory standardAustralia / APRA-regulated entities
APRA CPS 234
Prudential Standard CPS 234 Information Security
What is it?
Requires information security capability, controls, response plans and systematic assurance. It commenced on 1 July 2019.
Who does it concern?
APRA-regulated banks, insurers and superannuation trustees within the standard’s application provisions, including relevant holding companies.
Primary sourceRead the official framework
Supervisory standardAustralia / APRA-regulated entities
APRA CPS 230
Prudential Standard CPS 230 Operational Risk Management
What is it?
Requires operational risk management, continuity of critical operations and oversight of service providers. First effective on 1 July 2025; the current version commenced on 1 July 2026.
Who does it concern?
APRA-regulated banks, insurers and superannuation trustees within the standard's application provisions.
Primary sourceRead the official framework
Supervisory standardUAE / critical entities
UAE IA Regulation
UAE Information Assurance Regulation, Version 1.1, March 2020
What is it?
The Information Assurance Regulation version 1.1 was published in March 2020 by the then TRA, now TDRA. The UAE Cyber Security Council now publishes a successor UAE Information Assurance Standard. The identifiers below are from version 1.1, so check them against the edition that applies to you.
Who does it concern?
Critical entities designated under the UAE critical information infrastructure protection arrangements. Confirm the applicable edition and sector instructions with the relevant authority.
Primary sourceRead the official framework
Supervisory standardSaudi Arabia / national entities
NCA ECC
Essential Cybersecurity Controls, ECC-2:2024
What is it?
The National Cybersecurity Authority's ECC-2:2024 updates ECC-1:2018. It sets baseline cybersecurity controls for entities within its scope.
Who does it concern?
Saudi government entities and their companies and entities, and private-sector entities owning, operating or hosting critical national infrastructure. Other entities are encouraged to adopt the controls.
Primary sourceRead the official framework
Supervisory standardSaudi Arabia / financial institutions
SAMA CSF
SAMA Cyber Security Framework, Version 1.0, May 2017, Circular 381000091275
What is it?
Issued by the then Saudi Arabian Monetary Authority, now the Saudi Central Bank, on 24 May 2017. Backup and disaster recovery are mapped separately to the SAMA Business Continuity Management Framework.
Who does it concern?
SAMA-regulated member organisations within the applicable circulars. The current rulebook lists banking, finance, payments, credit bureaus and the regulatory sandbox.
Primary sourceRead the official framework
Supervisory standardSingapore / financial institutions
MAS TRM
Monetary Authority of Singapore Technology Risk Management Guidelines, January 2021
What is it?
Published on 18 January 2021, these Guidelines set supervisory principles and best practices for managing technology risk. Binding sector-specific Notices must be assessed separately.
Who does it concern?
Financial institutions regulated by MAS, with implementation proportionate to their activities and technology risks.
Primary sourceRead the official framework
Supervisory standardCanada / federally regulated financial institutions
OSFI B-13
OSFI Guideline B-13, Technology and Cyber Risk Management
What is it?
OSFI issued B-13 in July 2022, effective 1 January 2024. Its three domains cover governance and risk management, technology operations and resilience, and cyber security.
Who does it concern?
Federally regulated financial institutions, including foreign bank and insurance branches where consistent with their Canadian legal obligations. Implementation is risk-based.
Primary sourceRead the official framework
Technical alignment
Two distinct capabilities. One clearer view.
Control by Firevault
Control the path.
Article 21(2) lists the measures. Control can contribute physical control of selected connections to six of them.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
A physically disconnected copy supporting ICT backup, restoration and recovery, with every access session recorded.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected DORA articles where physical control of network connections can contribute, and the Modules involved.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Recovery copies for important business services held outside the connected estate, with retrieval tests as evidence.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
No Control mapping is published for FCA operational resilience. Its requirements centre on the information you hold, so the contribution shown is Offline Secure Storage®.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Backups of patient and operational records kept separate from the live system.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
No Control mapping is published for NHS DSPT. Its requirements centre on the information you hold, so the contribution shown is Offline Secure Storage®.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Privileged and client records held off the connected estate, opened only in verified sessions.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
No Control mapping is published for SRA standards. Its requirements centre on the information you hold, so the contribution shown is Offline Secure Storage®.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Selected personal data held physically disconnected between authorised sessions, supporting security of processing and timely restoration.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
No Control mapping is published for UK GDPR. Its requirements centre on the information you hold, so the contribution shown is Offline Secure Storage®.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
A physical control you can cite in your Statement of Applicability for backup, access, logging and classification.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected ISO/IEC 27001:2022 Annex A controls where physical control of selected connections can contribute.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
OSS® does not change what an assessor checks. It adds an offline copy of selected records beyond the Cyber Essentials baseline.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Four of the five Cyber Essentials technical controls, and where physical control of selected connections can add to them.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Physically disconnected gold copies support data security, resilient systems and recovery planning outcomes.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Physical control of selected connections supports system security, resilient networks and supply chain outcomes.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
The six on-premises principles, each answered by a physical property, and the cloud principles in the linked whitepaper.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
No Control mapping is published for NCSC backup principles. Its requirements centre on the information you hold, so the contribution shown is Offline Secure Storage®.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Archived account data held encrypted on dedicated hardware, off network-accessible systems between sessions.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
No Control mapping is published for PCI DSS. Its requirements centre on the information you hold, so the contribution shown is Offline Secure Storage®.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline backups and verified restoration assets.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected CSF 2.0 subcategories, from Govern to Recover, where physical control of selected connections can contribute.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline copies of control system configurations and project files for recovery.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected IEC 62443-3-3 system requirements where physical control of zone and conduit connections can contribute.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Impact techniques that depend on reaching backups.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Enterprise and ICS tactics that depend on reachable network paths, and the Modules that can reduce that reach.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
An offline backup supporting the contingency plan, with audit records for every session.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
No Control mapping is published for HIPAA Security Rule. Its requirements centre on the information you hold, so the contribution shown is Offline Secure Storage®.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline storage of the information needed to recover BES Cyber Systems.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
No Control mapping is published for NERC CIP. Its requirements centre on the information you hold, so the contribution shown is Offline Secure Storage®.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline backup and a separate storage location for recovery copies.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
No Control mapping is published for FISMA and NIST SP 800-53. Its requirements centre on the information you hold, so the contribution shown is Offline Secure Storage®.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
A physically disconnected copy of the data and records an AI system depends on, and a hardware cut a designated person can use to stop a system acting on selected data.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Model, agent and supplier pathways are approved, connected just in time and closed afterwards, so oversight is exercised at the connection as well as the output.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Trusted copies of the data, models and evaluation records an AI system depends on, held apart from the systems that use them.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Connections between models, agents and the systems they touch are authorised, time-limited and logged.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Copies of the data and documentation an AI management system must be able to produce, held offline and released only on approval.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Data, model and supplier pathways feeding an AI system are approved and connected just in time, so the management system governs reachability as well as process.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
A protected copy, restricted movement of information and session records a service organisation can point to in its own control narrative.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Standing supplier and network pathways are closed between sessions, and each opening is authorised, time-limited and logged.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
A disconnected recovery copy a continuity plan can call on, and retrieval that shows it works.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Recovery and supplier pathways are authorised per window, so a plan can bring a route up and take it down without a standing connection.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
An independent copy of selected information, held outside the production path and released on approval.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected standing routes are removed and replaced by authorised, time-limited connections.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
A protected copy of controlled information, held at a storage location that is not reachable from the production path.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Supplier and remote maintenance routes are authorised, time-limited and logged, so reachability is a decision rather than a standing state.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
A disconnected copy of the information an essential service needs to restore, with authorised retrieval and a record of every session.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Supplier and operational pathways are opened only when authorised, so risk to the systems behind an essential service is bounded.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline recovery copies and access records support risk-based protection of personal data.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Authorised connection windows reduce exposure through selected standing pathways.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline copies of selected system data and recovery records contribute to ship recovery arrangements.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected remote-maintenance pathways are physically disconnected outside authorised windows.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Protected recovery copies and evidence support the organisation’s aviation information security management.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Closing selected supplier and remote-maintenance pathways supports risk treatment.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Protected recovery records and selected offline copies contribute to resilience planning.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected pathways remain physically disconnected until an authorised window is approved.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline copies support preservation of manufacturer records and selected update materials, not the product’s own design.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Authorised connectivity windows support protection of selected development and update infrastructure.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline recovery copies, controlled access and retrieval tests support selected Data Recovery safeguards.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected network and supplier pathways are closed between authorised access windows.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Protected CUI recovery copies and access records can contribute evidence for selected Level 2 requirements.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Authorised, time-bounded connectivity supports control of selected remote access sessions.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Restricted recovery copies and retrieval evidence support selected backup controls.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Approved connectivity windows support authorisation of selected remote privileged activity.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Separated recovery copies and retrieval records support incident response and assessment evidence.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Default-disconnected pathways support selected segmentation and access restrictions.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Protected recovery copies and controlled access support backup protection and recovery testing.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Approved windows restrict selected supplier and remote-maintenance pathways.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Restricted access to selected copies and exportable records can contribute to the user’s security evidence.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected pathways can remain disconnected between approved access windows.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Protected recovery copies and retrieval exercises support recovery planning and evidence.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Approved connection windows support management of selected dependencies and outsourced access.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline recovery copies and approved access can contribute to selected backup and access practices.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected administrative pathways are disconnected between approved access windows.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Disconnected recovery copies and access evidence can contribute to backup protection.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected pathways can be disconnected between authorised windows to support segregation.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Protected recovery copies and retrieval evidence can contribute to risk management and incident preparation.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Default-disconnected pathways can contribute to the treatment of selected cyber risks.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Protected copies, access records and retrieval tests can support security controls and response evidence.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Approved connectivity windows can contribute to protection and response arrangements.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline recovery copies and retrieval evidence can support continuity planning for critical operations.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected supplier and remote-maintenance pathways are closed between approved windows.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline recovery copies and recorded retrievals can support the legacy backup and access controls.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Authorised connection windows can support legacy segregation, maintenance and supplier controls.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Protected recovery copies and retrieval evidence can contribute to backup, access and resilience controls.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Selected network and supplier pathways are disconnected outside approved windows.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Restricted recovery copies and retrieval records support access controls and the separate BCM framework.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Supplier and maintenance connectivity is authorised for a recorded window rather than left standing.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Offline copies and retrieval evidence contribute to recoverability and backup arrangements.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Time-bounded connection approvals support access and third-party controls.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlOffline Secure Storage®
Protect the asset.
Protected copies and retrieval evidence contribute to disaster recovery and data protection.
Physically disconnected storage and governed access.
Explore OSSControl by Firevault
Control the path.
Authorised connection windows contribute to layered defences and third-party access restrictions.
Physical connectivity boundaries and authorised, just-in-time intervention.
Explore ControlRequirements in practice
See the requirement. Then the contribution.
Open any requirement to see the technical measure each product can contribute, its limits and where to find the official text. The Both, OSS and Control filter above applies here too.
NIS27 requirements mapped
Art. 21(2)(c)Business continuity, such as backup management and disaster recoveryOSSControl
OSS / protect the asset
Gold copies and recovery records sit on dedicated hardware with no network connection while closed, so they are not on the network an incident has reached.
Control / govern the path
Business continuity and crisis management. During a crisis, a nominated authority has a defined way to change the state of selected connections.
Modules: Execute
Art. 21(2)(b)Incident handlingOSSControl
OSS / protect the asset
Recovery does not depend on the connected estate, and each access session is authorised out of band and logged as evidence.
Control / govern the path
An authorised response can physically disconnect a selected connection, with a supervisory route when the routine process must be overridden.
Modules: Fracture, Execute
Art. 21(2)(d)Supply chain securityOSSControl
OSS / protect the asset
Records held offline cannot be reached through a compromised supplier connection while the drives are closed.
