Used before Incident response ready and Security release approval, to confirm the work of Security Release is done, its work products are at the right maturity and its decisions are recorded. Run by the stage leads and checked by the product security owner.
MustDone: review the traceability matrix, evaluation reports and security errata list, and confirm every requirement is verified or its risk accepted by the security owner.
MustDone: sign production firmware images with production keys through the signing service under dual control and verify signatures on production parts.
MustDone: generate the software bill of materials in the build pipeline and add statements for known vulnerabilities that do not affect the product.
MustDone: prepare the conformity evidence and the declaration of conformity where regulation requires it, and confirm export classification and any licences for the first destinations.
MustDone: issue the secure integration guide.
key handling, provisioning options, lifecycle states, secure boot configuration, transferred risks and security errata.
MustDone: state the security support period to customers, publish the disclosure policy and reporting channel, rehearse the incident response procedure and name the product contacts.
42 more items for registered members.
The full lifecycle detail, with its charts, flows, tables and every section, is for registered members. Registration is free and takes a minute. You come back to this page afterwards.