SHP tiers are not scores.
They are governed security postures defined by platform-specific specifications.
A tier has meaning only within the threat model, control set, verification rules, mathematics, and certification logic that define it.
Tier numbers are therefore not universal measures of security.
Tiers are platform-specific
Tier 1 on one platform does not imply the same controls, threat coverage, operational assumptions, or assurance properties as Tier 1 on another.
Fedora Tier 1 is defined by the Fedora specification set.
Wi-Fi Tier 1 is defined by the Wi-Fi specification set.
Network Gateway Tier 1 is defined by the Network Gateway specification set.
The same number does not create cross-platform equivalence.
A tier is defined by rules, not impression
A tier is established by its applicable:
- threat model
- control catalogue
- control dependencies
- applicability conditions
- Non-Negotiable Controls
- verification rules
- tier mathematics
- certification decision logic
Tier assignment is therefore not based on an assessor’s overall impression that a system appears “secure enough”.
It is derived from explicit rules and observed results.
Control results feed the tier decision
Controls are evaluated individually under the applicable verification rules.
Those results then feed the tier decision.
The process is not:
Controls passed ÷ Controls total = Tier
SHP does not use a percentage score to substitute for tier logic.
A high number of passing controls does not automatically compensate for a failed mandatory condition.
Non-Negotiable Controls are hard gates
Non-Negotiable Controls protect tier integrity.
Where an NNC applies, it must be satisfied for the tier outcome permitted by the governing rules.
An applicable NNC cannot be:
- waived by an operator
- averaged into a score
- compensated for by unrelated passing controls
- ignored to preserve a desired tier
- hidden through bounded certification
If an applicable NNC fails, the resulting downgrade or certification consequence follows the governing rules.
There is no discretionary override.
Tier downgrade is mechanical
Where the conditions required for a tier are no longer satisfied, the applicable downgrade rules determine the resulting posture.
Downgrade is not a matter of preference.
It is not delayed because an operator considers the failed condition unimportant.
It is not suppressed to preserve a certification label.
Tier integrity depends on predictable consequences.
Full-tier certification
Full-tier certification means that the complete applicable requirements for that tier have been satisfied under the governing platform and certification specifications.
That includes the applicable:
- control set
- NNC requirements
- evidence requirements
- verification rules
- tier mathematics
- certification decision rules
Full-tier certification remains bounded by the evaluated device, state, specification versions, and validity period.
It is not a declaration of universal security.
Bounded certification
Where explicitly permitted by the applicable specifications, SHP may certify a defined subset of a tier.
It must be labelled exactly:
Tier X — Bounded Certification
A bounded certification must enumerate:
- the controls included
- the controls excluded
- the residual risk created by those exclusions
Bounded certification must never be represented as equivalent to full-tier certification.
It cannot override the absence or failure of an applicable Non-Negotiable Control.
If an applicable NNC fails, bounded certification cannot be used as a workaround.
Higher tiers are not simply “more secure”
A higher tier number represents a different defined posture under the applicable platform rules.
That may involve:
- additional controls
- stronger requirements
- different assumptions
- different operational constraints
- broader threat coverage
- tighter verification requirements
- different recovery expectations
The actual meaning comes from the applicable specifications.
A higher number should not be interpreted as a simple linear security score.
Tier meaning and certification status are different
A tier describes a hardening posture.
Certification status describes whether an active SHP certification currently represents that posture for a particular device state.
Those concepts must remain separate.
A device may historically have satisfied Tier 2 and later become:
Expired — Not Certified
or:
Revoked — Not Certified
or lose certification because material drift invalidated the evaluated state.
That does not change what Tier 2 meant at the time of certification.
It changes whether the device is currently certified.
Drift can change tier eligibility
Certification is state-bound.
If the system changes, the current state may no longer satisfy the conditions required for the certified tier.
The applicable drift rules determine whether:
- the tier remains valid
- downgrade is required
- certification is invalidated
- re-verification is required
The previous tier result is not permanently attached to the device.
Tier evaluation depends on versioned specifications
A tier result has meaning only under the versioned rules used to produce it.
That includes the applicable versions of:
- platform mathematics
- control catalogues
- verification logic
- evidence requirements
- certification decision rules
- tier mathematics
A tier result produced under one specification set must not be silently interpreted under another.
Historical certifications retain their historical meaning.
Bounded certification must remain visibly bounded
A bounded certification must never be presented in a way that could reasonably be mistaken for full-tier certification.
Its exclusions and residual risk must remain explicit.
The label:
Tier X — Bounded Certification
is part of the certification meaning, not optional presentation text.
Removing that qualification would misrepresent the certification state.
The tier model is part of certification governance
Tier evaluation does not operate independently of the rest of SHP.
The relationship is:
Control Results → NNC Evaluation → Tier Evaluation → Certification Eligibility
Verification provides the observed results.
Tier mathematics determines the applicable posture.
Certification logic determines whether that posture is eligible for SHP certification.
These layers are connected, but they are not interchangeable.
The specifications define the tiers
This page explains the SHP tier model.
The applicable versioned specifications define its technical meaning.
Those specifications govern:
- tier structure
- control sets
- dependencies
- applicability
- Non-Negotiable Controls
- downgrade behaviour
- bounded certification
- verification requirements
- certification eligibility
Where explanatory website text and an applicable normative specification differ, the governing specification controls.
Read the SHP Tier Mathematics Specification →