Implementation Guides: Build Phase

The Build Phase covers the engineering tasks involved in designing, implementing, testing, and evidencing secure-by-design controls before and during release.

This section will help you answer questions like:

• What risks and trust boundaries does the product have?
• How should device identity, keys, boot integrity, updates, and configuration be designed?
• What evidence should be retained for release and technical documentation?

Core Topics

• Threat Modeling: Identify product risks, mitigations, decisions, and evidence.
• Secure Configuration & Hardening: Reduce attack surface and lock down production configuration.
• Unique Device Identity: Define how each device proves what it is across onboarding, authentication, updates, and support.
• Secure Boot: Protect the boot chain so only authorised firmware or software runs.
• Key Provisioning & Storage: Define how keys are created, protected, rotated, revoked, and evidenced.
• Data Privacy & Secure Deletion: Protect sensitive data and define deletion or removal behaviour.
• Secure OTA Updates: Deliver, verify, recover, roll out, and evidence security updates.
• SBOM & VEX Workflows: Connect component inventory to release evidence and vulnerability status.
• User Information & Documentation: Provide users with security, update, support, and vulnerability-reporting information.

Use these guides with the Secure-by-Design Evidence Pack to retain design, test, release, and exception records.