SHP does not assume that hardening is universally portable between systems.
A platform is supported only where an applicable Active Platform Admission Record establishes that support.
Nothing else creates platform support.
Documentation does not.
Testing does not.
Implementation history does not.
Verification tooling does not.
A control catalogue does not.
A draft specification does not.
Formal admission does.
Support is explicit
SHP treats platform support as a governed state.
A platform must be formally admitted before SHP certification claims can be made for it.
An Active Platform Admission Record establishes that the required platform-specific governance, specification, verification, certification, lifecycle, and trust conditions have been satisfied for admission.
If the applicable admission record is not Active, platform support must not be inferred.
What platform admission requires
Formal admission requires, at minimum:
- a defined platform boundary
- an explicit threat model
- applicable platform mathematics or an authorised certification model
- control catalogues
- Non-Negotiable Controls where tiers or certification classes are used
- deterministic verification requirements
- evidence requirements
- drift rules
- downgrade rules
- invalidation rules
- expiry rules
- revocation rules
- recovery requirements
- lifecycle rules
- an approved position within the SHP trust architecture
- governance approval
If these requirements are incomplete, contradictory, or unverified, SHP does not infer support.
Currently supported platforms
Fedora
Status: Supported
Fedora support is established by the applicable Active Fedora Platform Admission Record.
The admitted Fedora specification set defines its platform boundary, threat model, control catalogues, certification mathematics, verification expectations, and tier semantics.
View the Fedora Platform Admission Record →
Wi-Fi Infrastructure
Status: Supported
Wi-Fi support is established by the applicable Active Wi-Fi Platform Admission Record.
The admitted Wi-Fi specification set defines its own platform boundary, threat model, control catalogues, mathematics, and certification behaviour.
View the Wi-Fi Platform Admission Record →
Network Gateway
Status: Supported
Network Gateway support is established by the applicable Active Network Gateway Platform Admission Record.
The admitted Network Gateway specification set defines its own platform boundary, threat model, control catalogues, mathematics, and certification behaviour.
View the Network Gateway Platform Admission Record →
Platform specifications do not create support by themselves
SHP may contain:
- research
- draft specifications
- experimental controls
- verification prototypes
- implementation work
- historical documents
- platform-related tooling
for a platform that is not formally supported.
Their existence must not be interpreted as an admission decision.
Publication is not admission.
Implementation is not admission.
Tooling is not admission.
Only the applicable Active Platform Admission Record establishes support.
Platforms remain structurally independent
Each admitted platform has its own specification set.
Platform-specific artefacts may include:
- threat models
- platform mathematics
- control catalogues
- tier definitions
- verification rules
- certification rules
- trust references
- admission records
Those artefacts define the meaning of certification for that platform.
A control that is valid for one platform must not automatically be treated as valid for another.
Tier numbers do not cross platform boundaries
The same tier number does not imply equivalent security properties across platforms.
Fedora Tier 1 is not the same thing as Wi-Fi Tier 1.
Wi-Fi Tier 2 is not the same thing as Network Gateway Tier 2.
The tier number identifies a position within the applicable platform’s own governed hardening model.
It does not create cross-platform equivalence.
Verification is platform-specific
Verification behaviour follows the admitted platform specification set.
A verifier must evaluate the controls, evidence, semantics, and decision rules applicable to that platform.
A verifier built for one platform does not implicitly support another.
The presence of tooling must never be used as a substitute for formal platform admission.
Certification is platform-specific
Certification also remains within the admitted platform boundary.
An SHP certification is tied to the applicable:
- platform
- evaluated device
- evaluated state
- specification versions
- tier or certification class
- validity period
Certification on one platform does not transfer to another.
Support is not signing readiness
Formal platform support does not mean that production certification signing is operational.
These states are separate.
Platform Support
means that the platform has been formally admitted under SHP governance.
Certification Signing Readiness
means that the required operational trust infrastructure exists for issuing SHP certification artefacts for that platform.
Service Availability
means that certification services are actually being offered.
None of these states should be inferred from another.
Admission is lifecycle-governed
Platform Admission Records have lifecycle state.
Only an Active admission record establishes current support.
A Draft admission record does not establish support.
A Superseded, Obsolete, or Withdrawn admission record does not independently establish current support.
Historical admission records retain their historical meaning, but current support follows the applicable current admission state.
No implicit platform expansion
SHP does not expand its scope casually.
A new operating system, device class, network domain, or other technical platform must not be treated as supported merely because it resembles an existing platform.
New platform support requires its own formal admission path.
This preserves:
- threat-model integrity
- control validity
- verification determinism
- tier meaning
- certification meaning
- trust separation
No platform is implicitly supported.
The specifications govern platform support
This page explains the SHP platform model.
The applicable versioned specifications and Platform Admission Records define its technical and governance meaning.
Where explanatory website text and an applicable normative specification differ, the governing specification controls.
Browse Platform Specifications →