Confirms the firmware security review, signing service, key management, update design and vulnerability handling are in place. The gate chair runs it with the product security architect.
MustThe evidence pack reached every participant early enough to be read before the review.
MustThe people with decision rights for this gate are present or have named a delegate in writing.
MustConditions set at the previous gate are closed, or their status is reported with evidence.
ShouldThe criteria for this gate were agreed before the evidence was prepared, not after.
MustThe security review of the boot ROM, boot loaders and firmware against the threat model is complete, and every finding is closed or accepted by the security owner.
33 more items for registered members.
The full lifecycle detail, with its charts, flows, tables and every section, is for registered members. Registration is free and takes a minute. You come back to this page afterwards.