Navigating the OCP S.A.F.E.™ Process for Vendors

Thank you for attending our presentation at OCP APAC Summit 2026!

Find us in Taipei! If you missed us, you can also reach out through our Contact page.

Rob Wood

Rickey Wang

OCP S.A.F.E. 術語對照表

Back to top

SFR Example

Below is an excerpt of an example Short Form Report (SFR), the machine-readable artefact produced at the end of an OCP S.A.F.E. review. Below is the human-readable JSON version of the signed and encoded CoRIM object. It contains a hash of the firmware and the files reviewed, as well as basic information on the findings. The full report objects are available in the OCP S.A.F.E. reports repository.

{
    "review_framework_version": "1.1",
    "device": {
        "vendor": "AMI",
        "product": "MegaRAC Community Edition",
        "category": "BMC Firmware",
        "repo_tag": "CE-AMI202510",
        "fw_version": "2.1-dev",
        "fw_hash_sha2_384": "ad9d2c...0cd34ce",
        "manifest": [
            {
                "file_name": "openbmc/.../pid-control_%.bbappend",
                "file_hash": "de51c...a00a975"
            },
            ...
        ]
    },
    "audit": {
        "srp": "Tetrel Security Inc.",
        "methodology": "Whitebox Review",
        "completion_date": "2025-10-09",
        "report_version": "2.0",
        "scope_number": "1",
        "cvss_version": "4.0",
        "issues": [
            {
                "title": "Insecure IPMI Password Management",
                "cvss_score": "4.5",
                "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:H/SI:H/SA:L",
                "cwe": "CWE-522: Insufficiently Protected Credentials",
                "description": "The encryption key used to protect the IPMI password file is stored alongside the encrypted password. Further key management improvements involve support for hardware cryptography, and are dependent on the choice of hardware platform, which is left as an effort to the OEM. Furthermore, CVE-2013-4786 is codified in the IPMI specification and so it is recommended to disable IPMI during deployment.",
                "cve": "CVE-2013-4786"
            },
            {
                "title": "All Processes Run as Root",
                "cvss_score": "1.8",
                "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
                "cwe": "CWE-269: Improper Privilege Management",
                "description": "Nearly all processes on the system run as the `root` user. This is in violation of the *principle of least privilege*. Some of the processes of concern have significant external attack surfaces which, if compromised, would lead to a complete compromise of the BMC. This is also tracked against the upstream project at https://github.com/openbmc/openbmc/issues/3383",
                "cve": null
            },
            ...
        ]
    }
}

Back to top

Commonly Asked Questions

What is the OCP S.A.F.E. program? The OCP Security Appraisal Framework and Enablement (OCP S.A.F.E.) program is the standard for assessing the security of the firmware supply chain for modern data centres. Tetrel is a Security Review Provider (SRP). Our team has been involved since the program’s inception. As an approved SRP, we conduct the independent and rigorous security reviews that enable component vendors to reduce audit overhead, meet the security requirements of hyperscale cloud providers, and demonstrate trustworthy hardware and firmware.

What are the three review scopes?

1. Scope 1 covers the external attack surface of the firmware: any interface that can be attacked from outside the SoC, including external flash memories, serial and debug interfaces, PCIe and other host interfaces.
2. Scope 2 includes all of Scope 1, and additionally the local attack surfaces within the device: attack surfaces between internal components and subsystems within the module or device.
3. Scope 3 focuses on the physical attack surface of the hardware itself, such as fault injection attacks and cryptographic side-channel leakage.

What reports are created? Every assessment produces a Long Form Report describing all of the findings, with prescriptive guidance to allow efficient remediation. This is for your internal use and need not be published. Once issues are fixed to your satisfaction, we can validate those fixes and issue a Short Form Report (SFR): a machine-readable and cryptographically signed CoRIM artefact that you may publish to the OCP repository if and when you choose. Publication is necessary for OCP S.A.F.E. endorsement.

What is OCP S.O.L.I.D.? The OCP Securing Of Latest Infrastructure Devices (S.O.L.I.D.) specification sets out the minimum security feature requirements (including business process requirements) that the CSPs expect devices to meet. Because the OCP S.A.F.E. program has no pass/fail criteria, S.O.L.I.D. extends the framework to provide such a minimum criteria. Tetrel reviews these self-declarations as part of OCP S.A.F.E. assessments; however, OCP S.A.F.E. goes much further than this minimum set of requirements.

What about Caliptra? Caliptra is an open-source project delivering a Silicon Root of Trust (RoT) specification and implementation, providing unforgeable device identity and a verifiable cryptographic mechanism to ensure that only trusted firmware runs on a device. Tetrel is an active SRP providing Caliptra Trademark Audit services to device vendors who wish to use the Caliptra trademark after integrating the Caliptra IP into their products.

Back to top

Common Risks

Overall project timelines are often impacted by the following delays:

1. Contract paperwork: This can understandably vary widely between clients. Tetrel aims to be nimble and can often achieve the necessary documentation review and agreements in a very short time. This most often depends on your own legal or procurement processes, which is naturally out of our hands. Our typical paperwork includes the following:
   • Statement of Work (SoW): This is the per-project part of the agreement and mostly covers technical details of scope, fees, timelines, etc.
   • Master Services Agreement (MSA): This is the main contract framework that governs our client relationship. Under this master agreement, we can work on any number of individual projects (SoWs).
   • Mutual Non-Disclosure Agreement (MNDA): Optional, this is redundantly covered by the MSA, but frequently a standalone MNDA can accelerate information sharing while the MSA is negotiated in parallel. Occasionally, multi-party NDAs may be required to review your firmware.
   • Purchase Order (PO): Some client procurement processes require this to be issued before we can start work over and above a signed SoW.
2. Kick-off delays: We would typically agree on a start date by working backward from whatever deadline your project has. To start on time, we rely on you to provide everything we need in a timely manner. This primarily includes the design artefacts and source code of the in-scope target, OCP S.O.L.I.D. self-assessment, and (if applicable) Caliptra integration evidence.
3. Overall project scope: The size of the project can obviously add effort. To help constrain the calendar time, we would typically assign more resources when it makes sense to do so and pending staffing availability. Large projects often lend themselves to multiple parallel activities. Even large projects rarely exceed 5 or 6 calendar weeks.
4. Remediation delays: If there are any discoveries you would like to fix before the final SFR is created, then time will be needed for your staff to go and make those fixes. This is a delay entirely on your side, and it is difficult for us to predict. We’ve seen clients take less than a day to fix things, and others take several months. This depends on your own processes. After remediation, the retesting is usually quick, but we recommend allocating time for a couple of iterations in case multiple iterations of fixes are needed (it is uncommon, but does happen).

Back to top

Find our people at the OCP event in Taipei, or reach out through the Contact link, and we will happily begin the discussion.