Introduction to hardware certification

Ensuring your hardware is certified is a critical process of the overall security program. As you purchase new servers, PCs, storage, and peripherals, it is critical you validate that the hardware is compatible with your deployed systems. Using non-compliant hardware could make your hardware vulnerable to a compromise or the additional hardware components could even have a compromise already embedded in them.

An example would be allowing the use of USB drives on your devices. Users receiving a free USB drive don't realize that the drive itself could be infected and that, once inserted into your device, it could compromise your entire organization. Because of this, it is critical you only allow pre-certified USB drives that are encrypted and provided by the organization to be used by employees. Any data that is copied from a USB drive to a company device must require encryption. Another concern, as mentioned previously, is the supply chain...