---
title: "Validate Module Integrity Checks | Firevault"
url: https://fire-vault.com/control-module/validate
description: "Validate confirms identity, authority and purpose before a path opens, an action runs or a protected asset moves."
lang: en-GB
---

**FV-05 Validate**Control module · Protect the asset

# Check who, why and with what authority. Before anything changes.

Validate confirms identity, authority and purpose before a path opens, an action runs or a protected asset moves. If any check fails, nothing changes, and the attempt is recorded.

Book a Control demo: https://fire-vault.com/demo
See it in action

Image: Validate module icon (https://fire-vault.com/__l5e/assets-v1/5d8c74f5-5e5c-44ef-8759-b3d63718e0e9/validate-icon.png)
**Validate**Protect the asset

Module

FV-05 Validate

Family

Protect the asset

The question it answers

Should this request be allowed?

Checks

Identity, authority, purpose

If a check fails

Nothing changes

What happens when

## The password was correct. The person was not.

Most access decisions rest on one thing: a login that works. Stolen logins work too.

1. Monday**A login is stolen.**
   A convincing email captures an administrator password.
2. Tuesday**A request is made.**
   Someone asks to open a path to the finance network. The password is accepted.
3. Wednesday**Nobody asked why.**
   There was no check of authority or purpose, so the request looked normal.

A password proves someone has it. Validate checks they should be doing this.

See it in action

## One request. Switch between a password check and Validate.

The same request to open a path to finance, handled two ways.

A correct password is enough to open the path.

Identity, authority and purpose are each checked. If any fails, the path stays as it is.

Step by step

1. Step 1**Request**
   A person or system asks for a change.
2. Step 2**Identity**
   Confirm who is asking, beyond a password.
3. Step 3**Authority and purpose**
   Confirm they may ask, and that the reason matches an approved purpose.
4. Step 4**Allow or refuse**
   The change happens only if every check passes. Both outcomes are recorded.

What Validate is

## A gate in front of every change.

Validate sits before Relay, Execute and Transfer, so nothing opens or moves on a password alone.

- **Identity**
  Who is asking, confirmed in more than one way.
- **Authority**
  Whether that person may request this change.
- **Purpose**
  Whether the reason matches an approved purpose.

What it changes

## Stolen logins are not enough.

Validate does not stop credentials being stolen. It stops a stolen credential being the only thing needed.

### Every change has a reason and an owner.

- Changes need identity, authority and purpose
- Failed checks change nothing
- Refusals are recorded as well as approvals
- Auditors see who asked, why and who allowed it

Where it fits

## Fracture, Isolate and Validate answer different questions.

Fracture and Isolate decide whether connections exist. Validate does a different job, and most Plans use more than one module.

| Module | Fracture | Isolate | Validate |
| --- | --- | --- | --- |
| The question it answers | Must this connection be physically disconnected now? | Which zones should never share a path? | Should this request be allowed, by this person, for this reason? |
| Normal state | Connected, with a crossing ready to be disconnected | Zones held apart, crossings closed by default | Every request checked before any change |
| When it acts | When a connection becomes dangerous | By design, before anything goes wrong | Before a path opens, an action runs or an asset moves |
| What it ends | An incident travelling along a live path | Trust that exists only because systems share a network | Changes made on the strength of a password alone |
| Typical Plans | CP-01, CP-02 | CP-04, CP-05, CP-14 | CP-06, CP-12, CP-20 |

Control Plans and Blueprints

## Where Validate does the work.

Validate is the check behind access, assurance and multi-party Plans. Plans marked Proposed are awaiting technical approval.

