Four kinds of help, each useful by itself

Step 1 · Two days

Team training

Teams that will build or buy attested systems and want the same foundation first.

• The two-day course Confidential Remote Computing: from the trusted computing base to enclaves, confidential virtual machines and attestation.
• In person, at your premises or at a venue we arrange, for up to six people, with a certificate.
• A shared vocabulary in your team, so the review that follows takes days.

Step 2 · Two weeks

Reattestation Review

Teams that want to know where their proof goes stale, and what the law will ask of them.

• A lifecycle map of your product: every update, repair, reset, expiry and handover that should force a new proof.
• A rule map: each requirement that touches integrity, identity or updates, mapped to evidence your product can produce. It covers eIDAS 2.0, the Cyber Resilience Act, the Machinery Regulation, UN R155 and R156, IEC 62443 and the AI Act, as they apply to you.
• Each gap ranked by what it costs you and by its deadline.
• A design for closing the top gaps, written for your engineers.

What the written result contains

• Your product on one page: what it is, how it changes, who relies on it.
• The event map: every update, repair, reset, expiry and handover, with what is proved today.
• The rule map: each requirement that applies to you, and the evidence your product can produce for it.
• The gaps, ranked by cost and by deadline: blocked sales, failed audits, fleets you could not recover.
• A design for the three most expensive gaps, with the standards it uses.
• What to tell customers and auditors now, and what to promise for later.
• A plan in steps your engineers can schedule.

Step 3 · After a review

Evidence Pack

Vendors whose deals wait on a customer's security review.

• A document your buyer's security team can act on: what is attested, by which hardware, against which reference values.
• Verification steps and tooling the customer runs on their side.
• A statement of what happens after each change, so the answer is still true next quarter.
• It builds on a Reattestation Review, or on attestation you already run.

Step 4 · Monthly

Retainer

Teams that ship often and want their proof to keep up.

• A check of each release: what changed in what you measure, and what your verifier has to learn.
• A short note after each vulnerability that touches your product: what it means, and what to prove again.
• Preparation for each audit and each large customer review, from evidence you already hold.
• A fixed number of hours each month, agreed in writing.