Skip to content

Commit adbb8d5

Browse files
chuckb1300chuckb1300
committed
fixing urls and updating policy reqs
1 parent 5cd3d82 commit adbb8d5

File tree

1 file changed

+16
-39
lines changed

1 file changed

+16
-39
lines changed

‎articles/certification/program-requirements-edge-secured-core.md

Lines changed: 16 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -63,9 +63,8 @@ Edge Secured-core for Windows IoT requires Windows 10 IoT Enterprise version 190
6363

6464
|Name|SecuredCore.Hardware.MemoryProtection|x86/AMD64|Arm64|
6565
|:---|:---|:---|:---|
66-
|Status|Required|
66+
|Status|Required|2023|2023|
6767
|Description|The purpose of the requirement is to validate that DMA is not enabled on externally accessible ports.|
68-
|Target Availability|2022|
6968
|Requirements dependency|Only if DMA capable ports exist|
7069
|Validation Type|Manual/Tools|
7170
|Validation|If DMA capable external ports exist on the device, toolset to validate that the IOMMU or SMMU is enabled and configured for those ports.|
@@ -76,9 +75,8 @@ Edge Secured-core for Windows IoT requires Windows 10 IoT Enterprise version 190
7675

7776
|Name|SecuredCore.Firmware.Protection|x86/AMD64|Arm64|
7877
|:---|:---|:---|:---|
79-
|Status|Required|
78+
|Status|Required|2023|2023|
8079
|Description|The purpose of the requirement is to ensure that device has adequate mitigations from Firmware security threats.|
81-
|Target Availability|2022|
8280
|Requirements dependency|DRTM + UEFI|
8381
|Validation Type|Manual/Tools|
8482
|Validation|Device to be validated through [Edge Secured-core Agent](https://aka.ms/Scforwiniot) toolset to confirm it is protected from firmware security threats through one of the following approaches: <ul><li>DRTM + UEFI Management Mode mitigations</li><li>DRTM + UEFI Management Mode hardening</li></ul> |
@@ -89,9 +87,8 @@ Edge Secured-core for Windows IoT requires Windows 10 IoT Enterprise version 190
8987

9088
|Name|SecuredCore.Firmware.SecureBoot|x86/AMD64|Arm64|
9189
|:---|:---|:---|:---|
92-
|Status|Required|
90+
|Status|Required|2023|2023|
9391
|Description|The purpose of the requirement is to validate the boot integrity of the device.|
94-
|Target Availability|2022|
9592
|Requirements dependency|UEFI|
9693
|Validation Type|Manual/Tools|
9794
|Validation|Device to be validated through [Edge Secured-core Agent](https://aka.ms/Scforwiniot) toolset to ensure that firmware and kernel signatures are validated every time the device boots. <ul><li>UEFI: Secure boot is enabled</li></ul>|
@@ -102,9 +99,8 @@ Edge Secured-core for Windows IoT requires Windows 10 IoT Enterprise version 190
10299

103100
|Name|SecuredCore.Firmware.Attestation|x86/AMD64|Arm64|
104101
|:---|:---|:---|:---|
105-
|Status|Required|
102+
|Status|Required|2023|2023|
106103
|Description|The purpose of the requirement is to ensure the device can remotely attest to the Microsoft Azure Attestation service.|
107-
|Target Availability|2022|
108104
|Requirements dependency|Azure Attestation Service|
109105
|Validation Type|Manual/Tools|
110106
|Validation|Device to be validated through toolset to ensure that platform boot logs and measurements of boot activity can be collected and remotely attested to the Microsoft Azure Attestation service.|
@@ -118,9 +114,8 @@ Edge Secured-core for Windows IoT requires Windows 10 IoT Enterprise version 190
118114

119115
|Name|SecuredCore.Encryption.Storage|x86/AMD64|Arm64|
120116
|:---|:---|:---|:---|
121-
|Status|Required|
117+
|Status|Required|2023|2023|
122118
|Description|The purpose of the requirement to validate that sensitive data can be encrypted on non-volatile storage.|
123-
|Target Availability|2022|
124119
|Validation Type|Manual/Tools|
125120
|Validation|Device to be validated through [Edge Secured-core Agent](https://aka.ms/Scforwiniot) toolset to ensure Secure-boot and BitLocker is enabled and bound to PCR7.|
126121
|Resources||
@@ -130,9 +125,8 @@ Edge Secured-core for Windows IoT requires Windows 10 IoT Enterprise version 190
130125