- CP-06**Controlled Access & Assurance**_Connect approvals and observed control states to agreed record sources, with collection and retention defined for the actions in scope._: https://fire-vault.com/control-plan/prove-compliance-through-control
- CP-12**Privileged Access Control**_Administrator access through a controlled network entry point._: https://fire-vault.com/control-plan/privileged-access-control
- CP-20**Multi-Party Authorisation**_Two independent approvals required before a connection opens._: https://fire-vault.com/control-plan/multi-party-authorisation
- CP-03**Third-Party Access Control**_Supplier and vendor paths that exist only for approved work, in a defined window._: https://fire-vault.com/control-plan/control-third-party-access
- **Control Plans**Twenty Plans, each solving one problem. All Control Plans (https://fire-vault.com/control-plans)
- **Control Blueprints**Industry solutions that combine Plans. All Control Blueprints (https://fire-vault.com/control-blueprints)
- **Fracture**Physically disconnect a connection. See Fracture (https://fire-vault.com/control-module/fracture)
- **Isolate**Hold zones apart by design. See Isolate (https://fire-vault.com/control-module/isolate)

Questions

## What network and security teams ask.

Want to see it on real hardware? We will show you.

Book a Control demo: https://fire-vault.com/demo

Does Validate replace our identity provider?

No. It uses the identity sources you already have and adds checks of authority and purpose before a Control change.

How is Validate different from Fracture and Isolate?

Fracture and Isolate work on connections. Validate decides whether a requested change should be allowed at all.

Can it require more than one approver?

Yes, where the risk warrants it. This is agreed per path or action.

What happens when a check fails?

Nothing changes, and the attempt is recorded.

Your next step

## See a request checked in front of you.

We will show a request allowed, and the same request refused, with the record for both.

Firevault home (https://fire-vault.com/)

Offline Secure Storage® and Control.

A UK cyber resilience company. Data protection and storage through Offline Secure Storage®. Network evolution and rapid protection through Control.

Firevault on LinkedIn: https://www.linkedin.com/company/firevault-limited
Firevault on Facebook: https://www.facebook.com/Firevaultltd/
Firevault on YouTube: https://www.youtube.com/@Firevault-ltd

Verify Firevault Cyber Essentials and Cyber Essentials Plus certification on the NCSC register: https://registry.blockmarktech.com/certificates/

© 2026 Firevault Limited Company No. 16320803 VAT No. 490 8551 64 Registered in England and Wales

