NIST SP 800-193, Platform Firmware Resiliency Guidelines, was published in May 2018. It gives technical guidance for keeping platform firmware and data working after potentially destructive attacks. It groups the work into three jobs: protect against unauthorised changes, detect changes that happen anyway, and recover rapidly and securely.
What the document covers
NIST describes the scope as the fundamental hardware and firmware needed to boot and run a system. Manufacturers and component suppliers can use it to build stronger protections, and administrators, security professionals and users can use it to guide procurement.
I could confirm the abstract and the three themes from NIST's page. For the detailed requirements, such as roots of trust and update mechanisms, read the full publication rather than relying on a summary.
Protect
Protection means mechanisms that guard against unauthorised changes. In practice, that is signed firmware, access control on flash, authenticated updates and locked down debug interfaces. The ideas covered in this series of posts on secure boot, anti-rollback and key custody mostly sit here.
Detect
Detection addresses changes that get through, or happen by other means. A device that verifies its own firmware at boot is detecting. So is a platform that measures what it loaded and reports it. ETSI EN 303 645 provision 5.7-2 expects a device that detects an unauthorised software change to alert the user or administrator.
Recover
Recovery is the part many product teams skip. NIST lists it as a core goal: recovering from attacks rapidly and securely. A device with a known good image stored locally, and a safe way to reinstall it, can come back without a recall. ETSI makes the same point, noting that recovery from a known good state helps avoid denial of service and costly maintenance visits.
Using it as a planning tool
A simple exercise is to take your product and write one sentence for each column.
- How do we stop someone changing the firmware?
- How would we know if they did?
- What do we do next, and can the device do it by itself?
Blank answers mark where your design is weakest. Procurement teams can ask suppliers the same three questions.
Fit with other guidance
The NIST text is platform oriented and relevant to servers, PCs and embedded systems. ETSI EN 303 645 is aimed at consumer IoT. Both lead to the same practical shape: verified boot, authenticated updates and a plan for the bad day.
Quick check
What are the three parts of SP 800-193?
Protection, detection and recovery of platform firmware, according to NIST's description.
Is it only for servers?
NIST says manufacturers and component suppliers can use it, and administrators and users can use it for procurement. It is about platform firmware generally.
Where Safeguard fits
Safeguard covers the software supply chain side of this work: SBOM and dependency scanning, policies and gates, and compliance and evidence automation. It does not replace hardware security features. A free scan is available at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