131126
|Name|SecuredCore.Encryption.TLS|x86/AMD64|Arm64|
132127
|:---|:---|:---|:---|
133-
|Status|Required|
128+
|Status|Required|2023|2023|
134129
|Description|The purpose of the requirement is to validate support for required TLS versions and cipher suites.|
135-
|Target Availability|2022|
136130
|Requirements dependency|Windows 10 IoT Enterprise Version 1903 or greater. Note: other requirements may require greater versions for other services. |
137131
|Validation Type|Manual/Tools|
138132
Validation|Device to be validated through toolset to ensure the device supports a minimum TLS version of 1.2 and supports the following required TLS cipher suites.<ul><li>TLS_RSA_WITH_AES_128_GCM_SHA256</li><li>TLS_RSA_WITH_AES_128_CBC_SHA256</li><li>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</li><li>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</li><li>TLS_DHE_RSA_WITH_AES_128_GCM_SHA256</li><li>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256</li><li>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</li></ul>|
@@ -143,9 +137,8 @@ Validation|Device to be validated through toolset to ensure the device supports
143137

144138
|Name|SecuredCore.Protection.CodeIntegrity|x86/AMD64|Arm64|
145139
|:---|:---|:---|:---|
146-
|Status|Required|
140+
|Status|Required|2023|2023|
147141
|Description|The purpose of this test is to validate that code integrity is available on this device.|
148-
|Target Availability|2022|
149142
|Requirements dependency|HVCI is enabled on the device.|
150143
|Validation Type|Manual/Tools|
151144
|Validation|Device to be validated through [Edge Secured-core Agent](https://aka.ms/Scforwiniot) toolset to ensure that HVCI is enabled on the device.|
@@ -156,9 +149,8 @@ Validation|Device to be validated through toolset to ensure the device supports
156149

157150
|Name|SecuredCore.Protection.NetworkServices|x86/AMD64|Arm64|
158151
|:---|:---|:---|:---|
159-
|Status|Required|
152+
|Status|Required|2023|2023|
160153
|Description|The purpose of the requirement is to validate that services listening for input from the network are not running with elevated privileges.|
161-
|Target Availability|2022|
162154
|Validation Type|Manual/Tools|
163155
|Validation|Device to be validated through [Edge Secured-core Agent](https://aka.ms/Scforwiniot) toolset to ensure that 3rd party services accepting network connections are not running with elevated LocalSystem and LocalService privileges. <ol><li>Exceptions may apply</li></ol>|
164156
|Resources||
@@ -171,7 +163,7 @@ Validation|Device to be validated through toolset to ensure the device supports
171163

172164
|Name|SecuredCore.Built-in.Security|x86/AMD64|Arm64|
173165
|:---|:---|:---|:---|
174-
|Status|Coming Soon June 2022|
166+
|Status|Required|Future|Future|
175167
|Description|The purpose of the requirement is to make sure devices can report security information and events by sending data to Azure Defender for IoT. <br>Note: Download and deploy security agent from GitHub|
176168
|Target Availability|2022|
177169
|Validation Type|Manual/Tools|
@@ -183,7 +175,7 @@ Validation|Device to be validated through toolset to ensure the device supports
183175