Control / govern the path
Supplier access is staged through a security airlock, limited to approved windows and withdrawn when it is no longer needed.
Modules: Relay, Lock, Unlink
Art. 21(2)(i)Access control policies and asset managementOSSControl
OSS / protect the asset
Access is identity-verified and time-bounded, and what is held offline is documented by data class.
Control / govern the path
Standing access to critical systems is withdrawn, and a named critical asset is protected across the connection boundaries that serve it.
Modules: Unlink, Array
Art. 20Governance and management accountabilityOSS
OSS / protect the asset
Session records and the offline classification schedule give the management body concrete evidence to oversee.
Art. 21(2)(a)Risk analysis and information system security policiesControl
Control / govern the path
Policy can require physical separation for the highest-consequence zones, with both sides of an intermediate zone controlled.
Modules: Isolate
Art. 21(2)(e)Security in acquisition, development and maintenanceControl
Control / govern the path
Maintenance connections exist only in approved windows, and high-consequence changes require two independent approvals.
Modules: Lock, Validate
Offline Secure Storage®Not mapped: incident reporting under Article 23 (an early warning within 24 hours and a notification within 72 hours remain your obligation), cryptography policy and training.
ControlNot mapped: (f) effectiveness assessment, (g) cyber hygiene and training, (h) cryptography and (j) multi-factor authentication and secured communications. Validate's two approvals are an approval control, not multi-factor authentication. Backup management under (c) belongs to Offline Secure Storage®, a separate Firevault product.
ReferenceDirective (EU) 2022/2555 (NIS2), Article 21(2).
Official referencesDirective (EU) 2022/2555 (NIS2), EUR-LexNCSC: Offline backups in an online world
DORA10 requirements mapped
Art. 12(1)Backup policies and restoration and recovery proceduresOSS
OSS / protect the asset
Selected data and gold copies are held on dedicated hardware and restored in an authorised, logged session.
Art. 12(3)Restoration from systems segregated from the source ICT systemOSS
OSS / protect the asset
The copy is held outside the production ICT estate and is physically disconnected from it between sessions.
Art. 11Response and recoveryOSS
OSS / protect the asset
The recovery copy does not share the fate of the affected estate, so recovery plans can rely on it being intact.
Art. 9Protection and preventionOSS
OSS / protect the asset
Physical disconnection is a property of the hardware rather than a configuration that can drift between audits.
Art. 9(4)(b)Network management, including isolating affected assetsControl
Control / govern the path
A selected connection can be physically disconnected when an authorised response calls for it, and sensitive zones can be bounded on both sides.
Modules: Fracture, Isolate
Art. 9(4)(c)Limiting access to what is requiredControl
Control / govern the path
Standing paths that are not needed are withdrawn, and permitted connections are available only during approved time windows.
Modules: Unlink, Lock
Art. 9(4)(e)ICT change managementControl
Control / govern the path
High-consequence connection changes require two independent approvals and can be confined to an agreed window.
Modules: Validate, Lock
Art. 11(2)(c)Containment measures for ICT-related incidentsControl
Control / govern the path
The response plan gains a defined physical action on selected connections, with a supervisory route when the routine process must be overridden.
Modules: Fracture, Execute
Art. 28General principles for ICT third-party riskControl
Control / govern the path
Supplier access is staged through a security airlock and available only during approved windows, rather than through a permanent route.
Modules: Relay, Lock
Art. 28(8)Exit strategiesControl
Control / govern the path
When a service ends or an exit plan is invoked, the supplier connection can be physically withdrawn.
Modules: Unlink
Offline Secure Storage®Not mapped: incident reporting (Articles 17 to 19), the resilience testing programme (Articles 24 to 27) beyond retrieval tests, and the register of ICT third-party arrangements.
ControlNot mapped: backup and restoration (Article 12), incident reporting and resilience testing. Control does not store, back up or restore data. Offline Secure Storage® is a separate Firevault product that can support backup requirements.
ReferenceRegulation (EU) 2022/2554 (DORA), Articles 9, 11 and 28.
Official referencesRegulation (EU) 2022/2554 (DORA), EUR-Lex
FCA operational resilience2 requirements mapped
SYSC 15ARemaining within impact tolerancesOSS
OSS / protect the asset
The data an important business service needs to recover is held on physically disconnected hardware, so a severe cyber scenario does not reach it.
TestingScenario testing and self-assessmentOSS
OSS / protect the asset
Retrieval tests with measured timelines give evidence for the self-assessment.
Offline Secure Storage®Mapping important business services and setting tolerances remain the firm's responsibility.
Official referencesFCA: Operational resilience
Related on FirevaultOSS® for financial services
NHS DSPT2 requirements mapped
BackupsBackups held separate from live systemsOSS
OSS / protect the asset
Recovery copies are physically disconnected between sessions, so ransomware on the live estate cannot reach them.
AccessAccess to confidential data is controlled and recordedOSS
OSS / protect the asset
Sessions are identity-verified and each one is logged.
Offline Secure Storage®Where the DSPT uses CAF outcomes, see the NCSC CAF row for B3 and D1.
Official referencesNHS Data Security and Protection Toolkit
Related on FirevaultOSS® for healthcare data
SRA standards1 requirement mapped
Code 6.3Client confidentialityOSS
OSS / protect the asset
Closed matters and privileged communications are held on physically disconnected hardware, with every session logged.
Offline Secure Storage®Confidentiality also depends on the firm's own systems, people and procedures.
Official referencesSRA Code of Conduct for Solicitors
Related on FirevaultOSS® for legal
UK GDPR5 requirements mapped
Art. 32(1)(b)Ongoing confidentiality, integrity, availability and resilienceOSS
OSS / protect the asset
While offline, there is no network path to the data, so remote access is not possible between sessions.
Art. 32(1)(c)Restoring availability and access in a timely mannerOSS
OSS / protect the asset
A disconnected copy remains available to restore from after an incident.
Art. 32(1)(a)Encryption of personal dataOSS
OSS / protect the asset
Data is encrypted on dedicated hardware.
Art. 5(1)(e)-(f)Storage limitation, integrity and confidentialityOSS
OSS / protect the asset
A documented classification of what is held offline, and why, supports retention decisions.
Art. 25Data protection by design and by defaultOSS
OSS / protect the asset
Protection is built into how the records are held, not added later.
Offline Secure Storage®Not mapped: lawful basis, data subject rights and breach notification under Article 33, which remain the controller's obligations.
Official referencesICO: UK GDPR guidance and resourcesUK GDPR, legislation.gov.uk
Related on FirevaultBriefing: physical disconnection and UK GDPR
ISO 2700116 requirements mapped
A.8.13Information backupOSS
OSS / protect the asset
Backup copies are held on dedicated hardware that is physically disconnected between sessions.
A.5.30ICT readiness for business continuityOSS
OSS / protect the asset
Retrieval tests give measured recovery timelines per vault.
A.5.15 / A.8.5Access control and secure authenticationOSS
OSS / protect the asset
Identity verification at provisioning and multi-factor authentication for every session.
A.8.15LoggingOSS
OSS / protect the asset
Each session is opened, recorded and closed, with logs exportable for auditors.
A.8.24Use of cryptographyOSS
OSS / protect the asset
Encryption at rest, with key custody stated in writing.
A.5.12Classification of informationOSS
OSS / protect the asset
Live, recovery and retained data are separated and documented.
A.7.1Physical security perimetersOSS
OSS / protect the asset
Drives are held in a Firevault Bunker.
A.5.3Segregation of dutiesControl
Control / govern the path
No single approval releases a protected connection change. Two independent people must approve the same request.
Modules: Validate
A.5.14Information transferControl
Control / govern the path
Approved exchanges use a designated connection, available only for that exchange, around a separately enforced one-way path. Transfer does not inspect the data.
Modules: Transfer
A.5.15Access controlControl
Control / govern the path
Standing paths that are not needed are withdrawn, and permitted connections exist only during approved windows.
Modules: Unlink, Lock
A.5.19Information security in supplier relationshipsControl
Control / govern the path
Supplier access is staged through a security airlock and limited to approved windows.
Modules: Relay, Lock
A.5.26Response to information security incidentsControl
Control / govern the path
An authorised response can physically disconnect a selected connection, with a supervisory route when needed.
Modules: Fracture, Execute
A.8.2Privileged access rightsControl
Control / govern the path
A privileged account alone cannot open a protected path. Overrides sit with a nominated supervisory authority.
Modules: Validate, Execute
A.8.20Networks securityControl
Control / govern the path
Sensitive zones are bounded on both sides, and named critical assets are protected across the connection boundaries that serve them.
Modules: Isolate, Array
A.8.22Segregation of networksControl
Control / govern the path
Crossings between segregated networks are controlled on both sides or staged through an airlock, never left open end to end.
Modules: Isolate, Relay
A.8.32Change managementControl
Control / govern the path
Connection changes require two independent approvals and can be confined to an agreed window.
Modules: Validate, Lock
Offline Secure Storage®Firevault does not certify management systems. Certification is decided by your accredited certification body.
ControlNot mapped: A.8.13 information backup and A.8.16 monitoring activities. Control does not back up data or monitor activity. Backups belong to Offline Secure Storage®, a separate Firevault product.
ReferenceISO/IEC 27001:2022 Annex A, organisational (5) and technological (8) controls.
Official referencesISO/IEC 27001:2022
Cyber Essentials4 requirements mapped
FirewallsBoundary protectionControl
Control / govern the path
The firewall stays in place. Behind it, selected paths can be physically withdrawn and sensitive zones bounded on both sides.
Modules: Isolate, Unlink
ConfigurationRemoving what is not neededControl
Control / govern the path
Network connections that are not needed are physically withdrawn, in the same spirit as removing unnecessary services.
Modules: Unlink
UpdatesSupplier and update connectionsControl
Control / govern the path
Supplier and update connections can be limited to approved windows. Control does not apply updates or change patching timescales.
Modules: Lock
AccessAdministrative accessControl
Control / govern the path
Changes to protected connections require two independent approvals within approved windows. Account management stays with your identity systems.
Modules: Validate, Lock
Offline Secure Storage®Cyber Essentials assesses your IT infrastructure. Moving records offline does not by itself reduce your certification scope.
ControlNot mapped: malware protection. Control does not scan, inspect or remove malicious content. Control does not change what an assessor requires for certification under any of the five controls.
ReferenceNCSC Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026).
Official referencesNCSC: Cyber Essentials
NCSC CAF6 requirements mapped
B3Data securityOSS
OSS / protect the asset
Selected data is held on hardware with no network connection while closed.
B5Resilient networks and systemsOSSControl
OSS / protect the asset
A recovery copy that does not depend on the connected estate.
Control / govern the path
Sensitive zones are bounded on both sides, and a selected connection can be physically disconnected when an authorised response calls for it.
Modules: Isolate, Fracture
D1Response and recovery planningOSS
OSS / protect the asset
Retrieval tests show that recovery from the offline copy works.
C1Security monitoringOSS
OSS / protect the asset
Every connection, identity check and restore is logged and can be reviewed.
B4System securityControl
Control / govern the path
Standing paths that are not needed are withdrawn, and permitted connections exist only in approved windows.
Modules: Unlink, Lock
A4Supply chainControl
Control / govern the path
Supplier access is staged through a security airlock and available only during approved windows.
Modules: Relay, Lock
Offline Secure Storage®Not mapped: governance outcomes under objective A, which depend on your organisation.
ControlNot mapped: monitoring and detection outcomes under objective C. Control does not monitor traffic.
Official referencesNCSC Cyber Assessment Framework
NCSC backup principles6 requirements mapped
1Make it possible to isolate your backup solutionOSS
OSS / protect the asset
The offline copy has no network interface or address while closed. Connection is a scheduled, identity-verified event.
2Update your backup solutionOSS
OSS / protect the asset
Updates happen in controlled windows, and the attack surface stays small while offline.
