The Structured Hardening Project defines a governed method for establishing and evaluating bounded security postures.
It is built around explicit scope rather than universal security claims.
The standard connects:
Threat Models → Controls → Hardening → Evidence → Verification → Certification
Each part has a distinct role.
Start with the threat model
SHP does not begin by collecting security settings.
It begins by defining the security problem.
A platform threat model establishes the relevant adversaries, attack classes, assumptions, protected objectives, operational constraints, and explicit exclusions.
Controls are meaningful only within those boundaries.
A control designed for one platform or threat model is not automatically valid for another.
Controls must be complete
An SHP hardening control is not merely a recommendation.
Every control must define:
- What it does — the security property or exposure being addressed.
- How it is applied — the required configuration or implementation.
- How it is verified — the deterministic observation or evidence used to evaluate it.
- How it is recovered or rolled back — the defined path for reversing or recovering from the control.
A proposed control without verification or recovery is incomplete.
Non-Negotiable Controls
Some controls are designated Non-Negotiable Controls (NNCs).
NNCs are hard certification gates.
They cannot be waived merely because other controls pass, and bounded certification cannot be used to conceal their absence.
Failure of an applicable NNC affects certification mechanically under the applicable tier and platform rules.
There is no discretionary override.
Deterministic verification
SHP separates application of controls from evaluation of controls.
Verification tooling must be:
- open
- deterministic
- versioned
- reproducible
- capable of structured machine-readable output
A certification decision must map to verification evidence and the applicable decision rules.
Opaque certification logic is incompatible with the SHP model.
Bounded certification
Not every valid certification necessarily represents every control in a full tier.
Where the applicable specifications permit bounded certification, it must be identified explicitly as:
Tier X — Bounded Certification
A bounded certification must identify:
- the controls included
- the controls excluded
- the residual risk created by those exclusions
Bounded certification is not equivalent to full-tier certification.
It cannot override a missing or failed applicable Non-Negotiable Control.
Certification is not permanent
SHP certification is bound to an evaluated state.
It is:
- device-bound
- state-bound
- specification-bound
- time-bounded
A certification therefore describes a defined evaluated condition, not an enduring property of a device.
Expiry ends active certification.
Revocation ends active certification.
Material state change can require re-verification before certification can again represent the current system state.
Platform boundaries
No platform is implicitly supported.
A new platform requires formal definition before SHP certification claims can be made for it.
Platform-specific threat models, controls, verification behaviour, and certification rules remain structurally distinct.
No cross-platform equivalence should be inferred merely because two platforms use the same tier number.
Standard and service are separate
SHP is a structured hardening standard.
Services may be delivered under that standard, but service delivery does not redefine certification requirements or platform scope.
The standard defines the rules.
Verification evaluates observed state against those rules.
Certification is issued only under SHP-controlled certification authority.
Specifications
The website provides an accessible explanation of the SHP model.
The applicable versioned specifications remain authoritative for technical definitions and certification meaning.