Real-time monitoring and control of thermal loads on tungsten plasma-facing components is mandatory for ITER to avoid their overheating during plasma discharges. For the Start of Research Operations (SRO) phase, dedicated First Wall Heat Load Control (FWHLC) functions are included in the ITER Plasma Control System (PCS) to prevent the development of excessive plasma heat loads on the inertially cooled first wall (FW). In this work, we propose a FWHLC design with a model-based approach, which features a simplified thermal model for the FW armour. This control-oriented model simulates the thermal response of ITER FW to slow changes in plasma equilibrium and energy, which during ITER operation will be monitored by the real-time wide angle infrared camera system. This allows computationally efficient runs for rapid controller performance assessment but can also assist operation scenario design by pre-empting potential heat load issues. FWHLC is designed to react to measured and predicted FW temperatures overcoming predesigned limits with real-time variations of the plasma shape or auxiliary power references, aiming to reduce thermal loads before a premature plasma termination is required to protect the FW. The new scheme is tested in closed loop simulations, where perturbations to nominal ITER low current scenarios are introduced in the wall thermal model to trigger the response of FWHLC, supporting the effectiveness of the proposed policy.