3Backups should be resilient to destructive actionsOSS
OSS / protect the asset
Production, domain and hypervisor credentials grant no rights on the offline copy.
4Restore from an earlier backupOSS
OSS / protect the asset
Multiple point-in-time copies stay offline, and restores are checksum-verified.
5Robust key managementOSS
OSS / protect the asset
Encryption uses customer-held identity factors, managed separately from the protected systems.
6Alerts on significant changesOSS
OSS / protect the asset
Connections, identity checks, privileged actions and restores are logged and alerted.
Offline Secure Storage®For the cloud principles, see the ransomware-resistant backups whitepaper.
Official referencesNCSC: Principles for ransomware-resistant backupsNCSC: Principles for ransomware-resistant cloud backupsNCSC: Offline backups in an online world
Related on FirevaultWhitepaper: ransomware-resistant backupsGuide: NCSC cloud backup principles
PCI DSS4 requirements mapped
Req. 3Protect stored account dataOSS
OSS / protect the asset
Archived records kept under your retention policy are encrypted and physically disconnected between sessions.
Req. 7Restrict access by business need to knowOSS
OSS / protect the asset
Only nominated, identity-verified people can open a session.
Req. 8Identify users and authenticate accessOSS
OSS / protect the asset
Multi-factor authentication for every session.
Req. 10Log and monitor all accessOSS
OSS / protect the asset
Time-stamped session logs, exportable for your assessor.
Offline Secure Storage®Stored account data remains in PCI DSS scope wherever it is held; your QSA decides scope. Not mapped: Requirements 4 (transmission), 5 (malware) and 11 (testing).
Official referencesPCI Security Standards Council document library
NIST CSF 2.07 requirements mapped
PR.DS-11Backups of data are created, protected, maintained and testedOSS
OSS / protect the asset
Copies are held physically disconnected between sessions and retrieval is tested.
RC.RP-03Integrity of backups is verified before restorationOSS
OSS / protect the asset
Restores from the offline copy are checksum-verified.
GV.SC-10Provisions for after a supplier agreement endsControl
Control / govern the path
When a partnership or service agreement ends, the supplier connection can be physically withdrawn.
Modules: Unlink
PR.AA-05Least privilege and separation of dutiesControl
Control / govern the path
Separation of duties reaches the physical connection: two independent approvals for protected changes, approved time windows and no standing access.
Modules: Validate, Lock, Unlink
PR.IR-01Networks and environments protected from unauthorised logical accessControl
Control / govern the path
Sensitive zones are bounded on both sides, crossings are staged through an airlock, critical assets are protected across their boundaries, and approved one-way exchanges use a designated connection.
Modules: Isolate, Relay, Array, Transfer
RS.MI-01Incidents are containedControl
Control / govern the path
An authorised response can physically disconnect a selected connection, including through a supervisory route.
Modules: Fracture, Execute
RC.RP-02Recovery actions are selected, scoped, prioritised and performedControl
Control / govern the path
Reconnection after an incident can be staged, with each protected connection restored only after independent approval and within an agreed window.
Modules: Validate, Lock
Offline Secure Storage®Not mapped: Detect outcomes.
ControlNot mapped: Detect (DE) outcomes and backup outcomes such as PR.DS-11. Control does not monitor traffic, detect incidents or back up data. Backups belong to Offline Secure Storage®, a separate Firevault product.
ReferenceNIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (February 2024).
Official referencesNIST Cybersecurity Framework
IEC 624436 requirements mapped
SR 7.3Control system backupOSS
OSS / protect the asset
Known-good configurations, PLC programs and project files are held offline, away from the network they protect.
SR 1.13Access via untrusted networksControl
Control / govern the path
Remote and supplier access is staged through a security airlock and available only during approved windows.
Modules: Relay, Lock
SR 2.1Authorisation enforcementControl
Control / govern the path
Protected conduit changes require two independent approvals, and a nominated supervisory authority holds a defined override.
Modules: Validate, Execute
SR 5.1Network segmentationControl
Control / govern the path
Intermediate zones are controlled on both sides, and named critical assets are protected across the conduits that serve them.
Modules: Isolate, Array
SR 5.2Zone boundary protectionControl
Control / govern the path
Conduits are staged, withdrawn when not needed, and one-way exports use a designated connection around a separately enforced diode path.
Modules: Relay, Unlink, Transfer
Separating a zone from a conduit. When an authorised response calls for it, a registered conduit can be physically disconnected. Continued local operation must be confirmed in the design.
Modules: Fracture
SR 7.4Control system recovery and reconstitutionControl
Control / govern the path
Reconnection after an incident is staged, with each protected conduit restored only after independent approval and within an agreed window.
Modules: Validate, Lock
Offline Secure Storage®Zone and conduit design remains with your asset owner and integrator.
ControlNot mapped: FR 3 system integrity, FR 4 data confidentiality, FR 6 timely response to events and SR 7.3 control system backup. Control does not inspect, encrypt, monitor or back up data, and it does not override plant safety systems.
ReferenceIEC 62443-3-3:2013 System security requirements and security levels, FR 1, FR 2, FR 5 and FR 7.
Official referencesISA/IEC 62443 series of standards
Related on FirevaultOffline OT configuration backupsBriefing: NIST SP 800-82r3 OT backup
MITRE ATT&CK11 requirements mapped
T1490Inhibit System RecoveryOSS
OSS / protect the asset
The offline copy cannot be deleted or corrupted over the network while the drives are closed.
T1486Data Encrypted for ImpactOSS
OSS / protect the asset
Ransomware on the connected estate cannot reach a copy with no network path.
T1485Data DestructionOSS
OSS / protect the asset
A disconnected copy remains to restore from.
TA0001Initial AccessControl
Control / govern the path
Remote paths that are not needed are withdrawn, and permitted ones exist only in approved windows, so fewer routes stand open.
Modules: Unlink, Lock
TA0004Privilege EscalationControl
Control / govern the path
An escalated privileged account cannot release a protected connection change on its own.
Modules: Validate
TA0008Lateral MovementControl
Control / govern the path
Movement between protected zones meets crossings that are controlled on both sides or staged through an airlock, not open end to end.
Modules: Isolate, Relay
TA0011Command and ControlControl
Control / govern the path
An authorised response can physically disconnect the selected connection carrying the activity.
Modules: Fracture
TA0010ExfiltrationControl
Control / govern the path
Selected outbound paths can be disconnected, and approved exchanges use a designated connection around a separately enforced one-way path.
Modules: Fracture, Transfer
TA0040ImpactControl
Control / govern the path
Named critical assets are protected across the boundaries that serve them, and a nominated authority holds a defined route to intervene.
Modules: Array, Execute
TA0108Initial Access (ICS)Control
Control / govern the path
Remote engineering and supplier access is staged through an airlock and limited to approved windows. Unused paths are withdrawn.
Modules: Relay, Lock, Unlink
TA0109Lateral Movement (ICS)Control
Control / govern the path
Crossings between IT and OT zones are controlled on both sides and can be physically disconnected by an authorised response.
Modules: Isolate, Fracture
Offline Secure Storage®OSS® does not detect adversary behaviour or stop techniques used during an authorised session.
ControlControl does not detect adversary behaviour, remove an attacker already inside a zone, or close radio, cellular or unknown routes. Each row shows where reduced reachability can disrupt a tactic, not complete mitigation.
ReferenceMITRE ATT&CK Enterprise and ICS matrices, at tactic level.
Official referencesMITRE ATT&CK
HIPAA Security Rule3 requirements mapped
164.308(a)(7)Contingency plan: data backup and disaster recoveryOSS
OSS / protect the asset
Retrievable exact copies are held physically disconnected between sessions.
164.312(b)Audit controlsOSS
OSS / protect the asset
Each session is recorded and exportable.
164.312(a)(2)(iv)Encryption and decryptionOSS
OSS / protect the asset
Data is encrypted on dedicated hardware.
Offline Secure Storage®Applies to US health data. Business associate arrangements must be agreed separately.
Official referencesHHS: The Security Rule
NERC CIP1 requirement mapped
CIP-009-6 R1.3Backup and storage of information required for recoveryOSS
OSS / protect the asset
Recovery information is held offline, away from the systems it restores.
Offline Secure Storage®Applies to registered entities in North America.
Official referencesNERC Reliability Standards
FISMA and NIST SP 800-533 requirements mapped
CP-9System backupOSS
OSS / protect the asset
Backups are held on dedicated hardware, physically disconnected between sessions.
CP-6Alternate storage siteOSS
OSS / protect the asset
Copies are held in a Firevault Bunker, separate from the primary site.
AU-12Audit record generationOSS
OSS / protect the asset
Each session generates an audit record.
Offline Secure Storage®Authorisation to operate is granted by the agency, not by a supplier.
Official referencesNIST SP 800-53 Rev. 5
EU AI Act3 requirements mapped
Art. 14Human oversightOSSControl
OSS / protect the asset
Oversight can include interruption: a hardware cut and a physically disconnected copy give a designated person a means to stop a system acting on selected data.
Control / govern the path
A named person approves each pathway, and the connection ends when the approved window ends.
Art. 12Record-keepingOSS
OSS / protect the asset
Each access session is recorded and exportable, so oversight actions leave a record.
Art. 15Accuracy, robustness and cybersecurityOSSControl
OSS / protect the asset
A copy held outside the network cannot be altered through the running system's connections.
Control / govern the path
Standing reachability between an AI system and the systems it touches is removed, so a compromised model has no permanent route.
Offline Secure Storage®The Act applies to AI systems placed on or used in the EU market. Firevault does not assess whether a system is high risk.
ControlControl governs connectivity and approval. It does not assess whether an AI system meets the Act's requirements.
ReferenceRegulation (EU) 2024/1689, Articles 12, 14 and 15
Official referencesEUR-Lex: Regulation (EU) 2024/1689
Related on FirevaultAI BlueprintAI Kill SwitchAutonomous AI agent control
NIST AI RMF4 requirements mapped
GOVERNPolicies, roles and accountabilityOSS
OSS / protect the asset
Access to protected copies is granted by an identified person and every session is recorded.
MAPContext and data identificationOSSControl
OSS / protect the asset
The records an AI system depends on are identified and classified before they are protected.
Control / govern the path
Every pathway between an AI system and the systems it touches is inventoried before it is approved.
MEASURETesting and verificationOSS
OSS / protect the asset
A disconnected copy is retrieved and checked, so recovery is demonstrated rather than assumed.
MANAGEResponse and recoveryOSSControl
OSS / protect the asset
Restoration uses a copy that was not reachable when the incident started.
Control / govern the path
A cut applied during an incident is recorded, so the response can be reviewed.
Offline Secure Storage®The AI RMF is voluntary guidance, not a legal requirement, and Firevault does not certify conformance.
ControlControl governs connectivity. Conformance with the AI RMF remains the organisation's own assessment.
ReferenceNIST AI 100-1 and NIST AI 600-1
Official referencesNIST: AI Risk Management FrameworkNIST AI 600-1: Generative AI Profile
Related on FirevaultAI BlueprintControl AI Systems Plan
ISO/IEC 420014 requirements mapped
6.1Actions to address risks and opportunitiesOSS
OSS / protect the asset
Selected AI data and records are protected against unavailability as well as disclosure.
A.7Data for AI systemsOSSControl
OSS / protect the asset
Training and reference data copies are held physically disconnected, with provenance retained.
Control / govern the path
Supplier and tooling routes to protected data are opened for an approved window and closed afterwards.
A.8Information for interested parties of AI systemsOSS
OSS / protect the asset
System documentation and impact records stay retrievable after an incident.
A.10Third-party and customer relationshipsControl
Control / govern the path
Third-party access to AI data is authorised by a named person and logged.
Offline Secure Storage®Annex A is a reference control set, not a checklist: applicability is recorded in your own Statement of Applicability.
