Section 28 of 101
27. Secure Boot
Stable section ID: S05-CON-006-SECTION-28 · 32 content blocks
Secure Boot shall ensure that only authorized and integrity-verified BIOS software executes within the trusted BIOS environment.
The secure boot chain shall begin from a protected root of trust that is resistant to unauthorized modification. Each subsequent boot stage shall be verified before control is transferred to it.
The verified chain may include:
immutable or protected initial boot code;
bootloader;
BIOS operating environment;
BIOS Core;
trusted drivers;
security services;
configuration schema;
critical policy packages;
recovery environment.
Every verified software object shall include:
publisher or approving authority;
version;
cryptographic integrity value;
signature;
permitted platform;
validity status;
revocation status.
Secure Boot shall reject:
unsigned critical software;
corrupted software;
revoked versions;
unauthorized downgrades;
incompatible drivers;
altered policy packages;
untrusted recovery images.
If normal boot verification fails, the system shall enter a defined recovery or restricted mode. It shall not continue ordinary operation while falsely reporting trusted status.
Manufacturer-provided drivers shall not automatically inherit BIOS Core trust. Drivers shall be verified, version-controlled, permission-restricted, and isolated according to their function.
Secure Boot shall support controlled key rotation and replacement of compromised trust authorities without destroying building identity or configuration continuity.
The BIOS shall expose its current boot-integrity status to authorized users and higher-level systems.