Which correctly describes the idea of composition emphasized in PSA Certified and SESIP, security certification frameworks for IoT devices?

Answer: A. When a product is built on a certified chip or root of trust, its evaluation results are reused, and the device maker is evaluated mainly on the parts it added

IoT devices come in many varieties, and putting each one through a heavy evaluation such as Common Criteria is costly in money and time. PSA Certified (a framework by Arm and others started in 2019) and SESIP defined by GlobalPlatform (an evaluation method that later also became the European standard EN 17927) take a compositional approach: each layer, such as the chip, the root of trust and the OS, is evaluated, and higher layers build their evaluations on those results. Device makers can thus choose certified components and concentrate on evaluating what they added. However, certification of lower layers does not guarantee the security of higher layers, so the higher layers must be evaluated and the conditions of use for the components must be observed.

• A. Correct. The evaluation results of lower layers are reused in evaluating higher layers.
• B. The approach assumes components from different companies are combined.
• C. Certification of lower layers does not guarantee freedom from vulnerabilities in the software of higher layers.