The Structured Hardening Project defines a governed method for establishing, verifying, and certifying bounded security postures.
It does not attempt to define universal security.
It defines something narrower:
A specific security posture, for a specific platform, against a defined threat model, under explicit and verifiable rules.
The SHP model is:
Threat Model → Controls → Hardening → Evidence → Verification → Certification
Each stage has a distinct purpose. None substitutes for another.
Start with the threat model
SHP does not begin with a checklist of security settings.
It begins by defining the security problem.
A platform threat model establishes the relevant:
- adversaries
- attack classes
- protected objectives
- assumptions
- exclusions
- operational constraints
- platform boundary
Controls are then defined against that threat model.
A control designed for one platform, threat model, or certification context is not automatically valid for another.
A control must be complete
An SHP hardening control is not merely a recommendation.
A valid control must define four things:
- What it does — the security property, exposure, or risk it addresses.
- How it is applied — the required configuration or implementation.
- How it is verified — the deterministic observation or evidence used to evaluate it.
- How it is recovered or rolled back — the defined path for reversing the control or restoring operation.
If verification or recovery is missing, the control is incomplete for SHP purposes.
There are no unverifiable certification controls.
Tier integrity
SHP tiers represent defined hardening postures under platform-specific rules.
They are not marketing labels and they are not informal descriptions of how “secure” a system feels.
A tier is established by its applicable control set, mathematical rules, verification requirements, and certification decision logic.
The same tier number on two different platforms does not imply that their controls or security properties are equivalent.
Non-Negotiable Controls
Some controls are designated Non-Negotiable Controls (NNCs).
NNCs are hard certification gates.
An applicable NNC cannot be waived because other controls pass.
It cannot be ignored by operator discretion.
It cannot be bypassed through bounded certification.
If an applicable NNC fails, certification status must change according to the applicable tier and platform rules.
Tier integrity is mechanical, not discretionary.
Verification is separate from hardening
Applying a hardening control and proving that it is present are different operations.
SHP verification is required to be:
- open
- deterministic
- versioned
- reproducible
- capable of structured machine-readable output
Verification evaluates observed state.
Certification decisions derive from that verification output and the applicable decision rules.
Opaque certification logic is incompatible with the SHP model.
Evidence matters
Certification cannot be based on an assertion that a system was hardened.
It requires evidence of the evaluated state.
Evidence requirements are defined by the applicable SHP specifications and must support deterministic verification and reproducible certification decisions.
The relationship is deliberate:
Observed State → Evidence → Verification Result → Certification Decision
Certification describes a state
An SHP certificate does not declare that a device is permanently secure.
Certification is:
- device-bound
- state-bound
- specification-bound
- time-bounded
It describes an evaluated condition under defined versions of the SHP rules.
Expiry ends active certification.
Revocation ends active certification.
Material state change can invalidate the certified state and require re-verification.
An expired certificate is Expired — Not Certified.
A revoked certificate is Revoked — Not Certified.
Understand SHP Certification →
Bounded certification
Where the applicable specifications permit it, certification may cover less than a complete tier.
It must then be labelled:
Tier X — Bounded Certification
A bounded certification must state:
- the controls included
- the controls excluded
- the residual risk created by those exclusions
It must never be represented as equivalent to full-tier certification.
Bounded certification cannot override the absence or failure of an applicable Non-Negotiable Control.
Drift and downgrade
Certification represents an evaluated state.
If that state changes, certification status must follow the applicable drift and downgrade rules.
SHP does not rely on discretionary judgement to preserve a certification whose required state no longer exists.
Where defined certification conditions cease to be satisfied, downgrade or invalidation is mechanical.
Historical certificates retain their historical meaning, but they do not create permanent certification of a changed system.
Platform support is explicit
No platform is implicitly supported by SHP.
Documentation, experimental work, controls, or verification tooling do not by themselves create platform support.
A platform becomes supported only through an Active Platform Admission Record.
Formal platform admission requires, at minimum:
- a defined platform boundary
- an explicit threat model
- applicable platform mathematics or authorised certification model
- control catalogues
- Non-Negotiable Controls where tiers or certification classes are used
- deterministic verification requirements
- evidence requirements
- drift, downgrade, invalidation, expiry, and revocation rules
- recovery requirements
- lifecycle rules
- an approved position within the SHP trust architecture
If those requirements are incomplete, contradictory, or unverified, platform support is not inferred.
Certification is governed, not self-declared
SHP verification tooling may be independently executed.
That does not create an SHP certificate.
Certification authority remains separate from verification capability.
Only certification issued under the SHP trust architecture and SHP-controlled signing authority constitutes SHP certification.
Client self-signing does not constitute certification.
Standard and service are separate
SHP is a structured hardening standard.
Certification is a service delivered under that standard.
Neither should be confused with general IT support, managed infrastructure, or an open-ended promise to secure every aspect of a system.
The scope is deliberately narrow.
The standard defines the rules.
Hardening applies them.
Verification evaluates them.
Certification records the resulting qualified state.
The specifications define SHP
This website explains the Structured Hardening Project.
The applicable versioned specifications define it.
Those specifications govern:
- authority
- mathematics
- platform boundaries
- threat models
- control catalogues
- evidence
- verification
- certification
- trust architecture
- platform admission
- lifecycle and amendment rules
Where explanatory website text and an applicable normative specification differ, the governing specification controls.