Arm’s Tailored Security Development Lifecycle
Arm has tailored Security Development Lifecycle processes for software, hardware, and solutions (like Arm Neoverse Compute Subsystems), all of which operate around a common framework.
Risk Evaluation in SDL
Arm integrates security into product development from the very beginning. Each project starts by defining security requirements that reflect the product’s intended use, market environment, and the types of threats it may face. These requirements identify what assets need protection, who potential adversaries are, and how the product will be deployed. With this foundation, our engineers perform structured threat modeling to anticipate possible attack scenarios. This ensures that high-level security objectives are captured early and that the design team can make informed decisions about how best to reduce risk.
The results of this evaluation are recorded in a Security Risk Assessment (SRA), a document that remains active throughout the lifecycle of the product. The SRA explains how threats map to specific countermeasures, what security controls have been built into the design, and any residual risks that partners should be aware of. By sharing summaries of this work with partners, Arm provides transparency into our approach and gives partners confidence that our technology is engineered with robust, clearly documented security measures from the outset.
Risk Reduction
Once risks are identified, Arm takes deliberate steps to reduce them before products reach our partners. Security objectives are translated into specific design and verification requirements, ensuring that protections are built into the hardware and software from the ground up. Engineers use attack-oriented testing methods, deliberately taking the perspective of an adversary to uncover weaknesses that might otherwise be missed. This process allows us to validate that countermeasures are effective and to refine them where necessary.
These efforts are not one-off checks — they are integrated into standard design and verification practices. As specifications evolve, so too do the associated security requirements and test plans. This continuous integration of security helps ensure that vulnerabilities are addressed early, reducing the cost and complexity of fixes while strengthening the overall trustworthiness of the product.
Risk Management
Security does not stop once a product ships. Arm maintains a continuous feedback loop to monitor, evaluate, and respond to emerging risks across our global ecosystem. Central to this is our Product Security Incident Response Team (PSIRT), which works closely with researchers, customers, and partners to discover, analyze, and resolve new vulnerabilities. As a CVE Numbering Authority (CNA), Arm ensures that issues are tracked transparently and disclosed responsibly, giving stakeholders the time and guidance they need to deploy mitigations effectively.
The insights gained through PSIRT activities are fed directly back into our Secure Development Lifecycle (SDL). This ensures that lessons learned from real-world incidents inform future designs and updates, continuously raising the bar for product resilience. By combining structured SDL processes with ongoing incident response, Arm delivers a lifecycle approach that protects today’s deployments while preparing for tomorrow’s threats.
Ensuring Continued Success
The SDL is not static. Arm regularly updates practices to respond to:
- Emerging threats (e.g., side-channel attacks, speculative execution issues).
- Customer and regulatory requirements across global markets.
- Advances in both hardware and software development methodologies.
Arm does so by utilizing the iterative process below to ensure that Arm’s SDL, technologies, and software remain robust, future-proof, and trusted by the industry.
Independent Product Security Assurance
- A dedicated assurance team continuously reviews and validates Arm’s SDL and PSIRT processes, ensuring they remain effective and aligned with evolving threats.
Proactive Community and Standards Engagement
- Arm actively contributes to academic, industry, and standards communities—such as IEEE, IETF, and MITRE—and holds status as a CVE Numbering Authority (CNA) for Arm-branded products and managed open-source projects.
Proactive Security Testing
- Penetration testing and red teaming teams continually search for security weaknesses in Arm technologies and software.
- The Arm Bug Bounty Program harnesses external expertise to uncover vulnerabilities early, ensuring faster remediation and continuous improvement in product resilience.