ControlControl governs connectivity and approval. Certification against ISO/IEC 42001 is a decision for an accredited certification body.
ReferenceISO/IEC 42001:2023, Clause 6.1 and Annex A control areas A.7, A.8 and A.10
Official referencesISO: ISO/IEC 42001:2023
Related on FirevaultAI Blueprint
SOC 23 requirements mapped
CC6.1Logical access over protected information assetsOSSControl
OSS / protect the asset
Access to protected copies requires an identified person, and each session is recorded and exportable.
Control / govern the path
Pathways are granted per person and window rather than left permanently open.
CC6.7Transmission, movement and removal of informationOSSControl
OSS / protect the asset
Copies leave the storage only through an approved retrieval, so movement is restricted to authorised people and processes.
Control / govern the path
Transfer runs through an approved route that records who asked and who released.
A1.2Data backup processes and recovery infrastructureOSS
OSS / protect the asset
Backup copies are taken, retained and retrieved, so recovery is demonstrated rather than assumed.
Offline Secure Storage®SOC 2 is an attestation on your own controls. Firevault is not the service auditor, and its storage is not a SOC 2 report.
ControlControl governs connectivity and approval; it does not produce an attestation report.
ReferenceAICPA TSP Section 100, criteria CC6.1, CC6.7 and A1.2
Official referencesAICPA: SOC 1, SOC 2 and SOC 3
ISO 223013 requirements mapped
8.2Business impact analysis and risk assessmentOSS
OSS / protect the asset
The information whose loss would stop delivery is identified and protected as a copy.
8.4Business continuity plans and proceduresOSSControl
OSS / protect the asset
Recovery material is held offline and released to named people when a plan is invoked.
Control / govern the path
A recovery pathway is opened only when the plan is invoked, and closes when the window ends.
8.5Exercise programmeOSSControl
OSS / protect the asset
Retrieval is tested on a schedule, so restoration is evidenced rather than assumed.
Control / govern the path
Exercises can run against a real cut and a real retrieval rather than a paper walkthrough.
Offline Secure Storage®ISO 22301 is certified against your own management system. Firevault contributes storage and access evidence, not certification.
ControlControl governs connectivity and approval.
ReferenceISO 22301:2019, Clause 8 sub-clauses 8.2, 8.4 and 8.5
Official referencesISO: ISO 22301:2019
Related on FirevaultOSS® for gold copy backups
ISO/IEC 270022 requirements mapped
8.13Information backupOSSControl
OSS / protect the asset
A copy is held physically disconnected, so backup integrity does not depend on the network.
Control / govern the path
Retrieval runs through an approved session rather than a permanently reachable share.
8.14Redundancy of information processing facilitiesOSS
OSS / protect the asset
An independent copy supports restoration when a processing facility is lost.
Offline Secure Storage®ISO/IEC 27002 is a controls reference and guidance document; certification is against ISO/IEC 27001.
ControlControl governs connectivity and approval.
ReferenceISO/IEC 27002:2022, controls 8.13 and 8.14
Official referencesISO: ISO/IEC 27002:2022
NIST SP 800-1713 requirements mapped
03.08.09System backup, cryptographic protectionOSS
OSS / protect the asset
Backup copies are held offline and protected against unauthorised disclosure at the storage location.
03.03.01Event loggingOSSControl
OSS / protect the asset
Each access session is recorded, so the record of who retrieved what can be produced.
Control / govern the path
Approval and release are recorded against the person who authorised them.
03.01.12Remote accessOSSControl
OSS / protect the asset
Remote pathways are opened for an approved window instead of being left available.
Control / govern the path
A vendor route is brought up for an approved window and disconnected afterwards.
Offline Secure Storage®Rev. 3 is the current edition. Requirement numbering differs from Rev. 2, where system backup was 3.8.9.
ControlControl governs connectivity and approval. Assessment against SP 800-171 remains the organisation's own.
ReferenceNIST SP 800-171 Rev. 3, requirements 03.01.12, 03.03.01 and 03.08.09
Official referencesNIST: SP 800-171 Rev. 3MOD: Secure by Design
Related on FirevaultDefence Blueprint
UK NIS Regulations 20182 requirements mapped
Reg. 10Security duties of operators of essential servicesOSSControl
OSS / protect the asset
Backup forms part of the technical and organisational measures used to manage risks to network and information systems.
Control / govern the path
Standing reachability across selected IT and OT paths is removed and replaced with approved windows.
Reg. 11Duty to notify incidentsOSS
OSS / protect the asset
Session records show what was affected and what was retrieved during a response.
Offline Secure Storage®These are the UK regulations in force, and they have been amended since 2018. They are not the EU NIS2 Directive, which this page lists separately.
ControlControl governs connectivity and approval.
ReferenceThe Network and Information Systems Regulations 2018, SI 2018/506, regulations 10 and 11
Official referencesLegislation.gov.uk: SI 2018/506
Related on FirevaultEnergy BlueprintWater Blueprint
EU GDPR4 requirements mapped
Art. 32(1)(b)Ongoing confidentiality, integrity, availability and resilienceOSSControl
OSS / protect the asset
Physically disconnected copies and authorised retrieval support the protection and availability of selected personal data.
Control / govern the path
Physically closing selected supplier and remote-access pathways between authorised sessions contributes to risk-based security.
Art. 32(1)(c)Timely restoration of availability and accessOSS
OSS / protect the asset
Protected recovery copies support restoration following a physical or technical incident.
Art. 32(1)(d)Regular testing and evaluation of security measuresOSS
OSS / protect the asset
Retrieval tests and exported records contribute evidence to the organisation’s testing process.
Art. 5(1)(f)Integrity and confidentialityOSSControl
OSS / protect the asset
Restricted access to selected copies supports protection against unauthorised processing and accidental loss.
Control / govern the path
Recorded approvals and connection windows support restricted access to systems handling personal data.
Offline Secure Storage®Lawful processing, retention, individual rights and international transfers remain separate obligations. Under Article 33, controllers notify qualifying breaches without undue delay and, where feasible, within 72 hours of awareness. Processors notify controllers without undue delay.
ControlConnectivity control does not determine lawful processing or perform breach notification.
ReferenceGDPR, Articles 32(1)(b) and 5(1)(f)
Official referencesEUR-Lex: GDPR
IACS UR E26 and E274 requirements mapped
E26 4.5.1Recovery planOSS
OSS / protect the asset
Protected copies and retrieval procedures support the shipowner’s documented recovery arrangements.
E26 4.5.2Backup and restore capabilityOSS
OSS / protect the asset
Disconnected copies of selected configurations and data support restoration and provide material for recovery tests.
E26 4.2.6Remote access control and communication with untrusted networksControl
Control / govern the path
Approved connection windows and session records support controlled remote access to selected ship systems.
E26 4.2.1Security Zones and Network SegmentationControl
Control / govern the path
Closing selected inter-zone pathways contributes to separation within the ship’s approved network architecture.
Offline Secure Storage®Ship-specific recovery planning, operational safety, equipment capabilities and classification surveys remain separate. Holding a backup does not demonstrate that an on-board system can restore safely.
ControlOn-board acceptance, authentication, encryption, safe interruption and rollback require ship-specific implementation and verification. Control does not replace E27 equipment requirements or IMO safety management.
ReferenceUR E26, sections 4.2.1 and 4.2.6, particularly 4.2.6.3.1 and 4.2.6.3.2
Official referencesIACS: UR E26 Rev.1IACS: UR E27 Rev.1IMO: Maritime cyber risk
EASA Part-IS3 requirements mapped
IS.I.OR.200Information security management system (ISMS)OSSControl
OSS / protect the asset
Access records, provisioning records and retrieval tests contribute evidence to the organisation’s ISMS.
Control / govern the path
Authorised and logged connectivity windows contribute evidence of implemented security measures.
IS.I.OR.205Information security risk assessmentOSSControl
OSS / protect the asset
Classification and provisioning records help document selected information assets and recovery dependencies for assessment.
Control / govern the path
Records of controlled pathways can inform assessment of interfaces and supplier dependencies.
IS.I.OR.220Information security incidents, detection, response, and recoveryOSS
OSS / protect the asset
Offline copies and retrieval tests support recovery procedures for selected information and systems.
Offline Secure Storage®Equivalent IS.D.OR.200, IS.D.OR.205 and IS.D.OR.220 provisions apply under Regulation 2022/1645. Safety risk assessment, incident detection and external reporting remain the organisation’s responsibility.
ControlIS.I.OR.230 concerns external reporting. IS.I.OR.235 concerns contracting information security management activities, not all supplier access. Control does not perform these duties. Equivalent IS.D.OR provisions apply where relevant.
ReferenceRegulation (EU) 2023/203, Annex II, IS.I.OR.200 and IS.I.OR.205
Official referencesEUR-Lex: Regulation 2022/1645EUR-Lex: Regulation 2023/203
CER Directive5 requirements mapped
Art. 12Risk assessment by critical entitiesOSS
OSS / protect the asset
Classification and provisioning records can inform assessment of information and recovery dependencies.
Art. 13(1)(c)Respond to, resist and mitigate incidentsOSSControl
OSS / protect the asset
Access records and protected operational records can support the organisation’s incident response.
Control / govern the path
Disconnecting selected pathways can support proportionate containment arrangements.
Art. 13(1)(d)Recover from incidentsOSS
OSS / protect the asset
Offline copies and retrieval tests support selected business continuity and recovery arrangements.
Art. 13(1)(e)Employee security managementOSSControl
OSS / protect the asset
Identity-verified and authorised access supports restricted access to selected sensitive information.
Control / govern the path
Recorded approvals and bounded access windows support management of access to selected infrastructure and sensitive information.
Art. 13(1)(a)Prevent incidentsControl
Control / govern the path
Reducing standing connectivity contributes to prevention measures where justified by the entity’s risk assessment.
Offline Secure Storage®CER is not a substitute for NIS2 cybersecurity duties. Premises protection, background checks, training and wider all-hazards resilience remain separate. Article 15 requires notification without undue delay, initially within 24 hours unless operationally unable, and a detailed report where relevant within one month thereafter.
ControlControl does not provide premises perimeter protection under Article 13(1)(b), personnel training under Article 13(1)(f), background checks or Article 15 notifications.
ReferenceDirective (EU) 2022/2557, Article 13(1)(a), (c) and (e)
Official referencesEUR-Lex: CER Directive
EU Cyber Resilience Act3 requirements mapped
Art. 13(13)Retention of technical documentation and the EU declaration of conformityOSS
OSS / protect the asset
Protected copies support keeping required records available to market surveillance authorities for at least ten years after placing the product on the market, or the support period if longer.
Art. 13(9)Continued availability of security updatesOSS
OSS / protect the asset
Protected copies of released updates can support the manufacturer’s ability to keep updates available for the required period.
Annex I, Part II, point (7)Secure distribution of updatesControl
Control / govern the path
Restricted supplier and administrative pathways can contribute to protecting supporting update infrastructure against unauthorised access.
Offline Secure Storage®Offline storage alone does not make documentation available to authorities or updates available to users. Annex I Part I concerns product properties and Part II vulnerability handling. Firevault contributes to manufacturer records and supporting infrastructure, not proof that the product’s own design conforms.
ControlThe manufacturer must implement secure update distribution and the product’s required update capabilities. Control does not itself provide authenticity checks, signed updates, product security features, vulnerability handling or Article 14 reporting.
ReferenceRegulation (EU) 2024/2847, Annex I, Part II, point (7)
Official referencesEUR-Lex: Cyber Resilience Act
CIS Controls v8.16 requirements mapped
11.1Establish and Maintain a Data Recovery ProcessOSS
OSS / protect the asset
Provisioning records, classification schedules and retrieval procedures contribute to a documented recovery process.
11.3Protect Recovery DataOSS
OSS / protect the asset
Disconnected copies and identity-verified access contribute to protection of recovery data.
