Firevault, offline secure storage, physically disconnected from the internet
Pricing

Control module · Vault layer

FV-Validate. The check before the consequence.

Validate is the deliberate pause between asking and acting. It checks whether a request, command or approval should proceed before access is granted, before an action is executed and before a transfer leaves the protected environment.

As featured in

  • TechRadar Pro logo
  • Yahoo Finance logo
  • Channel Insider logo
  • Security Buyer logo
  • SecurityBrief logo

The problem

A check after the action is a report.

A check after the action is a report. A check before the action is a control.

  1. Checks run before the consequence, rather than as a review afterwards.

  2. The same situation is judged by the same standards, whoever submits it.

  3. Identity, authority, policy and context are weighed together.

Problem 1

Validation after the fact.

Reviewing whether a request should have been allowed only after the consequence has occurred is a poor substitute for checking first.

Answered byPre-action checks

Problem 2

Inconsistent criteria.

When the answer depends on who evaluates the request, the same situation can be approved on Monday and refused on Tuesday.

Answered byConsistent criteria

The scenario

Scenario:
A sensitive transfer that is questioned first.

Validate is the moment where good intent meets honest scrutiny, and the system is the better for both. Step through it, or play it through.

Step 1 of 4

Request

A request is raised to transfer a sensitive dataset out of a protected environment.

Illustration.

Pre-action
Checks complete before the consequence is incurred
Multi-factor
Identity, authority, policy and context evaluated together
Recorded
Outcome and rationale captured for every check
Consistent
The same criteria apply regardless of who is asking

Placement

Where Validate proves the boundary still holds.

Validate is the continuous, evidenced check that what should be severed is severed, what should be open is open, and what was stored is what was stored. Grounded in NIST CSF DE.CM and ID.GV-4, ISO 27001 A.8.16 Monitoring Activities and IEC 62443-3-3 SR 6.1, SR 6.2.

Relies on

  • Read paths that cannot be silenced by the system being checked
  • Cryptographic signing of attestations
  • An immutable place to keep the evidence

Pairs with

FV-Validate works alongside Firebreak, Isolate, Archive and Execute. Firebreak® hardware is manufactured by Firevault.

IEC 62443 SR 6.1

Conduit state attestation

Continuously confirms that each governed conduit is in its expected state, with cryptographic evidence.

ISO 27001 A.8.16

Offline Secure Storage integrity

Scheduled integrity checks across Offline Secure Storage copies, wherever they reside. Bit-rot, tamper and silent failure on archived recovery sets surface long before you need to restore from them.

Physically disconnected Offline Secure Storage: server, three drives and a padlock

NIST CSF DE.CM-1

Change verification

Every Execute action is followed by a verification that the intended state was actually reached.

NIST CSF ID.GV-4

Compliance evidence generation

Generates a continuous evidence trail aligned to IEC 62443, NIS2 and ISO 27001 control statements.

Capabilities

What you get with every deployment.

Six things FV-Validate gives a security team, from the first decision to the audit afterwards.

FV-Validate

Pre-action checks

Checks run before the consequence, rather than as a review afterwards.

FV-Validate

Multi-factor evaluation

Identity, authority, policy and context are weighed together.

FV-Validate

Consistent criteria

The same situation is judged by the same standards, whoever submits it.

FV-Validate

Approval awareness

Whether a required approval exists and is still valid is part of the check.

FV-Validate

Returned rationale

Outcomes come with reasoning, so requesters understand the decision.

FV-Validate

Evidential record

Each check and its rationale are written through Archive to physically separate storage.

Adoption guide

From first workflow to routine operation.

Four steps, piloted on one workflow before it extends across the estate.

  1. 1

    Identify the consequential actions

    List the access, actions and transfers where an upfront check matters most.

  2. 2

    Define the criteria

    Agree which identity, authority, policy and context to evaluate for each.

  3. 3

    Pilot the check

    Place Validate ahead of one workflow end to end, returning rationale and recording evidence.

  4. 4

    Extend across the estate

    Move more workflows onto Validate and review outcomes through Archive regularly.

Playbooks

Which playbook covers this module.

Each playbook shows where this module sits in a real deployment, who authorises it and how a pilot scales into rollout.

A Control Blueprint for AI: 2026 Playbook

Explains how checks apply to requests from agents and automated pipelines before an action proceeds.

Read the playbook

A Control Blueprint for Aerospace and Aviation

Covers approval checks on configuration, data release and maintenance where airworthiness evidence is at stake.

Read the playbook

The Leaders’ Playbook

Gives boards questions about who authorises what, and what evidence comes back.

Read the playbook

All playbooks

Questions

Frequently asked about Validate

No. Permissions are one input. Validate weighs identity, authority, policy and context together, checks whether a required approval exists and is still valid, and does it before the consequence rather than afterwards.

The action does not proceed, and the outcome comes with its rationale. The requester is informed, the policy owner is notified, and the check is recorded through Archive.

Emergency access is handled as its own governed pattern, such as a time-bound Relay session with multi-party approval and full audit, so the check is not silently skipped.

Ahead of the consequence: before access is granted, before an action is executed and before a transfer leaves the protected environment, using read paths the system being checked cannot silence.

All questions

Decide what stays connected.

We will walk your architecture, show where FV-Validate sits on each path, and the evidence it leaves behind.