WHAT SHP DOES
One narrowly defined job.
SHP takes a formally admitted platform from an explicit threat model through defined hardening controls, evidence and deterministic verification to a governed certification decision.
See how SHP is different →STRUCTURED HARDENING PROJECT
Security claims should be provable.
Anyone can say a system has been hardened. SHP defines what that claim means, verifies the actual system state against published requirements, and provides a governed path to certification.
You say the system is hardened. Can you prove it?
Define it.
Harden it.
Verify it.
Certify it.
WHAT SHP DOES NOT DO
Not another security score.
SHP is not a percentage score, an assessor's opinion, or a permanent declaration that a machine is “secure”.
Explore the Standard →SUPPORTED PLATFORMS
Support is explicit.
SHP does not assume that hardening controls transfer safely between operating systems, device classes, or network platforms.
A platform is supported only when an Active Platform Admission Record says that it is.
Fedora
Fedora Workstation and Fedora Silverblue under the admitted Fedora platform specification set.
Supported platform →Wi-Fi Infrastructure
Wireless infrastructure governed by its own threat model, mathematics, control catalogues and certification rules.
Supported platform →Network Gateway
Network boundary infrastructure governed by the admitted Network Gateway specification set.
Supported platform →THE MODEL
From threat model to certification.
SHP does not begin with a checklist. It begins by defining the security problem.
- 01Threat Model
- 02Controls
- 03Hardening
- 04Evidence
- 05Verification
- 06Certification
THE STANDARD
Not a collection of security tweaks.
Every SHP hardening control must define what it does, how it is applied, how it is verified, and how it can be recovered or rolled back.
Controls feed deterministic verification. Verification feeds the certification decision.
Explore the Standard →THE BOUNDARY
Hardening and certification. Nothing else.
SHP is a hardening standard and certification system. It is not managed IT, general technical support, or a promise that a system will remain secure forever.
We won't help you set up your printer.
CERTIFICATION
Certification describes a state.
An SHP certificate applies to a defined device, evaluated state, specification set and validity period.
Drift, expiry or revocation changes that status. Certification is never permanent.
- Device-bound
- State-bound
- Specification-bound
- Time-bounded
- Cryptographically verifiable
THE PROJECT
Defined rules. Visible boundaries.
SHP separates the standard, verification, certification and platform-specific rules instead of blurring them together.
Standard
Threat-model-driven hardening using explicit, verifiable controls.
Standard →Tiers
Defined hardening postures protected by Non-Negotiable Controls and deterministic downgrade rules.
Tiers →Verification
Open, deterministic, versioned and reproducible evaluation of observed system state.
Verification →Certification
A governed decision derived from verification evidence, not an informal judgement or marketing badge.
Certification →Platforms
Platform support exists only through formal admission under the SHP governance model.
Platforms →Specifications
The governed technical corpus defines SHP. The website presents it; it does not replace it.
Specifications →VERIFICATION
Open and reproducible.
SHP verification logic is intended to be open, deterministic, versioned, reproducible and capable of producing structured, machine-readable output.
How verification works →CERTIFICATION AUTHORITY
Governed, not self-declared.
Running SHP verification tooling yourself does not create an SHP certificate.
SHP certification is issued only under the SHP trust architecture and SHP-controlled signing authority.
Understand certification →GOVERNANCE
The Charter is the highest authority.
The Structured Hardening Project Charter defines the constitutional boundaries of the standard, including platform admission, certification, Non-Negotiable Controls, verification, drift, cryptographic governance and specification authority.
Read the governing Charter →SPECIFICATIONS
The documents matter.
SHP is governed through versioned normative specifications covering mathematics, threat models, controls, evidence, verification, certification and platform-specific behaviour.
The public website explains SHP. The applicable specifications define it.
Browse the specification library →