Chip lifecycle / Security lifecycle / End of Security Support

End of Security Support

Ending security support in an orderly way: announcing the end of security support with enough notice, issuing the final security update and advisory, guiding customers to supported products, retiring production keys and certificates safely and archiving the security records for as long as they must be kept.

Where this stage sits

This stage with its neighbours. Each row is a discipline active here, shaded by how mature its work is by the end of each stage.

Stage

^D11 Vulnerability Reporting & Response

^A12 Security Updates & Maintenance

^A13 End of Security SupportYou are here

Product and assurance milestones

SSSecurity support review ENEnd of security support notice EOEnd of security support

Security engineering milestones

PRIncident response ready RASecurity release approval RRIncident response review URSecurity update released

Product security management^A

1.0

Threat analysis and risk assessment^A

1.0^O

Security firmware and secure boot^D

1.0

Security evaluation and penetration testing^O

1.0^O

Supply chain security and provisioning^A

1.0

Certification and assurance^A

1.0

Regulatory and export compliance^A

1.0

Product security incident response^D

1.0

Security updates and release^A

1.0

Customer security enablement^A

1.0

Key0.0Planned0.3Outlined0.5Analysed0.8Feature complete1.0CompleteFreezeFrozenFaded block: still at the step shown before it, Held below Complete or Maintained under change control once complete or frozenFreeze or sign-off pointMilestone for one item; the rest of the work carries onMilestone gateYou are here: End of Security SupportAI impactDisruption (red)Augmentation (blue)Opportunity (green)How AI is changing the workWhat the steps mean What the codes mean

Show this chart as a list

Stages

Product and assurance milestones

Security engineering milestones

Disciplines

Product security management^A
- Vulnerability Reporting & Response: maturity 1.0, Complete. Security release approved with every residual risk accepted by its named owner; security support planned to the end of support.
- Security Updates & Maintenance: maturity 1.0, Complete. Security release approved with every residual risk accepted by its named owner; security support planned to the end of support.
- End of Security Support: maturity 1.0, Complete. Security release approved with every residual risk accepted by its named owner; security support planned to the end of support.
Threat analysis and risk assessment^A
- Vulnerability Reporting & Response: maturity 1.0, Complete. Every threat traced to a passing test or an accepted residual risk at the tape-out sign-off; the model is then kept current from silicon findings and field reports.^O
Security firmware and secure boot^D
- Vulnerability Reporting & Response: maturity 1.0, Complete. Boot ROM code final and verified for the masks and security firmware verified; afterwards the lane maintains the firmware and writes the fixes that updates deliver.
- Security Updates & Maintenance: maturity 1.0, Complete. Boot ROM code final and verified for the masks and security firmware verified; afterwards the lane maintains the firmware and writes the fixes that updates deliver.
Security evaluation and penetration testing^O
- Vulnerability Reporting & Response: maturity 1.0, Complete. Silicon attacked as planned and every weakness fixed, mitigated or recorded as errata; afterwards the lane supports the laboratory and reproduces reported vulnerabilities.^O
Supply chain security and provisioning^A
- Vulnerability Reporting & Response: maturity 1.0, Complete. Secure provisioning qualified at every production site with production keys; then run in production and finally used to retire keys and certificates.
- Security Updates & Maintenance: maturity 1.0, Complete. Secure provisioning qualified at every production site with production keys; then run in production and finally used to retire keys and certificates.
- End of Security Support: maturity 1.0, Complete. Secure provisioning qualified at every production site with production keys; then run in production and finally used to retire keys and certificates.
Certification and assurance^A
- Vulnerability Reporting & Response: maturity 1.0, Complete. Certificates or assessment results issued for each scheme in the plan; then kept valid through updates and product changes.
- Security Updates & Maintenance: maturity 1.0, Complete. Certificates or assessment results issued for each scheme in the plan; then kept valid through updates and product changes.
Regulatory and export compliance^A
- Vulnerability Reporting & Response: maturity 1.0, Complete. Security conformity declared where regulation requires it at the security release; reporting obligations then kept in the field.
- Security Updates & Maintenance: maturity 1.0, Complete. Security conformity declared where regulation requires it at the security release; reporting obligations then kept in the field.
- End of Security Support: maturity 1.0, Complete. Security conformity declared where regulation requires it at the security release; reporting obligations then kept in the field.
Product security incident response^D
- Vulnerability Reporting & Response: maturity 1.0, Complete. Incident response ready before the security release, with the disclosure policy published and the team staffed; then reports are triaged, fixed and disclosed until end of support.
- Security Updates & Maintenance: maturity 1.0, Complete. Incident response ready before the security release, with the disclosure policy published and the team staffed; then reports are triaged, fixed and disclosed until end of support.
- End of Security Support: maturity 1.0, Complete. Incident response ready before the security release, with the disclosure policy published and the team staffed; then reports are triaged, fixed and disclosed until end of support.
Security updates and release^A
- Vulnerability Reporting & Response: maturity 1.0, Complete. Software bill of materials published and update delivery proven at the security release; then each security update is signed and released.
- Security Updates & Maintenance: maturity 1.0, Complete. Software bill of materials published and update delivery proven at the security release; then each security update is signed and released.^A
- End of Security Support: maturity 1.0, Complete. Software bill of materials published and update delivery proven at the security release; then each security update is signed and released.
Customer security enablement^A
- Vulnerability Reporting & Response: maturity 1.0, Complete. Secure integration guide released to customers at the security release; then notices, support and migration guidance until end of support.
- Security Updates & Maintenance: maturity 1.0, Complete. Secure integration guide released to customers at the security release; then notices, support and migration guidance until end of support.
- End of Security Support: maturity 1.0, Complete. Secure integration guide released to customers at the security release; then notices, support and migration guidance until end of support.

Register or sign in to read on

The full lifecycle detail, with its charts, flows, tables and every section, is for registered members. Registration is free and takes a minute. You come back to this page afterwards.