## Structured data

```json
[
  {
    "@context": "https://schema.org",
    "@type": "Organization",
    "@id": "https://fire-vault.com/#organization",
    "name": "Firevault",
    "legalName": "Firevault Limited",
    "url": "https://fire-vault.com",
    "logo": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/logo.png",
      "width": 200,
      "height": 60
    },
    "foundingDate": "2025-03",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "address": {
      "@type": "PostalAddress",
      "addressCountry": "GB",
      "addressLocality": "United Kingdom"
    },
    "contactPoint": [
      {
        "@type": "ContactPoint",
        "contactType": "customer service",
        "email": "hello@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      },
      {
        "@type": "ContactPoint",
        "contactType": "sales",
        "email": "sales@fire-vault.com",
        "availableLanguage": "English",
        "areaServed": [
          "GB",
          "EU",
          "US",
          "AE"
        ]
      }
    ],
    "founder": [
      {
        "@type": "Person",
        "name": "Mark Fermor",
        "jobTitle": "Founder, CTO and CMO"
      },
      {
        "@type": "Person",
        "name": "David Bailey",
        "jobTitle": "Founder and CEO"
      }
    ],
    "areaServed": [
      "United Kingdom",
      "Europe",
      "United States",
      "Middle East"
    ],
    "sameAs": [
      "https://www.linkedin.com/company/firevault",
      "https://x.com/firevaultuk"
    ],
    "slogan": "Disconnect to Protect",
    "brand": [
      {
        "@type": "Brand",
        "name": "Offline Secure Storage"
      },
      {
        "@type": "Brand",
        "name": "Control by Firevault"
      },
      {
        "@type": "Brand",
        "name": "Firebreak"
      }
    ],
    "knowsAbout": [
      "Offline Secure Storage",
      "Physically disconnected data storage",
      "Physical Air Gap Data Protection",
      "Ransomware Protection",
      "Ransomware recovery",
      "3-2-1-1-0 backup rule",
      "AI kill switch",
      "Operational technology security",
      "Critical national infrastructure resilience",
      "Data Sovereignty",
      "GDPR Compliance",
      "NIS2 Compliance",
      "DORA Compliance",
      "NCSC Cyber Assessment Framework"
    ]
  },
  {
    "@context": "https://schema.org",
    "@type": "WebSite",
    "@id": "https://fire-vault.com/#website",
    "name": "Firevault",
    "alternateName": [
      "Firevault",
      "Firevault UK",
      "Firevault Limited"
    ],
    "url": "https://fire-vault.com",
    "publisher": {
      "@id": "https://fire-vault.com/#organization"
    },
    "inLanguage": "en-GB",
    "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}"
      },
      "query-input": "required name=search_term_string"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "WebPage",
    "@id": "https://fire-vault.com/control-module/validate#webpage",
    "url": "https://fire-vault.com/control-module/validate",
    "name": "Validate Module Integrity Checks",
    "description": "Validate confirms identity, authority and purpose before a path opens, an action runs or a protected asset moves.",
    "isPartOf": {
      "@id": "https://fire-vault.com/#website"
    },
    "about": {
      "@id": "https://fire-vault.com/#organization"
    },
    "primaryImageOfPage": {
      "@type": "ImageObject",
      "url": "https://fire-vault.com/__l5e/assets-v1/2fd030ed-294d-42ea-af3d-5429b7dc0062/og-control-validate.webp"
    },
    "inLanguage": "en-GB",
    "breadcrumb": {
      "@id": "https://fire-vault.com/control-module/validate#breadcrumb"
    }
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "@id": "https://fire-vault.com/control-module/validate#breadcrumb",
    "itemListElement": [
      {
        "@type": "ListItem",
        "position": 1,
        "name": "Home",
        "item": "https://fire-vault.com"
      },
      {
        "@type": "ListItem",
        "position": 2,
        "name": "Control Module",
        "item": "https://fire-vault.com/control-module"
      },
      {
        "@type": "ListItem",
        "position": 3,
        "name": "Validate Module Integrity Checks",
        "item": "https://fire-vault.com/control-module/validate"
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@graph": [
      {
        "@type": "Organization",
        "@id": "https://fire-vault.com/#org",
        "name": "Firevault",
        "legalName": "Firevault Limited",
        "url": "https://fire-vault.com/",
        "identifier": "16320803",
        "sameAs": [
          "https://www.linkedin.com/company/firevault-limited",
          "https://www.facebook.com/Firevaultltd/",
          "https://www.youtube.com/@Firevault-ltd"
        ]
      },
      {
        "@type": "WebPage",
        "name": "FV-Validate: The check before the consequence",
        "url": "https://fire-vault.com/control-module/validate",
        "description": "Validate is the deliberate pause between asking and acting. It checks whether a request, command or approval should proceed before access is granted, before an action is executed and before a transfer leaves the protected environment.",
        "publisher": {
          "@id": "https://fire-vault.com/#org"
        }
      },
      {
        "@type": "BreadcrumbList",
        "itemListElement": [
          {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://fire-vault.com/"
          },
          {
            "@type": "ListItem",
            "position": 2,
            "name": "FV-Validate",
            "item": "https://fire-vault.com/control-module/validate"
          }
        ]
      },
      {
        "@type": "FAQPage",
        "mainEntity": [
          {
            "@type": "Question",
            "name": "Is Validate just another permissions check?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "No. Permissions are one input. Validate weighs identity, authority, policy and context together, checks whether a required approval exists and is still valid, and does it before the consequence rather than afterwards."
            }
          },
          {
            "@type": "Question",
            "name": "What happens when a check is refused?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "The action does not proceed, and the outcome comes with its rationale. The requester is informed, the policy owner is notified, and the check is recorded through Anchor."
            }
          },
          {
            "@type": "Question",
            "name": "Can Validate be bypassed in an emergency?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "Emergency access is handled as its own governed pattern, such as a time-bound Relay session with multi-party approval and full audit, so the check is not silently skipped."
            }
          },
          {
            "@type": "Question",
            "name": "Where does Validate sit relative to the application?",
            "acceptedAnswer": {
              "@type": "Answer",
              "text": "Ahead of the consequence: before access is granted, before an action is executed and before a transfer leaves the protected environment, using read paths the system being checked cannot silence."
            }
          }
        ]
      }
    ]
  }
]
```