Chip lifecycle / Security lifecycle / Security Release

Security Release

Approving the product for shipment from a security point of view: every security requirement verified or its risk accepted, certificates and declarations in place, production keys and provisioning running, the software bill of materials published, the secure integration guide issued to customers and the incident response process ready before the first part ships.

Where this stage sits

This stage with its neighbours. Each row is a discipline active here, shaded by how mature its work is by the end of each stage.

Stage

^D09 Certification & Assurance

^A10 Security ReleaseYou are here

^D11 Vulnerability Reporting & Response

Product and assurance milestones

ESEvaluation evidence submitted CECertification achieved

Security engineering milestones

PQSecure provisioning qualified PRIncident response ready RASecurity release approval RRIncident response review URSecurity update released

Product security management^A

0.8

1.0

Threat analysis and risk assessment^A

1.0

Security firmware and secure boot^D

1.0

Security evaluation and penetration testing^O

1.0

Supply chain security and provisioning^A

1.0

Certification and assurance^A

1.0^D

Regulatory and export compliance^A

0.8

1.0

Product security incident response^D

0.8

1.0

Security updates and release^A

0.8

1.0

Customer security enablement^A

0.8

1.0^A

Key0.0Planned0.3Outlined0.5Analysed0.8Feature complete1.0CompleteFreezeFrozenFaded block: still at the step shown before it, Held below Complete or Maintained under change control once complete or frozenFreeze or sign-off pointMilestone for one item; the rest of the work carries onMilestone gateYou are here: Security ReleaseAI impactDisruption (red)Augmentation (blue)Opportunity (green)How AI is changing the workWhat the steps mean What the codes mean

Show this chart as a list

Stages

Product and assurance milestones

Security engineering milestones

Disciplines

Product security management^A
- Certification & Assurance: maturity 0.8, Feature complete. Security case complete for tape-out: every review before silicon held and the residual risks argued; silicon, provisioning and certification evidence awaited.
- Security Release: maturity 1.0, Complete. Security release approved with every residual risk accepted by its named owner; security support planned to the end of support.
- Vulnerability Reporting & Response: maturity 1.0, Complete. Security release approved with every residual risk accepted by its named owner; security support planned to the end of support.
Threat analysis and risk assessment^A
- Certification & Assurance: maturity 1.0, Complete. Every threat traced to a passing test or an accepted residual risk at the tape-out sign-off; the model is then kept current from silicon findings and field reports.
- Security Release: maturity 1.0, Complete. Every threat traced to a passing test or an accepted residual risk at the tape-out sign-off; the model is then kept current from silicon findings and field reports.
- Vulnerability Reporting & Response: maturity 1.0, Complete. Every threat traced to a passing test or an accepted residual risk at the tape-out sign-off; the model is then kept current from silicon findings and field reports.^O
Security firmware and secure boot^D
- Certification & Assurance: maturity 1.0, Complete. Boot ROM code final and verified for the masks and security firmware verified; afterwards the lane maintains the firmware and writes the fixes that updates deliver.
- Security Release: maturity 1.0, Complete. Boot ROM code final and verified for the masks and security firmware verified; afterwards the lane maintains the firmware and writes the fixes that updates deliver.
- Vulnerability Reporting & Response: maturity 1.0, Complete. Boot ROM code final and verified for the masks and security firmware verified; afterwards the lane maintains the firmware and writes the fixes that updates deliver.
Security evaluation and penetration testing^O
- Certification & Assurance: maturity 1.0, Complete. Silicon attacked as planned and every weakness fixed, mitigated or recorded as errata; afterwards the lane supports the laboratory and reproduces reported vulnerabilities.
- Security Release: maturity 1.0, Complete. Silicon attacked as planned and every weakness fixed, mitigated or recorded as errata; afterwards the lane supports the laboratory and reproduces reported vulnerabilities.
- Vulnerability Reporting & Response: maturity 1.0, Complete. Silicon attacked as planned and every weakness fixed, mitigated or recorded as errata; afterwards the lane supports the laboratory and reproduces reported vulnerabilities.^O
Supply chain security and provisioning^A
- Certification & Assurance: maturity 1.0, Complete. Secure provisioning qualified at every production site with production keys; then run in production and finally used to retire keys and certificates.
- Security Release: maturity 1.0, Complete. Secure provisioning qualified at every production site with production keys; then run in production and finally used to retire keys and certificates.
- Vulnerability Reporting & Response: maturity 1.0, Complete. Secure provisioning qualified at every production site with production keys; then run in production and finally used to retire keys and certificates.
Certification and assurance^A
- Certification & Assurance: maturity 1.0, Complete. Certificates or assessment results issued for each scheme in the plan; then kept valid through updates and product changes.^D
- Security Release: maturity 1.0, Complete. Certificates or assessment results issued for each scheme in the plan; then kept valid through updates and product changes.
- Vulnerability Reporting & Response: maturity 1.0, Complete. Certificates or assessment results issued for each scheme in the plan; then kept valid through updates and product changes.
Regulatory and export compliance^A
- Certification & Assurance: maturity 0.8, Feature complete. Technical documentation complete apart from the certificates; export licences in place or applied for the first destinations.
- Security Release: maturity 1.0, Complete. Security conformity declared where regulation requires it at the security release; reporting obligations then kept in the field.
- Vulnerability Reporting & Response: maturity 1.0, Complete. Security conformity declared where regulation requires it at the security release; reporting obligations then kept in the field.
Product security incident response^D
- Certification & Assurance: maturity 0.8, Feature complete. Procedure rehearsed on the evaluation and certification findings; identifiers, advisory templates and escalation contacts ready.
- Security Release: maturity 1.0, Complete. Incident response ready before the security release, with the disclosure policy published and the team staffed; then reports are triaged, fixed and disclosed until end of support.
- Vulnerability Reporting & Response: maturity 1.0, Complete. Incident response ready before the security release, with the disclosure policy published and the team staffed; then reports are triaged, fixed and disclosed until end of support.
Security updates and release^A
- Certification & Assurance: maturity 0.8, Feature complete. Pipeline moved to production signing keys after the key ceremony; update and rollback tests passing; bill of materials ready for review.
- Security Release: maturity 1.0, Complete. Software bill of materials published and update delivery proven at the security release; then each security update is signed and released.
- Vulnerability Reporting & Response: maturity 1.0, Complete. Software bill of materials published and update delivery proven at the security release; then each security update is signed and released.
Customer security enablement^A
- Certification & Assurance: maturity 0.8, Feature complete. Guide complete with the security errata and certification conditions; customer support for provisioning set up.
- Security Release: maturity 1.0, Complete. Secure integration guide released to customers at the security release; then notices, support and migration guidance until end of support.^A
- Vulnerability Reporting & Response: maturity 1.0, Complete. Secure integration guide released to customers at the security release; then notices, support and migration guidance until end of support.

Register or sign in to read on

The full lifecycle detail, with its charts, flows, tables and every section, is for registered members. Registration is free and takes a minute. You come back to this page afterwards.