How security support ends in an orderly way: announcing the end of security support with enough notice, issuing the final security update and advisory, guiding customers to supported products, retiring production keys and certificates safely and archiving security records. It is written for the security owner, incident response, supply chain security and customer teams.

1. Purpose and scope

Ending security support is a commitment as much as providing it. Customers need to know in time when updates will stop, what remains unfixed and where to move. Devices in the field will outlive the support, so the final state of the product, and what can still be done in an emergency, must be decided deliberately.

Keys and trust infrastructure need special care. Production signing keys and the device certificate authority are powerful assets: kept, they could be misused; destroyed, they rule out any future signed fix. The stage decides which applies, carries it out under witness and records it, and archives what is needed to answer questions about shipped devices.

In scope: the end-of-security-support notice, customer migration guidance, the final security update and advisory, key and certificate retirement and the security archive. Out of scope: the end of product supply, which belongs to the product and SoC lifecycles.

14 more sections for registered members.

Register or sign in to read on

The full lifecycle detail, with its charts, flows, tables and every section, is for registered members. Registration is free and takes a minute. You come back to this page afterwards.