184176
|Name|SecuredCore.Protection.Baselines|x86/AMD64|Arm64|
185177
|:---|:---|:---|:---|
186-
|Status|Coming Soon June 2022|
178+
|Status|Required|Future|Future|
187179
|Description|The purpose of the requirement is to validate that the system conforms to a baseline security configuration.|
188180
|Target Availability|2022|
189181
|Requirements dependency|Azure Defender for IoT|
@@ -202,7 +194,6 @@ Some requirements of this program are based on a business agreement between your
202194
|:---|:---|
203195
|Status|Required|
204196
|Description|The purpose of the requirement is to validate that debug functionality on the device is disabled.|
205-
|Target Availability|2022|
206197
|Requirements dependency||
207198
|Validation Type|Manual/Tools|
208199
|Validation|Device to be validated through toolset to ensure that debug functionality requires authorization to enable.|
@@ -215,7 +206,6 @@ Some requirements of this program are based on a business agreement between your
215206
|:---|:---|
216207
|Status|Required|
217208
|Description|The purpose of this test is to validate the device against two use cases: a) Ability to perform a reset (remove user data, remove user configs), b) Restore device to last known good in the case of an update causing issues.|
218-
|Target Availability|2022|
219209
|Requirements dependency||
220210
|Validation Type|Manual/Tools|
221211
|Validation|Device to be validated through a combination of toolset and submitted documentation that the device supports this functionality. The device manufacturer can determine whether to implement these capabilities to support remote reset or only local reset.|
@@ -228,7 +218,6 @@ Some requirements of this program are based on a business agreement between your
228218
|:---|:---|
229219
|Status|Required|
230220
|Description|The purpose of this policy is to ensure that the device remains secure.|
231-
|Target Availability|2022|
232221
|Validation Type|Manual|
233222
|Validation|Commitment from submission that devices certified will be required to keep devices up to date for 60 months from date of submission. Specifications available to the purchaser and devices itself in some manner should indicate the duration for which their software will be updated.|
234223
|Resources||
@@ -240,7 +229,6 @@ Some requirements of this program are based on a business agreement between your
240229
|:---|:---|
241230
|Status|Required|
242231
|Description|The purpose of this policy is to ensure that there is a mechanism for collecting and distributing reports of vulnerabilities in the product.|
243-
|Target Availability|2022|
244232
|Validation Type|Manual|
245233
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
246234
|Resources||
@@ -252,7 +240,6 @@ Some requirements of this program are based on a business agreement between your
252240
|:---|:---|
253241
|Status|Required|
254242
|Description|The purpose of this policy is to ensure that vulnerabilities that are high/critical (using CVSS 3.0) are addressed within 180 days of the fix being available.|
255-
|Target Availability|2022|
256243
|Validation Type|Manual|
257244
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
258245
|Resources||
@@ -280,9 +267,9 @@ Edge Secured-core validation on Linux based devices is executed through a contai
280267
---
281268
|Name|SecuredCore.Hardware.Identity|x86/AMD64|Arm64|
282269
|:---|:---|:---|:---|
270+
|Status|Required|2023|2023|
283271
|Description|The purpose of the requirement is to validate the device identify is rooted in hardware.|||
284272
|Requirements dependency||TPM v2.0 device|TPM v2.0 </br><sup>or *other supported method</sup>|
285-
|Status|Required|2023|2023|
286273
|Validation Type|Manual/Tools|||
287274
|Validation|Device to be validated through toolset to ensure that the device has a HWRoT present and that it can be provisioned through DPS using TPM or SE.|||
288275
|Resources|[Setup auto provisioning with DPS](../iot-dps/quick-setup-auto-provision.md)|||
@@ -452,7 +439,6 @@ Validation|Device to be validated through toolset to ensure the device supports
452439
|:---|:---|
453440
|Status|Required|
454441
|Description|The purpose of the requirement is to validate that debug functionality on the device is disabled.|
455-
|Target Availability|2022|
456442
|Validation Type|Manual/Tools|
457443
|Validation|Device to be validated through toolset to ensure that debug functionality requires authorization to enable.|
458444
|Resources||
@@ -464,7 +450,6 @@ Validation|Device to be validated through toolset to ensure the device supports
464450
|:---|:---|
465451
|Status|Required|
466452
|Description|The purpose of this test is to validate the device against two use cases: a) Ability to perform a reset (remove user data, remove user configs), b) Restore device to last known good in the case of an update causing issues.|
467-
|Target Availability|2022|
468453
|Validation Type|Manual/Tools|
469454
|Validation|Device to be validated through a combination of toolset and submitted documentation that the device supports this functionality. The device manufacturer can determine whether to implement these capabilities to support remote reset or only local reset.|
470455
|Resources||
@@ -476,7 +461,6 @@ Validation|Device to be validated through toolset to ensure the device supports
476461
|:---|:---|
477462
|Status|Required|
478463
|Description|The purpose of this policy is to ensure that the device remains secure.|
479-
|Target Availability|2022|
480464
|Validation Type|Manual|
481465
|Validation|Commitment from submission that devices certified will be required to keep devices up to date for 60 months from date of submission. Specifications available to the purchaser and devices itself in some manner should indicate the duration for which their software will be updated.|
482466
|Resources||
@@ -488,7 +472,6 @@ Validation|Device to be validated through toolset to ensure the device supports
488472
|:---|:---|
489473
|Status|Required|
490474
|Description|The purpose of this policy is to ensure that there is a mechanism for collecting and distributing reports of vulnerabilities in the product.|
491-
|Target Availability|2022|
492475
|Validation Type|Manual|
493476
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
494477
|Resources||
@@ -500,7 +483,6 @@ Validation|Device to be validated through toolset to ensure the device supports
500483
|:---|:---|
501484
|Status|Required|
502485
|Description|The purpose of this policy is to ensure that vulnerabilities that are high/critical (using CVSS 3.0) are addressed within 180 days of the fix being available.|
503-
|Target Availability|2022|
504486
|Validation Type|Manual|
505487
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
506488
|Resources||
@@ -517,7 +499,7 @@ The Mediatek MT3620AN must be included in your design. For any component that ca
517499

518500
All operating systems on device must meet Secured Core requirements
519501

520-
Additional considerations for Azure Sphere are provided as an application note here: [Azure Sphere application notes](https://learn.microsoft.com/azure-sphere/app-notes/app-notes-overview)
502+
Additional considerations for Azure Sphere are provided as an application note here: [Azure Sphere application notes](../../azure-sphere/app-notes/app-notes-overview)
521503

