Where attestation belongs in each stage of a secure development life cycle, from design to retirement.
Most security life cycles end at release. Attestation makes the stages after release visible, which is where products spend most of their life.
Design: decide what is measured and who verifies. Build: produce expected measurements with every build. Make or deploy: give each unit an identity and a first proof. Operate: prove state on a schedule. Update: prove the new state and refuse the old. Retire: revoke identities and destroy keys.
A product that covers only the first three stages is attested once. One that covers all six is reattested.
Attested software supply chainAttested devicesContinuous compliance
Working on re-attestation for your product? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.