Skip to content

Secure Boot

What is Secure Boot?

A security standard that ensures a device boots using only software trusted by the manufacturer, preventing rootkits and boot-level malware from loading.

Information Security

Terms that appear alongside secure boot

Each of these is named in at least one of the same controls as secure boot. The number is how many controls name both.

Frameworks that govern secure boot

NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on secure boot

Requirements naming secure boot across 6 standards, quoted from the control text.

ETSI EN 303 6452 controls

The device verifies its software using secure boot mechanisms, ideally anchored in a hardware root of trust resistant to physical and logical tampering. Status in Table B.1: R (recommendation, a should provision).

etsi-en-303-645::Provision 5.7-1 · Software verified by secure boot →
Australian Information Security Manual1 control

Early Launch Antimalware, Secure Boot, Trusted Boot and Measured Boot functionality is enabled.

ISM-1745 · Secure boot and measured boot functionality →
MITRE D3FEND1 control

Apply D3FEND HARDEN tactic to make compromise more difficult prior to attack. D3-AH Application Hardening (D3-DCE Dead Code Elimination + D3-EAL Exception Handler Pointer Validation + D3-PSL Pointer Authentication + D3-SU Software Update + D3-DLIC Driver Load...

MITRE-D3FEND-Harden-Tactic-Application-Credential-Message-Platform-Hardening-MFA-Encryption-Secure-Boot · MITRE D3FEND Harden Tactic + Application + Credential + Message + Platform + MFA + Encryption + Secure Boot →
IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)2 controls

NSS-17 + NSS-42-G require system integrity protection through configuration management + change management + baseline control + hardening.

IAEA-NSS17-SystemIntegrity-Configuration-Change-Management · IAEA NSS-17 - System Integrity + Configuration Management + Change Management + Baseline + Hardening →
ITU-T X.805 - Security Architecture for End-to-End Communications2 controls

Security Dimension 6 Data Integrity per X.805 Clause 6.6: Data Integrity keeps data correct and accurate. Data are shielded from being altered, deleted, created or copied without authorization, and any such unauthorized activity is made detectable.

X805-Dim6-Data-Integrity-Correctness-Accuracy-Unauthorized-Modification-Deletion-Detection · ITU-T X.805 Security Dimension 6 - Data Integrity + Correctness + Accuracy + Unauthorized Modification Prevention + Deletion Detection + Hashing + HMAC + Digital Signatures + Merkle Trees + Blockchain Integrity + File Integrity Monitoring (FIM) →
Commercial National Security Algorithm Suite (CNSA) 2.01 control

CNSSP 15 Annex B allows SHA3-384 or SHA3-512 (FIPS 202) for internal hardware functionality only, such as boot-up integrity checks; note b explains that, at a vendor's discretion, for internal components of a hardware system that do not interoperate outside th...

commercial-national-security-algorithm-suite-cnsa-2-0::ALG-SHA3 · ALG-SHA3 SHA3-384 or SHA3-512 allowed only for internal hardware integrity processes →

Questions people ask about secure boot

What is Secure Boot?
A security standard that ensures a device boots using only software trusted by the manufacturer, preventing rootkits and boot-level malware from loading.
Why is Secure Boot important for compliance?
Secure Boot is a key concept in Information Security. Understanding secure boot helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Secure Boot?
Secure Boot appears in the requirement text of ETSI EN 303 645, Australian Information Security Manual, MITRE D3FEND, IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1), ITU-T X.805 - Security Architecture for End-to-End Communications. Across these standards we have identified 9 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Secure Boot?
Explore our compliance framework pages to see how secure boot applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Secure Boot applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.