522504

523505
## Sphere Hardware/Firmware Requirements
@@ -597,7 +579,7 @@ Additional considerations for Azure Sphere are provided as an application note h
597579
|Description|The purpose of this reqiurement is to validate that sensitive data can be encrypted on non-volatile storage.|
598580
|Validation Type|Automated|
599581
|Validation|Provided by Microsoft|
600-
|Resources|[Data at rest protection on Azure Sphere](../azure-sphere/app-notes/app-notes-overview)|
582+
|Resources|[Data at rest protection on Azure Sphere](../../azure-sphere/app-notes/app-notes-overview)|
601583

602584
---
603585
</br>
@@ -652,7 +634,7 @@ Additional considerations for Azure Sphere are provided as an application note h
652634
|Description|The purpose of the requirement is to make sure devices can report security information and events by sending data to Azure Defender for IoT. <br>Note: Download and deploy security agent from GitHub|
653635
|Validation Type|Automated|
654636
|Validation|Provided by Microsoft|
655-
|Resources|[Collect and interpret error data - Azure Sphere](../azure-sphere/deployment/interpret-error-data?tabs=cliv2beta)</br>[Configure crash dumps - Azure Sphere](../azure-sphere/deployment/configure-crash-dumps)|
637+
|Resources|[Collect and interpret error data - Azure Sphere](../../azure-sphere/deployment/interpret-error-data?tabs=cliv2beta)</br>[Configure crash dumps - Azure Sphere](../../azure-sphere/deployment/configure-crash-dumps)|
656638

657639
---
658640
</br>
@@ -707,8 +689,7 @@ Additional considerations for Azure Sphere are provided as an application note h
707689
|Name|SecuredCore.Policy.Protection.Debug|
708690
|:---|:---|
709691
|Status|Required|
710-
|Description|The purpose of the requirement is to validate that debug functionality on the device is disabled.|
711-
|Target Availability|2022|
692+
|Description|The purpose of the policy requires that debug functionality on the device is disabled.|
712693
|Validation Type|Manual/Tools|
713694
|Validation|Device to be validated through toolset to ensure that debug functionality requires authorization to enable.|
714695
|Resources||
@@ -719,8 +700,7 @@ Additional considerations for Azure Sphere are provided as an application note h
719700
|Name|SecuredCore.Policy.Manageability.Reset|
720701
|:---|:---|
721702
|Status|Required|
722-
|Description|The purpose of this test is to validate the device against two use cases: a) Ability to perform a reset (remove user data, remove user configs), b) Restore device to last known good in the case of an update causing issues.|
723-
|Target Availability|2022|
703+
|Description|The policy requires that the device can execute two use cases: a) Ability to perform a reset (remove user data, remove user configs), b) Restore device to last known good in the case of an update causing issues.|
724704
|Validation Type|Manual/Tools|
725705
|Validation|Device to be validated through a combination of toolset and submitted documentation that the device supports this functionality. The device manufacturer can determine whether to implement these capabilities to support remote reset or only local reset.|
726706
|Resources||
@@ -732,7 +712,6 @@ Additional considerations for Azure Sphere are provided as an application note h
732712
|:---|:---|
733713
|Status|Required|
734714
|Description|The purpose of this policy is to ensure that the device remains secure.|
735-
|Target Availability|2022|
736715
|Validation Type|Manual|
737716
|Validation|Commitment from submission that devices certified will be required to keep devices up to date for 60 months from date of submission. Specifications available to the purchaser and devices itself in some manner should indicate the duration for which their software will be updated.|
738717
|Resources||
@@ -744,7 +723,6 @@ Additional considerations for Azure Sphere are provided as an application note h
744723
|:---|:---|
745724
|Status|Required|
746725
|Description|The purpose of this policy is to ensure that there is a mechanism for collecting and distributing reports of vulnerabilities in the product.|
747-
|Target Availability|2022|
748726
|Validation Type|Manual|
749727
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
750728
|Resources||
@@ -756,7 +734,6 @@ Additional considerations for Azure Sphere are provided as an application note h
756734
|:---|:---|
757735
|Status|Required|
758736
|Description|The purpose of this policy is to ensure that vulnerabilities that are high/critical (using CVSS 3.0) are addressed within 180 days of the fix being available.|
759-
|Target Availability|2022|
760737
|Validation Type|Manual|
761738
|Validation|Documentation on the process for submitting and receiving vulnerability reports for the certified devices will be reviewed.|
762739
|Resources||

0 commit comments

Comments
 (0)