5.1.8 is unclear and hard to verify about iot-security-verification-standard-isvs HOT 2 CLOSED

It sounds like it would be better to remove the specificity of chosen. Hardware is always sourced whether it's in-house or otherwise. The design of hardware varies on the supplier model - ODM, JDM, etc.

Regrading verification, one would need to review schematics, data sheets, and reverse engineer components to investigate whether such hardware debug features exist. The level of effort varies but these can be caught in design stages if security teams have access to platform documents and preproduction boards (i.e. EVT, DVT, PVT) or by third-parties after mass production (not preferred but is often the case without having the required in-house skillsets).

Revised requirement below

Verify that hardware has no unofficially documented debug features, such as special pin configurations that can enable or disable certain functionality.

from iot-security-verification-standard-isvs.

75b251d

from iot-security-verification-standard-isvs.