11.4Establish and Maintain an Isolated Instance of Recovery DataOSS
OSS / protect the asset
Selected recovery copies remain physically disconnected while storage is closed.
11.5Test Data RecoveryOSS
OSS / protect the asset
Retrieval tests and exported evidence support the organisation’s recovery testing programme.
12.2Establish and Maintain a Secure Network ArchitectureControl
Control / govern the path
Physical disconnection of selected pathways contributes to segmentation and least privilege within a wider architecture.
6.1Establish an Access Granting ProcessControl
Control / govern the path
Recorded approvals for connectivity windows can contribute evidence to the organisation’s documented access granting process.
Offline Secure Storage®Safeguard 11.2, Perform Automated Backups, is not claimed: offline storage alone does not schedule or automate backup creation. The organisation must test a sample of in-scope assets quarterly or more frequently under 11.5 and establish that recovery returns assets to a trusted state.
ControlSafeguard 6.1 specifically addresses access on new hire or role change. Session approval is only supporting evidence, not a replacement for identity lifecycle processes. Network availability and the wider architecture remain the organisation’s responsibility.
ReferenceCIS Controls v8.1, safeguards 12.2 and 6.1
Official referencesCIS: Controls v8.1CIS: Controls Navigator v8.1
CMMC 2.03 requirements mapped
MP.L2-3.8.9Protect BackupsOSS
OSS / protect the asset
Physically disconnected copies and controlled retrieval support protection of the confidentiality of backup CUI at storage locations.
AU.L2-3.3.1System AuditingOSSControl
OSS / protect the asset
Exportable storage access records contribute to the organisation’s audit records.
Control / govern the path
Connection records can contribute evidence of selected remote access activity.
AC.L2-3.1.12Control Remote AccessControl
Control / govern the path
Selected remote pathways are disconnected between approved windows, with approvals and connection windows logged.
Offline Secure Storage®Level 2 uses the 110 NIST SP 800-171 Revision 2 requirements. Assessment scope, audit retention and any certification remain the organisation’s responsibility.
ControlConnectivity records are not a substitute for system-wide monitoring, audit generation or a CMMC assessment.
ReferenceCMMC Level 2 Assessment Guide, AC.L2-3.1.12, AU.L2-3.3.1 and MP.L2-3.8.9
Official referencesCMMC programme ruleDFARS final ruleDoD Level 2 Assessment Guide
Def Stan 05-1383 requirements mapped
2504BackupsOSS
OSS / protect the asset
Protected copies and encryption evidence contribute to secured current backups. Integrity validation must be arranged separately.
2505Resilient backupsOSS
OSS / protect the asset
Offline copies and retrieval tests support resilience evidence. Secure offsite storage and regular recovery testing require an organisation-specific arrangement.
2417Authorise remote execution of privileged commandsControl
Control / govern the path
Out-of-band approval and logged access windows support prior authorisation for selected remote privileged sessions.
Offline Secure Storage®Control 2504 is marked for Level 1. Control 2505 is marked for Levels 2 and 3. A spare drive in the same vault is not offsite storage.
ControlThe organisation must also control commands, identities and privileges within the connected systems.
ReferenceDef Stan 05-138 Issue 4, controls 2504, 2505 and 2417
Official referencesMOD standard, Issue 4
TSA pipeline directives5 requirements mapped
III.F.1.cSecurity and integrity of backed-up dataOSS
OSS / protect the asset
Offline copies support storage separate from the system and restricted access to backups.
III.GCybersecurity Assessment PlanOSS
OSS / protect the asset
Retrieval tests and exported access records can contribute evidence for the operator’s assessment and audit activities.
III.BNetwork segmentationControl
Control / govern the path
Selected IT/OT and other network pathways remain disconnected outside approved windows.
III.CAccess controlControl
Control / govern the path
Authorised, time-bounded connections contribute to restrictions on selected local and remote access.
III.DContinuous monitoring and detectionControl
Control / govern the path
Connection-window records can contribute to monitoring evidence for selected pathways.
Offline Secure Storage®Malicious-code checks at backup and restoration, the response plan, annual assessment submissions and CISA reporting remain the operator’s responsibility.
ControlControl does not provide continuous threat detection or replace the operator’s monitoring tools and procedures.
ReferencePipeline-2021-02G, sections III.B, III.C, III.D, III.F and III.G
Official referencesTSA mitigation directive 02GTSA reporting directive 01GTSA directive register
NYDFS Part 5004 requirements mapped
500.16(e)Protected backupsOSS
OSS / protect the asset
Physically disconnected copies and authorised retrieval support protection against unauthorised alteration or destruction.
500.16(d)(2)Testing restoration from backupsOSS
OSS / protect the asset
Retrieval tests can contribute evidence for annual testing of restoration of critical data and information systems.
500.7Access privileges and managementOSSControl
OSS / protect the asset
Identity-verified storage access and session records contribute to restricted access to selected copies.
Control / govern the path
Time-bounded connectivity supports restrictions on selected access pathways.
500.11Third-party service provider security policyControl
Control / govern the path
Supplier approvals and connection records can contribute evidence for the organisation’s third-party security policy.
Offline Secure Storage®Copies must support restoration of material operations. Retrieval alone is not a complete restoration test. Section 500.17(a)(1) requires notice as promptly as possible and within 72 hours after determining that a defined cybersecurity incident has occurred.
ControlControl does not assess supplier security or replace due diligence, contracts, access reviews or reporting.
Reference23 NYCRR 500.7, 500.11 and 500.16
Official referencesDFS consolidated second-amendment text
SWIFT CSCF 20264 requirements mapped
Access controlLogical access controlOSSControl
OSS / protect the asset
Identity-verified retrieval supports access restrictions over selected stored copies.
Control / govern the path
Approved windows and connection records support restrictions on selected remote and supplier access.
LoggingLogging and monitoringOSS
OSS / protect the asset
Exportable storage session records can contribute to security review evidence.
Incident responseCyber incident response planningOSS
OSS / protect the asset
Protected recovery copies and retrieval tests can contribute to the organisation’s response arrangements.
Environment protectionSwift environment protectionControl
Control / govern the path
Restricted connectivity supports separation of selected Swift-related pathways.
Offline Secure Storage®Control areas are named rather than numbered here; confirm the numbered control against the official CSCF document. No standalone backup control is claimed.
ControlApplicability depends on the user's Swift architecture type. Check exact control references against the official CSCF document for the current cycle.
ReferenceSwift CSCF v2026, described by control area
Official referencesSwift CSCF v2026 resource
PRA operational resilience5 requirements mapped
SS1/21 Chapter 4Actions to remain within impact toleranceOSS
OSS / protect the asset
Selected protected copies can contribute to recovery arrangements for important business services.
SS1/21 Chapter 6Scenario testingOSS
OSS / protect the asset
Retrieval exercises can contribute to severe but plausible disruption testing.
SS2/21 Chapter 10Business continuity and exit plansOSS
OSS / protect the asset
Recoverable selected copies can support continuity and exit planning for outsourced arrangements.
SS1/21 Chapter 5MappingControl
Control / govern the path
Connection records can contribute evidence about selected network and third-party dependencies.
SS2/21 Chapter 7Data securityControl
Control / govern the path
Restricted supplier connectivity contributes to protection of selected pathways to data.
Offline Secure Storage®The firm defines important business services and impact tolerances under SS1/21 Chapters 2 and 3. Retrieval tests alone do not demonstrate end-to-end service recovery within tolerance.
ControlControl does not perform service mapping, set impact tolerances or replace third-party due diligence and continuity planning.
ReferenceSS1/21 Chapters 4, 5 and 6; SS2/21 Chapters 7 and 10
Official referencesPRA SS1/21PRA SS2/21
Essential Eight2 requirements mapped
Regular backupsRegular backupsOSS
OSS / protect the asset
Physically disconnected copies and retrieval tests support protection and recovery of selected data.
Restrict administrative privilegesRestrict administrative privilegesOSSControl
OSS / protect the asset
Separate approval and recorded access sessions support accountable access to protected copies.
Control / govern the path
Time-bounded connectivity and approval records support restrictions on administrative access.
Offline Secure Storage®Backup scope, frequency, retention, restoration and all maturity criteria remain organisational responsibilities. Identity verification is not evidence of multi-factor authentication.
ControlConnectivity control does not implement account privilege management or multi-factor authentication.
ReferenceEssential Eight Maturity Model, Restrict administrative privileges
Official referencesASD: Essential Eight maturity modelASD: Commonwealth Cyber Security Posture in 2023
ASD ISM3 requirements mapped
Backup protectionBackup protectionOSS
OSS / protect the asset
Physical disconnection reduces network exposure of selected copies between authorised sessions.
Backup restorationBackup restorationOSS
OSS / protect the asset
Retrieval tests can be pointed to as evidence within wider restoration exercises.
Network segmentation and segregationNetwork segmentation and segregationControl
Control / govern the path
Default-disconnected connectivity can contribute to separation of selected network zones, including IT and OT boundaries.
Offline Secure Storage®Rows are named by guideline topic rather than control number; check the numbered controls in the current ISM edition. Backup scope, retention and restoration exercises remain the organisation's responsibility.
ControlA complete network design, zone classification and inter-zone security policy remain necessary.
ReferenceISM, Guidelines for networking, Network segmentation and segregation
Official referencesASD: current ISMASD: system managementASD: networking
SOCI Act2 requirements mapped
30AHCritical infrastructure risk management programOSSControl
OSS / protect the asset
Offline copies and retrieval tests can support measures to minimise or eliminate material risks and mitigate relevant impacts.
Control / govern the path
Approved connectivity windows and logs can support documented treatment of supplier and network pathway risks.
30CDAdoption and maintenance of incident response planOSS
OSS / protect the asset
Recovery copy inventories and retrieval evidence can support an incident response plan where the Part 2C obligation is imposed.
Offline Secure Storage®Part 2B reporting remains the responsible entity’s duty. Section 30BC requires reporting as soon as practicable and within 12 hours of awareness of a critical incident with a significant impact on availability. Section 30BD requires reporting as soon as practicable and within 72 hours for other incidents with a relevant impact. Oral reports require subsequent written reports.
ControlPart 2C obligations are imposed through statutory mechanisms and include incident response planning, exercises, vulnerability assessments and access to system information. Control does not discharge these obligations.
ReferenceSOCI Act, Part 2A, section 30AH; Part 2C
Official referencesFederal Register: SOCI ActFederal Register: 2024 amendment
APRA CPS 2343 requirements mapped
21Implementation of information security controlsOSSControl
OSS / protect the asset
Disconnected copies and approved access support protection proportionate to asset criticality and sensitivity.
Control / govern the path
Physical disconnection of selected pathways reduces standing exposure and records authorised connectivity.
24Information security response plansOSSControl
OSS / protect the asset
Recovery copy records and retrieval procedures can support plans for plausible incidents.
Control / govern the path
Connectivity closure and approval records can support defined containment procedures.
27Testing control effectivenessOSS
OSS / protect the asset
Retrieval tests provide evidence for part of the organisation’s systematic testing programme.
Offline Secure Storage®Paragraph 23 requires timely detection and response. Paragraphs 24 to 26 address response plans and their annual review and testing. Paragraph 35 requires APRA notification as soon as possible and no later than 72 hours after awareness of a qualifying incident. Paragraph 36 separately requires notification of specified material control weaknesses within 10 business days.
ControlDetection, incident assessment, comprehensive testing and regulatory notification remain organisational duties.
ReferenceCPS 234, paragraphs 21, 23 to 27 and 35 to 36
Official referencesAPRA: CPS 234 official text
APRA CPS 2305 requirements mapped
Critical operationsCritical operationsOSS
OSS / protect the asset
Selected recovery copies can support operations whose disruption would materially adversely affect the entity, customers or its financial-system role.
Tolerance levelsTolerance levelsOSS
OSS / protect the asset
Measured retrieval times can inform tolerances for disruption, data loss and minimum service levels.
Business continuity planBusiness continuity planOSSControl
OSS / protect the asset
Documented retrieval procedures and resources can support continuity actions and dependency assessments.
Control / govern the path
Recorded pathway dependencies and closure procedures can support continuity planning.
BCP testingSystematic testing programmeOSS
OSS / protect the asset
Retrieval tests can contribute to the systematic BCP testing programme, including the annual exercise.
Material service providersMaterial service providersControl
Control / govern the path
Authorised windows and access logs can support management of operational risks arising from selected providers.
Offline Secure Storage®A protected copy alone does not establish recovery within tolerance. Identifying material service providers, contracting and oversight remain the entity's responsibility. Rows are named by topic; check paragraph numbers in the current version.
ControlControl does not maintain the provider register, assess materiality or replace contractual and continuity arrangements.
ReferenceCPS 230 (version commencing 1 July 2026): critical operations, business continuity and material service providers
Official referencesAPRA Handbook: CPS 230
UAE IA Regulation5 requirements mapped
T3.5.1Information BackupOSS
OSS / protect the asset
Physically disconnected copies and retrieval-test records contribute to evidence of protected, recoverable backups.
T5.2.2Privilege ManagementOSS
OSS / protect the asset
Identity-verified, authorised retrieval windows support restricted access to selected copies.
T4.5.3Segregation in NetworksControl
Control / govern the path
Selected pathways remain physically disconnected outside authorised windows, contributing to network segregation.
T5.4.4Remote Diagnostic and Configuration ProtectionControl
Control / govern the path
Selected remote-maintenance pathways open only for approved, time-bounded sessions.
T6.2.2Monitoring and Review of Third Party ServicesControl
Control / govern the path
Supplier connection approvals and session windows can be pointed to as evidence in service reviews.
Offline Secure Storage®Supports selected controls only. Backup schedules, recovery objectives, testing and regulatory reporting remain the organisation's responsibility. Neither product makes an organisation compliant.
ControlSupports selected connectivity controls only. Identity systems, monitoring, supplier due diligence and contracts remain the organisation's responsibility.
ReferenceUAE IA Regulation v1.1, controls T4.5.3, T5.4.4 and T6.2.2
Official referencesTDRA: UAE IA Regulation v1.1Cyber Security Council: UAE Information Assurance Standard
NCA ECC5 requirements mapped
2-9Backup and Recovery ManagementOSS
OSS / protect the asset
Offline copies and recorded retrieval tests support backup protection and recovery evidence.
2-2Identity and Access ManagementOSSControl
OSS / protect the asset
Identified, authorised retrieval sessions support restricted access to recovery copies.
Control / govern the path
Approvals and time-bounded windows support controlled access over selected pathways.
3-1Cybersecurity Resilience Aspects of Business Continuity Management (BCM)OSS
OSS / protect the asset
Protected copies and retrieval tests can contribute to the organisation's continuity and recovery exercises.
2-5Network Security ManagementControl
Control / govern the path
Physical disconnection of selected pathways contributes to network separation and restricted connectivity.
4-1Third-Party CybersecurityControl
Control / govern the path
Supplier pathway approvals and connection logs support oversight of third-party access.
Offline Secure Storage®Supports selected controls only. Backup schedules, recovery objectives, testing and regulatory reporting remain the organisation's responsibility. Neither product makes an organisation compliant.
ControlSupports selected connectivity controls only. Identity systems, monitoring, supplier due diligence and contracts remain the organisation's responsibility.
ReferenceECC-2:2024 subdomains 2-2, 2-5 and 4-1.
Official referencesNCA: Essential Cybersecurity Controls ECC-2:2024
SAMA CSF4 requirements mapped
3.3.5Identity and Access ManagementOSSControl
OSS / protect the asset
Authorised, identity-verified retrievals support need-to-have access to selected recovery copies.
Control / govern the path
Approved connection windows contribute to restricted access over selected pathways.
2.6IT Disaster Recovery Plan (DRP), SAMA BCM FrameworkOSS
OSS / protect the asset
Protected copies and retrieval tests contribute to the separate BCM framework's backup and recovery process.
3.4.1Contract and Vendor ManagementControl
Control / govern the path
Supplier-access approvals and connection logs can support vendor control reviews.
3.4.2OutsourcingControl
Control / govern the path
Recorded supplier connection windows contribute to oversight of outsourced access.
Offline Secure Storage®Supports selected controls only. Backup schedules, recovery objectives, testing and regulatory reporting remain the organisation's responsibility. Neither product makes an organisation compliant.
ControlSupports selected connectivity controls only. Identity systems, monitoring, supplier due diligence and contracts remain the organisation's responsibility.
ReferenceCSF 3.3.5, 3.4.1 and 3.4.2. OSS backup mapping uses BCM Framework 2.6, not CSF 2.6.
Official referencesSAMA: Cyber Security FrameworkSAMA: Original CSF PDF, Version 1.0SAMA BCM Framework: 2.6 IT Disaster Recovery Plan
MAS TRM5 requirements mapped
8.2System RecoverabilityOSS
OSS / protect the asset
Selected recovery copies can support recovery planning, subject to tested retrieval and restoration times.
8.4System Backup and RecoveryOSS
OSS / protect the asset
Physically disconnected copies and retrieval-test records contribute to evidence of protected backups.
Access controlAccess controlOSSControl
OSS / protect the asset
Identity-verified and authorised retrieval sessions support access restrictions for selected copies.
Control / govern the path
Selected pathways are connected only for an authorised window, with approvals recorded.
3.4Management of Third Party ServicesControl
Control / govern the path
Supplier connection approvals and logs contribute to oversight of third-party access.
Cyber security operationsCyber security operationsControl
Control / govern the path
Connection-window records can contribute evidence to security investigations, but do not replace monitoring or incident response.
Offline Secure Storage®Supports selected controls only. Backup schedules, recovery objectives, testing and regulatory reporting remain the organisation's responsibility. Neither product makes an organisation compliant.
ControlSupports selected connectivity controls only. Identity systems, monitoring, supplier due diligence and contracts remain the organisation's responsibility.
ReferenceMAS TRM Guidelines, sections 3.4, 8.2 and 8.4
Official referencesMAS: Technology Risk Management Guidelines, January 2021
OSFI B-136 requirements mapped
2.9.1Disaster recovery program is establishedOSS
OSS / protect the asset
Offline copies and retrieval records can contribute to the enterprise disaster recovery programme under Principle 12.
2.9.3Disaster recovery scenarios are testedOSS
OSS / protect the asset
Retrieval-test evidence can support scenario exercises under Principle 13, but does not demonstrate full service recovery.
3.2.5Data protection and loss prevention security controls are implementedOSS
OSS / protect the asset
Physical disconnection and controlled retrieval contribute to protection of selected data at rest.
3.2.4Cyber security controls are layeredControl
Control / govern the path
Default disconnection of selected pathways contributes an additional preventive layer.
3.2.7Identity and access management controls are implementedControl
Control / govern the path
Approval records and time-bounded supplier windows support restricted third-party access.
3.2.8Security configuration baselines are enforced and deviations are managedControl
Control / govern the path
Selected pathways remain disconnected by default and approved windows are logged.
Offline Secure Storage®Supports selected controls only. Backup schedules, recovery objectives, testing and regulatory reporting remain the organisation's responsibility. Neither product makes an organisation compliant.
ControlSupports selected connectivity controls only. Identity systems, monitoring, supplier due diligence and contracts remain the organisation's responsibility.
ReferenceB-13 domain 2, section 2.9, Principles 12 and 13. Domain 3, section 3.2 Defend, Principle 15.
Official referencesOSFI: Guideline B-13OSFI: B-13 publication letter and effective date
These describe possible technical contributions, not a certification, legal opinion or a claim that deployment alone satisfies an obligation. Neither product makes you compliant on its own.
Board and director accountability
The duty sits with the board. The evidence sits in the estate.
Company law and regulators expect boards to be informed about cyber and resilience risk, to oversee it and to be able to show that they have.
These duties do not prescribe technology. They ask what the board knew, what it asked for and what it reviewed. Choose a country to see its duties, the penalties regulators can impose, where personal liability can reach directors and senior managers, and enforcement already on the record. Choosing one in the selector above also updates this view.
Director care
Companies Act 2006, s.174(1) and (2)
Directors must exercise reasonable care, skill and diligence, assessed against both their role and their actual knowledge and experience.
This applies to directors of companies subject to the Act.
What the board can ask to see
Companies Act 2006, s.174Firevault can contribute access session records and retrieval test results for a board review of information risk.
Company success
Companies Act 2006, s.172(1)
Directors must act in good faith to promote the company’s success for members as a whole, having regard to the listed factors including long-term consequences.
This applies to directors of companies subject to the Act, with statutory qualifications.
What the board can ask to see
Companies Act 2006, s.172Firevault can contribute an offline classification schedule and retrieval test results to inform discussion of long-term information resilience.
Material controls declaration
UK Corporate Governance Code 2024, Provision 29
Boards should monitor and annually review the control framework and report on material control effectiveness, including a balance sheet date declaration for financial years beginning on or after 1 January 2026.
This applies on a comply or explain basis to companies within the Code’s listing-rule scope.
What the board can ask to see
FRC, Provision 29 MythbusterFirevault can contribute access session records, approvals and retrieval test results for the board’s assessment of relevant material controls.
Cyber governance practice
Cyber Governance Code of Practice, D1 and D2; E1 and E2, published 8 April 2025
Boards should seek assurance on incident recovery plans and annual exercises, establish cyber governance and require reporting at least quarterly.
This voluntary guidance is intended for boards and directors of public and private organisations.
What the board can ask to see
DSIT, Cyber Governance Code of PracticeFirevault can contribute retrieval test results and access approvals for periodic board assurance reporting.
NIS2 management accountability
Directive (EU) 2022/2555, Article 20(1) and (2)
Member States must require management bodies to approve and oversee Article 21 measures, make them capable of liability for infringements and require their members to undertake training.
This concerns management bodies of essential and important entities, through applicable national implementing law.
What the board can ask to see
EUR-Lex, NIS2Firevault can contribute access approvals, retrieval test results and an offline classification schedule for oversight of relevant risk measures.
DORA management responsibility
Regulation (EU) 2022/2554, Article 5(2) and (4)
Management bodies must define, approve and oversee ICT risk arrangements, retain ultimate responsibility and keep their skills current through regular relevant training.
This applies to management bodies of financial entities subject to these DORA provisions, taking account of statutory exclusions.
What the board can ask to see
EUR-Lex, DORAFirevault can contribute retrieval test results, access session records and approvals for oversight of recovery and access arrangements.
Material incident reporting
Form 8-K, Item 1.05(a), (c) and Instructions 1 and 4
Registrants must generally report within four business days of determining materiality, make that determination without unreasonable delay and observe any applicable permitted delay conditions.
This applies to registrants required to report material cyber incidents on Form 8-K.
What the board can ask to see
SEC, Release 33-11216, adopted rule textFirevault can contribute time-stamped access session records and approvals to support management’s incident fact gathering for board scrutiny.
Board oversight disclosure
Regulation S-K, Item 106(c)(1), 17 CFR 229.106(c)(1)
Registrants must describe board oversight of cyber risks, identify responsible committees where applicable and explain how the board or committee is informed.
This applies to registrants required to provide Item 106 disclosures in Form 10-K.
What the board can ask to see
SEC, Release 33-11216, adopted rule textFirevault can contribute access records and retrieval test results as inputs to the reporting process described to investors.
Director care
Corporations Act 2001, s.180(1)
Directors and officers must exercise the care and diligence of a reasonable person in the corporation’s circumstances with the same office and responsibilities.
This applies to directors and other officers of corporations within the provision’s scope.
What the board can ask to see
Federal Register of Legislation, Corporations Act 2001Firevault can contribute retrieval test results and access approvals for informed review of information resilience risks.
Information security responsibility
APRA CPS 234, paragraph 13
The board is ultimately responsible for ensuring that the entity maintains its information security.
This applies to boards of APRA-regulated entities covered by CPS 234.
What the board can ask to see
APRA, CPS 234 Information SecurityFirevault can contribute an offline classification schedule, access session records and retrieval test results for board assurance.
Saudi cyber governance
SAMA Cyber Security Framework, 3.1.1 Principle and control consideration 1
The cyber security governance structure should be endorsed by the board and its cyber security committee should be mandated by the board.
This applies to Saudi Central Bank Member Organisations within the Framework’s scope.
What the board can ask to see
SAMA Rulebook, Cyber Security FrameworkFirevault can contribute access approvals and retrieval test results for reporting through the board-mandated cyber security committee.
Director diligence
Companies Act 1967, s.157(1)
Directors must act honestly and use reasonable diligence in discharging their duties.
This applies to directors of companies within the Singapore Act’s scope.
What the board can ask to see
Singapore Statutes Online, Companies Act 1967Firevault can contribute access approvals and retrieval test results for informed board questioning of information risks.
Technology risk oversight
MAS Technology Risk Management Guidelines, January 2021, section 3.1
Boards and senior management should oversee technology risk governance and establish a sound technology risk management framework.
These supervisory guidelines address financial institutions under MAS supervision, with proportional implementation.
What the board can ask to see
MAS, Technology Risk Management GuidelinesFirevault can contribute access session records, approvals and retrieval test results for technology risk oversight reporting.
Director and officer care
Canada Business Corporations Act, s.122(1)(a) and (b)
Directors and officers must act honestly and in good faith in the corporation’s best interests and exercise reasonably prudent care, diligence and skill.
This applies to directors and officers of corporations governed by the federal Act.
What the board can ask to see
Justice Canada, CBCA s.122Firevault can contribute an offline classification schedule and retrieval test results to inform review of information risk.
Financial institution board oversight
OSFI Corporate Governance Guideline (2018), II, The Role of the Board, item 1
Boards should approve and oversee the risk appetite framework and internal control framework.
This applies to federally regulated financial institutions other than foreign bank and foreign insurance branch operations.
What the board can ask to see
OSFI, Corporate Governance Guideline (2018)Firevault can contribute access approvals, access session records and retrieval test results as inputs to internal control oversight.
What is at stake: United Kingdom
For the organisation
- ICO fines under UK GDPRUp to £17.5 million or 4% of worldwide turnover
The higher maximum is £17.5 million or, for an undertaking, 4% of total annual worldwide turnover, whichever is higher. Security failures under Article 32 sit in the standard tier of £8.7 million or 2%, although a related breach of the data protection principles can reach the higher tier.
UK GDPR Article 83; Data Protection Act 2018, s.157 · In force
Data Protection Act 2018, s.157 - NIS Regulations penaltiesUp to £17 million
Operators of essential services and relevant digital service providers face three bands: up to £1 million for a non-material contravention, £8.5 million for a material contravention and £17 million where the contravention created, or could have created, a significant risk to service provision.
Network and Information Systems Regulations 2018, reg.18(6) · In force
NIS Regulations 2018, regulation 18 - Cyber Security and Resilience BillProposed: £17 million or 4% of worldwide turnover
The Bill would replace the NIS penalty bands with a maximum of £17 million or 4% of worldwide turnover, whichever is higher, for more serious breaches and £10 million or 2% for less serious breaches. Enforcement would begin only after Royal Assent and secondary legislation.
Cyber Security and Resilience (Network and Information Systems) Bill · Proposed, before Parliament on 8 November 2026
DSIT enforcement factsheet - FCA and PRA penaltiesNo fixed statutory cap
For an authorised firm that breaches a relevant requirement, including applicable operational resilience rules, the regulator may impose a penalty of such amount as it considers appropriate.
Financial Services and Markets Act 2000, s.206(1) · In force
FSMA 2000, s.206
For directors and senior managers
- Director disqualificationUp to 15 years
A director found unfit can be disqualified from acting as a director for between two and 15 years under section 6, and the Secretary of State can seek disqualification in the public interest under section 8. This is general company law, not an automatic sanction for a cyber incident.
Company Directors Disqualification Act 1986, ss.6 and 8 · In force
Company Directors Disqualification Act 1986, s.8 - Personal liability for data protection offences
Where a criminal offence under the Act is committed by a company with the consent or connivance of, or is attributable to neglect by, a director, manager or similar officer, that person is also guilty of the offence. It covers offences such as unlawfully obtaining or disclosing personal data, not the company's administrative fines.
Data Protection Act 2018, s.198 · In force
Data Protection Act 2018, s.198 - Claims for breach of the duty of care
A director who fails to exercise reasonable care, skill and diligence can be liable to the company, and members can bring a derivative claim on the company's behalf for negligence or breach of duty.
Companies Act 2006, ss.174, 178 and 260 · In force
Companies Act 2006, s.260 - Senior Managers Regime: Duty of ResponsibilityPersonal fines and prohibition
In financial services, a senior manager can be fined personally where the firm breaches a requirement in their area and they did not take the steps reasonably expected to avoid or stop it. The regulator can also prohibit an individual from performing specified functions.
Financial Services and Markets Act 2000, ss.56, 66, 66A and 66B · In force
FSMA 2000, s.66A
Enforcement on the record
British Airways
ICO · October 2020
Penalty for security failures exposed by a 2018 cyber attack on its website and booking systems.
ICO penalty noticeCapita
ICO · October 2025
Combined fines on Capita plc (£8 million) and Capita Pension Solutions (£6 million) for security failures linked to the March 2023 cyber attack.
ICO announcementAdvanced Computer Software
ICO · March 2025
Fine after a 2022 ransomware attack, citing gaps in multi-factor authentication, vulnerability scanning and patch management.
ICO announcement23andMe
ICO · June 2025
Fine for failing to implement appropriate security measures before a 2023 attack affecting 155,592 UK users.
ICO enforcement recordWhat is at stake: European Union
For the organisation
- GDPR administrative finesUp to €20 million or 4% of worldwide turnover
The higher tier is €20 million or 4% of total worldwide annual turnover, whichever is higher. Security obligations under Article 32 sit in the standard tier of €10 million or 2%, although a related breach of the Article 5 principles can reach the higher tier.
Regulation (EU) 2016/679, Article 83(4) to (6) · In force
GDPR on EUR-Lex - NIS2 finesAt least €10 million or 2% (essential), €7 million or 1.4% (important)
For breaches of the risk-management and reporting duties, Member States must set national maximum fines of at least these amounts, whichever is higher. The enforceable ceiling is set by each country's implementing law.
Directive (EU) 2022/2555, Article 34(4) and (5) · In force through national law
NIS2 on EUR-Lex - DORA penaltiesSet nationally; up to 1% of daily turnover for critical ICT providers
Member States set the penalties for financial entities. A critical ICT third-party provider can be ordered to make daily periodic penalty payments of up to 1% of its average daily worldwide turnover, for up to six months, until it complies.
Regulation (EU) 2022/2554, Articles 35(6) to (8) and 50 · Applies since 17 January 2025
DORA on EUR-Lex
For directors and senior managers
- NIS2 management-body liability
Management bodies must approve and oversee the cyber security risk-management measures and can be held liable for their entity's infringements. How that liability works is set by national law.
Directive (EU) 2022/2555, Article 20(1) · In force through national law
NIS2 on EUR-Lex - NIS2 temporary ban from managementTemporary prohibition
Where an essential entity still fails to comply after other enforcement measures, authorities can request a temporary prohibition on a chief executive or legal representative exercising managerial functions in that entity until it complies. Natural persons who represent or control an essential entity can be held liable for failing to ensure compliance. Public administration entities are excluded.
Directive (EU) 2022/2555, Article 32(5)(b) and (6) · In force through national law
NIS2 on EUR-Lex - DORA penalties on management
Member States must allow penalties and remedial measures to be applied to members of the management body and other individuals responsible for a financial entity's breach, under the conditions set by national law.
Regulation (EU) 2022/2554, Article 50(5) · Applies since 17 January 2025
DORA on EUR-Lex
Enforcement on the record
Dedalus Biologie
CNIL, France · April 2022
Fine for several infringements, including inadequate security, after a breach exposing medical information about nearly 500,000 people.
EDPB summaryWhat is at stake: United States
For the organisation
- SEC enforcement of cyber disclosuresUp to $4 million in recent settlements
Listed companies that make materially misleading cyber disclosures face SEC enforcement. In October 2024 Unisys, Avaya, Check Point and Mimecast settled charges for $4 million, $1 million, $995,000 and $990,000 respectively, without admitting or denying the findings.
SEC release 2024-174 · Settled
SEC press release 2024-174 - HIPAA civil money penaltiesUp to $2,190,294 a year per requirement
The inflation-adjusted regulatory maximum for violations of an identical HIPAA requirement in a calendar year. It is not an overall cap across all provisions.
45 CFR 102.3 and 160.404 · In force; no further adjustment for 2026
Federal Register, 28 January 2026
For directors and senior managers
- Criminal liability for concealing a breachConviction, probation and a $50,000 fine
Uber's former chief security officer was convicted in 2022 of concealing a data breach from the FTC and sentenced in May 2023 to three years' probation and a $50,000 fine. The case concerned concealment, not the breach itself.
United States v Joseph Sullivan, N.D. Cal. · Convicted and sentenced
US Department of Justice - Orders that follow the chief executive
The FTC's 2023 order against Drizly personally bound its chief executive to information security obligations for ten years, including at qualifying future businesses, after security failures exposed data about approximately 2.5 million consumers.
In the Matter of Drizly, LLC and James Cory Rellas, FTC File No. 2023185 · Final order, January 2023
FTC statement on the final order - Signed annual certification in New York
Firms regulated by NYDFS must certify material compliance with its cyber security regulation, or acknowledge non-compliance, by 15 April each year, signed by the highest-ranking executive and the CISO.
23 NYCRR 500.17(b) · In force
NYDFS cyber security submissions - Board oversight claims in Delaware
Delaware case law allows director liability for a bad-faith failure to establish board-level reporting and monitoring of mission-critical risk. A cyber incident alone does not establish that failure. The SEC's case against SolarWinds and its CISO was dismissed with prejudice in November 2025.
Marchand v Barnhill, 212 A.3d 805 (Del. 2019); SEC Litigation Release 26423 · Case law
Delaware Supreme Court opinion
Enforcement on the record
Unisys
SEC · October 2024
Settled charges of materially misleading cyber disclosures and disclosure controls failures.
SEC press release 2024-174PayPal
NYDFS · January 2025
Penalty for cyber security regulation failures, including qualified personnel and training, that contributed to customer data being exposed.
NYDFS press releaseWhat is at stake: Australia
For the organisation
- Serious interference with privacyUp to A$50 million, three times the benefit or 30% of turnover
For a body corporate, the maximum civil penalty is the greater of A$50 million, three times the benefit obtained or, where the benefit cannot be determined, 30% of adjusted turnover during the breach period.
Privacy Act 1988, s.13G(3) · In force
Privacy Act 1988, s.13G - Corporations Act civil penaltiesUp to A$18.2 million, three times the benefit or 10% of turnover
The maximum civil penalty for companies is the greater of 50,000 penalty units, three times the benefit obtained and detriment avoided, or 10% of annual turnover capped at 2.5 million penalty units (A$910 million). Licensees can be penalised for failing to manage cyber risk adequately.
Corporations Act 2001; penalty unit A$364 from 1 July 2026 · In force
ASIC fines and penalties
For directors and senior managers
- Civil penalties for directorsUp to A$1.82 million or three times the benefit
The director duty of care and diligence is a civil penalty provision. The maximum civil penalty for an individual is the greater of 5,000 penalty units or three times the benefit obtained and detriment avoided.
