1. Purpose
This procedure turns the security overlay into work a project can plan, perform and prove: how to run its practices in order, who does what, and what evidence each phase leaves so that a reviewer, customer or evaluator can trust the result.
The adversary adapts, and many hardware weaknesses cannot be fixed after manufacture. So the procedure starts at planning, revisits the threat model whenever the design changes, and carries obligations into the field until support ends.
9 more sections for registered members.