The Certification Program Explained

Certification enables you to test your products before they reach the market, and demonstrate a security commitment to your customers. Independent test labs are used for the evaluation creating consistency and standardization and third-party validation of security implementations. The evaluation focuses on the security requirements of the generic parts of IoT products and combines this with a multi-level silicon evaluation. This ensures that all IoT components and products are built to a consistent set of security principles with additional silicon security provided for specific use cases

Who Benefits from Certification?

Device Manufacturers

PSA Certified aligns with the key government requirements to give you a head-start on adherence with emerging laws and standards, and helps you showcase your investment in security.

Silicon Vendors

PSA Certified helps you prove you have a well-designed Root of Trust (RoT) in your products and provides evidence of your investment in security.

System Software Providers

It provides streamlined access to chip security functions and evidence of your security proficiency. Align to security regulations and showcase your security expertise.

Middleware and IoT Application Developers

It offers key reusable code to make use of complex security with improved time-to-market and without needing specific security expertise.

Enterprises

The scheme gives you a better understanding of the devices you are procuring for your business and how secure they really are.

Cloud Service Providers

It is an easy way to understand a device’s credentials before it connects to your network through Entity Attestation Tokens.

Insurers

PSA Certified provides a clear baseline of security, requiring that all connected devices are built upon a Root of Trust (RoT). The third-party evaluation and verification provide assurance that enables trusted deployment at scale and the confidence to back digital transformation.

Governments and Standards Bodies

PSA Certified is an existing and well-developed scheme built by industry experts, which means you don’t have to reinvent the wheel, or invest in new research.

Our product utilizes PSA Certified silicon, so we knew we were building on a secure foundation and industry best practice. This means that we can protect our customers from the most common IoT attacks.

Dr Juan Nogueira is Sr. Director for Connectivity in the Global Technology Team at Flex

A Layered Approach to Certification

There are three layers in the PSA Certified certification program that assess security on a hardware Root of Trust.

The first layer is the silicon; PSA Certified requires a hardware Root of Trust called a PSA-RoT that is available in three levels of security assurance and robustness.

The second layer is the software; PSA Certified assesses security principles built into the system software upon a PSA-RoT.

The third layer is the endpoint device; PSA Certified assesses security-by-design principles implemented into devices built upon a PSA-RoT.

PSA Certified Level 1: Buiding a foundation of security for the IoT

  • For device manufacturers, system software providers, silicon vendors, IP providers
  • Assesses security principles-based design using a security questionnaire with laboratory evaluation
  • Methodically developed using IoT threat models, security goals and key industry regulations and standards from around the world
  • Concise questionnaire - less than 50 questions, followed by a review by a laboratory and certification body verification
  • Composite format with separate sections for chip, OS and device allowing reuse of components up the stack

PSA Certified Level 2: Providing evidence of protection against software attacks

  • For silicon vendors
  • Lab-based vulnerability analysis and penetration testing of a chip's PSA Root of Trust (PSA-RoT) security component
  • Provides evidence of nine security requirements showing protection against scalable, remote software attacks
  • Two evaluation methodologies increasing extensibility in end marks: PSA Certified Level 2 PSA-RoT Protection Profile (informal CSPN style) and PSA Certified Level 2 GlobalPlatform SESIP Profile (formal style)
  • Evaluation time is 25 days, so it is time-efficient and affordable
  • PSA Certified Level 2 Ready pre-certification is available for FPGA and or test-chip hardware to show adherence to a sub-set of the PSA Certified Level 2 requirements Assesses security principles-based design using a security questionnaire with laboratory evaluation

PSA Certified Level 3: Providing evidence of protection against hardware and software attacks

  • For silicon vendors
  • Lab-based vulnerability analysis and penetration testing of a chip's PSA Root of Trust (PSA-RoT) security component
  • Demonstrate substantial security assurance and robustness and provide evidence of protection from hardware and software attacks
  • Two evaluation methodologies increasing extensibility in end marks: PSA Certified Level 3 PSA-RoT Protection Profile (informal CSPN style) and PSA Certified Level 3 GlobalPlatform SESIP Profile (formal style)
  • Evaluation time is 35 days

PSA Certified Evaluation for RoT Components: Show security readiness for subsystem or RoT component

  • For silicon vendors and IP providers
  • Lab-based vulnerability analysis and penetration testing of a PSA Root of Trust (PSA-RoT) security component
  • Provide evidence of the assurance and robustness of RoT components aligning to PSA Certified Level 2 or PSA Certified Level 3 security requirements

PSA Functional API Certification: Demonstrate easy integration between PSA-RoT and system software

  • For silicon vendors and system software providers
  • Verify correct implementation of the PSA Functional APIs
  • Provide a marker for interoperability across products that support the APIs

Ready to join the PSA Certified partnership?

Share this page

The PSA Certified name, PSA Certified logos, PSA Functional API Certified logo featured on this website are registered trademarks or trademarks of Arm Limited (or its subsidiaries) in the US and/or elsewhere. All rights reserved. Other brands and names mentioned on this website may be the trademarks of their respective owners.

Copyright © 2021 Arm Limited (or its affiliates). All rights reserved.

Sign Up to Receive the Latest from PSA Certified

Loading...