Corporations Act 2001, s.180(1) · In force
ASIC fines and penalties - Criminal breaches of directors' dutiesUp to 15 years' imprisonment
The most serious offences, including criminal breaches of directors' duties, false or misleading disclosure and dishonest conduct, carry maximum prison terms of 15 years.
Corporations Act 2001, as strengthened from 13 March 2019 · In force
ASIC fines and penalties
Enforcement on the record
Australian Clinical Labs
Federal Court, on OAIC application · October 2025
The first civil penalties ordered under the Privacy Act, following the 2022 Medlab Pathology breach.
OAIC announcementFIIG Securities
Federal Court, on ASIC application · February 2026
Penalty for cyber security failures, plus A$500,000 towards ASIC's costs and an independent expert compliance programme.
ASIC media releaseMedibank and Optus
OAIC civil penalty proceedings · 2024 and 2025
Proceedings allege failures to protect the personal information of about 9.7 million and 9.5 million people respectively. These are allegations; no penalty had been ordered when this was checked.
OAIC: action against OptusWhat is at stake: Saudi Arabia
For the organisation
- Personal Data Protection Law finesUp to SAR 5 million, doubled for repeat violations
Any private person or entity covered by the Law that breaches it or its Regulations can receive a warning or a fine of up to SAR 5 million. For a repeat violation the fine can be doubled, up to twice that limit.
Saudi Personal Data Protection Law, Article 36 · In force
Bureau of Experts: Personal Data Protection Law
For directors and senior managers
- Disclosing sensitive dataUp to two years and SAR 3 million
Anyone who discloses or publishes sensitive data in breach of the Law, with intent to harm the data subject or for personal benefit, faces imprisonment of up to two years, a fine of up to SAR 3 million, or both.
Saudi Personal Data Protection Law, Article 35, as amended by Royal Decree M/148 · In force
Bureau of Experts: Personal Data Protection Law - Cyber crime offencesUp to four years and SAR 3 million
Unlawful access to damage or disclose private data, disrupting information networks or obstructing services can attract imprisonment of up to four years, a fine of up to SAR 3 million, or either. These are offences for deliberate conduct, not penalties for suffering a breach.
Saudi Anti-Cyber Crime Law, Article 5 · In force
Bureau of Experts: Anti-Cyber Crime Law
What is at stake: Singapore
For the organisation
- PDPA financial penaltiesUp to 10% of Singapore turnover or S$1 million
Where an organisation's annual turnover in Singapore exceeds S$10 million, the maximum financial penalty is 10% of that turnover. For other organisations it is S$1 million.
Personal Data Protection Act 2012, s.48J · In force since 1 October 2022
PDPC enforcement amendments
For directors and senior managers
- Breach of a director's dutyFine up to S$20,000, up to 12 months' imprisonment, or both
A director must act honestly and use reasonable diligence. Breach is an offence and also makes the director liable to the company for any damage suffered or profit made.
Companies Act 1967, s.157(1) and (3) · In force
Companies Act 1967, s.157
Enforcement on the record
SingHealth and IHiS
PDPC · January 2019
Penalties of S$750,000 on IHiS and S$250,000 on SingHealth after the 2018 cyber attack on SingHealth's patient database.
PDPC enforcement decisionWhat is at stake: Canada
For the organisation
- PIPEDA breach-reporting offencesUp to C$100,000
An organisation that knowingly fails to report a breach creating a real risk of significant harm, notify individuals or keep breach records can be fined up to C$10,000 on summary conviction or C$100,000 on indictment.
PIPEDA, ss.10.1, 10.3 and 28 · In force
PIPEDA, s.28 - Quebec privacy penaltiesUp to C$25 million or 4% of worldwide turnover
Administrative penalties reach the greater of C$10 million or 2% of worldwide turnover, including for inadequate security or failing to report a confidentiality incident. Penal fines for specified offences reach the greater of C$25 million or 4%.
Act respecting the protection of personal information in the private sector, ss.90.1, 90.12 and 91 · In force
Commission d'accès à l'information - OSFI administrative monetary penalties
OSFI can impose administrative monetary penalties on federally regulated financial institutions, and where applicable on directors and officers, for designated violations. Its 2025 enforcement approach envisages more frequent penalties.
Office of the Superintendent of Financial Institutions Act; AMP (OSFI) Regulations · In force
OSFI guide to AMPs - Proposed federal privacy law
Bill C-36 would replace PIPEDA's private-sector rules with a new Act overseen by a commission with order-making and penalty powers.
Bill C-36, Protecting Privacy and Consumer Data Act · Proposed, first reading 15 June 2026
Privacy Commissioner statement
For directors and senior managers
- Directors' and officers' duties
Directors and officers must act honestly and in good faith and exercise the care, diligence and skill of a reasonably prudent person. A contract or the articles generally cannot relieve them of that duty or liability for its breach.
Canada Business Corporations Act, s.122(1) and (3) · In force
CBCA, s.122
A summary of selected duties, not legal advice. General director duties are not specific to cyber security, and how any duty applies depends on the organisation, its listing and its regulator. Firevault records can contribute evidence a board reviews. They do not discharge a director duty or make an organisation compliant. Penalty figures are statutory maxima or amounts announced by the regulator or court, not predictions. Whether any penalty or personal liability applies depends on the facts, the provision breached and national law.
How it applies
Translate the words into your environment.
The same framework can mean very different implementation decisions for a hospital, a financial institution or an operational technology network.
01
Data that must stay protected
Keep physically disconnected copies of selected critical information.
Explore the approach02
Access that should not always be connected
Control selected standing network or supplier routes, connected just in time when authorised.
Explore the approach03
A requirement to demonstrate
Connect technical measures to responsibilities, testing and evidence.
Explore the approach01
Third-party ICT connections
Approve when suppliers can reach selected systems, connected just in time and disconnected afterwards.
Explore the approach02
Recovery information
Keep designated recovery information in physically disconnected storage.
Explore the approach03
Operational resilience
Map technical implementation to ICT risk and testing obligations.
Explore the approach01
Sensitive records
Separate selected patient and care information from constant network exposure.
Explore the approach02
Supplier access
Give external technical teams just-in-time pathways when authorised.
Explore the approach03
Service continuity
Protect recovery material and plan for restoration.
Explore the approach01
Data that must stay protected
Keep physically disconnected copies of selected critical information.
Explore the approach02
Access that should not always be connected
Control selected standing network or supplier routes, connected just in time when authorised.
Explore the approach03
A requirement to demonstrate
Connect technical measures to responsibilities, testing and evidence.
Explore the approach01
Remote engineering
Control vendor maintenance routes into OT systems, connected just in time for an approved window.
Explore the approach02
Industrial boundaries
Remove standing reachability across selected IT and OT paths.
Explore the approach03
Offline operating records
Separate key engineering information and recovery copies.
Explore the approach01
Remote engineering
Control supplier and engineering routes into controllers and PLCs, connected just in time.
Explore the approach02
Industrial boundaries
Remove standing reachability between enterprise and production networks.
Explore the approach03
Offline engineering records
Separate configurations, programs and recovery copies.
Explore the approach01
Data that must stay protected
Keep physically disconnected copies of selected critical information.
Explore the approach02
Access that should not always be connected
Control selected standing network or supplier routes, connected just in time when authorised.
Explore the approach03
A requirement to demonstrate
Connect technical measures to responsibilities, testing and evidence.
Explore the approach01
Data that must stay protected
Keep physically disconnected copies of selected critical information.
Explore the approach02
Access that should not always be connected
Control selected standing network or supplier routes, connected just in time when authorised.
Explore the approach03
A requirement to demonstrate
Connect technical measures to responsibilities, testing and evidence.
Explore the approach01
Data that must stay protected
Keep physically disconnected copies of selected critical information.
Explore the approach02
Access that should not always be connected
Control selected standing network or supplier routes, connected just in time when authorised.
Explore the approach03
A requirement to demonstrate
Connect technical measures to responsibilities, testing and evidence.
Explore the approach01
Model and agent oversight
Model, agent and supplier pathways are approved, connected just in time and closed afterwards, so a designated person can interrupt a system before it acts on data.
Explore the approach02
Training data and evaluation records
Copies of the data and evaluation records behind a model are held physically disconnected, with each access session recorded.
Explore the approach03
A cut that can be pointed to
A hardware cut applied to AI systems, with the record a board or regulator would ask for.
Explore the approach01
Controlled information copies
Copies of controlled information are held offline at a storage location that is not reachable from the production path.
Explore the approach02
Supplier maintenance routes
Vendor access to engineering and support systems is authorised for a window and disconnected afterwards.
Explore the approach03
Evidence for assessment
Approvals, retrievals and session records are kept in one place for assessment.
Explore the approach01
Operations and ground systems
Recovery copies for the systems behind flight operations, ground handling and passenger processing.
Explore the approach02
Supplier and maintenance pathways
Vendor routes into operational systems are opened for an approved window and closed afterwards.
Explore the approach03
Continuity at the hub
A disconnected copy that can be restored without depending on the corporate network.
Explore the approach01
Ship and port systems
Configuration and operating records for navigation, port and terminal systems held offline.
Explore the approach02
Shore to ship pathways
Connections between shore systems and ships are authorised per window rather than left available.
Explore the approach03
Offline operating records
Engineering and recovery copies separated from the connected network.
Explore the approach01
Competitive and telemetry data
Copies of design, telemetry and operational data held physically disconnected.
Explore the approach02
Factory and garage boundaries
Standing reachability between enterprise and garage systems removed, replaced by approved windows.
Explore the approach03
Event continuity
A recovery copy that can be retrieved at an event without the factory network.
Explore the approach01
Field and plant control systems
Configuration and operating records for control systems held offline and restored on approval.
Explore the approach02
Vendor maintenance routes
Contractor pathways into plant systems opened for an approved window and disconnected afterwards.
Explore the approach03
Offline operating records
Engineering, safety and recovery copies separated from the connected network.
Explore the approachThe distinction matters
Control the path. Protect the asset.
Control governs the physical network paths that exist and who may use them, connecting them just in time when authorised. Offline Secure Storage® protects selected information and recovery copies by keeping them physically disconnected when access is not needed. They solve different problems and may be used together.
Evidence and responsibility
Technology helps. Governance proves.
No product makes an organisation compliant by itself. Policy, scope, implementation, operating procedures, testing and evidence remain essential.
Firevault’s own certifications are separate from your obligations under the frameworks shown here. Firevault holds Cyber Essentials Plus; confirm current status, scope and validity with Firevault before relying on it.
Define
Identify the requirement, the responsible owner and the systems or information in scope.
Implement
Choose and document the relevant technical and organisational measures.
Demonstrate
Test operation, retain appropriate evidence and review changes over time.
What your assessor receives
For Offline Secure Storage®, the evidence pack contains:
- Access audit logsWho opened which vault, when, from where and for how long.
- Encryption attestationEncryption and key custody, stated in writing.
- Provisioning recordsIdentity verification completed before access.
- Classification scheduleWhat is held offline, by data class, and why.
- Retrieval testsEvidence that recovery works, with measured timelines.
- Control statementsWording per framework for your own submission.
Guidance
Briefings for your assessment.
Plain-English guides to the standards assessors and insurers ask about most.
GuideNCSC cloud backup principlesWhat the NCSC asks of ransomware-resistant cloud backup, and where Firevault contributes.- BriefingPhysical disconnection and UK GDPRHow a physically disconnected copy supports security of processing.
- BriefingNIST SP 800-82r3 OT backupBackup and recovery expectations for operational technology.
- BriefingThe 3-2-1-0 insurer standardWhat insurers increasingly expect from backup copies.
Your next step
Which requirement is hardest to prove?
Talk us through your framework, your infrastructure and the controls you need to demonstrate. We can discuss where offline storage and physical connection control are relevant.
Speak to the team