What it means
Bare-metal provisioning security protects installation media, firmware settings, deployment networks, bootstrap credentials, hardware identity, and the first configuration applied to a physical server.
Why it matters
The earliest deployment stage often has broad network and credential access but limited monitoring, making it a high-value point for persistent compromise.
Practical focus
- Define the trust path from hardware receipt through first managed boot and the security outcome it must support
- Apply verified media, isolated provisioning, protected bootstrap secrets, approved firmware, and baseline application through documented, reviewable configuration
- Verify firmware state, installation source, hardware inventory, and baseline attestation after changes and on a scheduled basis
- Plan for a compromised image, exposed provisioning service, or unmanaged first boot, including rollback, ownership, and escalation
Common mistakes
- Enabling a feature without defining what it should protect
- Relying on defaults or one-time validation
- Granting broad exceptions that erase the control boundary
- Treating a compromised image, exposed provisioning service, or unmanaged first boot as an operational surprise instead of a test case
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: