Who runs PSA Certified today?

GlobalPlatform. The PSA Certified evaluation scheme was originally built by seven founding companies (Arm, the laboratories SGS Brightsight, CAICT, Riscure Keysight and UL, the consultancy Prove & Run, and TrustCB, which acted as the certification body) and Arm donated it to GlobalPlatform in September 2025. Work on the scheme now happens in the PSA Certified Working Group of the GlobalPlatform SESIP Committee, and the Level 1 questionnaire v3.1 of April 2026 is the first version published by GlobalPlatform.

What distinguishes Level 1, Level 2 and Level 3?

Level 1 is a questionnaire (about 50 questions, split into chip, system software and device sections) reviewed by an evaluation laboratory, with no penetration testing. Level 2 is a laboratory evaluation of the chip PSA Root of Trust against scalable software attacks, with a fixed effort of 25 days. Level 3 adds physical and side-channel attacks in the exploitation phase, with a 35-day effort. The Attack Methods document sets the attack ratings in scope at 0 to 15 for Level 2, 0 to 20 for Level 3 and 0 to 24 for Level 4.

Which SESIP level do PSA Certified Level 2 and Level 3 correspond to?

The SESIP Profile for PSA Certified Level 2 (GPS_SPE_112, v1.0, November 2025) claims SESIP 2. The SESIP Profile for PSA Certified Level 3 (GPS_SPE_111, v1.0, November 2025, previously JSADEN011) claims SESIP 3. They do not map to SESIP3, SESIP4 or SESIP5 as is often written. Each level can also be evaluated through the older CSPN-style Protection Profile, which leads to the same certificate.

Does Level 2 include side-channel and fault injection testing?

Not as an exploitation attack. The Attack Methods document states that at Level 2 physical attacks on the target are out of scope in the exploitation phase. A fault or side-channel attack on one sample is considered only if it exposes a class secret, such as a symmetric key shared by all devices, that then enables a simple software attack. Physical Attacker Resistance is a mandatory requirement only from Level 3.

What does PSA Certified API certification validate?

It validates that an implementation passes the PSA Certified API test suites. Two badges exist: PSA Certified API Compliance (Crypto API and Storage API mandatory, Attestation and Firmware Update APIs optional) and PSA Certified Crypto API Compliance for crypto vendors. PSA Certified states that API compliance is not necessary to obtain a PSA Certified security evaluation, and that chips running TF-M are automatically compliant because TF-M is a reference implementation.

Does a PSA Certified certificate give presumption of conformity under the RED or the CRA?

No. Under the RED, presumption for Article 3(3)(d), (e) and (f) comes from EN 18031-1, -2 and -3 as cited, with restrictions, by Implementing Decision (EU) 2025/138. Under the CRA, it comes from cited harmonised standards, common specifications or European cybersecurity certification schemes under Regulation (EU) 2019/881 (Article 27). PSA Certified is none of these. The Level 1 questionnaire v3.1 has optional sections that help collect CRA and RED evidence, but they are based on the European Parliament text of March 2024 and on the draft prEN 18031.

What is in a PSA attestation token?

RFC 9783 (June 2025) specifies the PSA attestation token as a profile of the Entity Attestation Token, CBOR-encoded and signed with COSE. Mandatory claims include the nonce, client ID, Instance ID (identifying the attestation key), Implementation ID, security lifecycle, software components and profile. The certification reference, an EAN-13 number plus a five-digit version, is optional, and there is no claim carrying a PSA Certified level.

PSA Certified: levels, SESIP profiles and the CRA

Hugues Orgitello updated 7 Oct 2026 14 min read

PSA Certified is a security evaluation scheme for the Root of Trust of a chip, with a questionnaire level that also covers system software and finished devices. It grew out of the Platform Security Architecture that Arm created, was built by seven founding companies, and was donated by Arm to GlobalPlatform in September 2025. Since then GlobalPlatform has republished the core documents: the SESIP profiles for Level 2 and Level 3 (November 2025), the Attack Methods (December 2025) and the Level 1 questionnaire v3.1 (April 2026). This guide follows those texts level by level, corrects the SESIP mapping that circulates widely (Level 2 claims SESIP 2, Level 3 claims SESIP 3), and places the scheme against ETSI EN 303 645, the RED and the Cyber Resilience Act, where it gives no presumption of conformity.

Who runs the scheme

PSA Certified lists seven founding companies: Arm, four evaluation laboratories (SGS Brightsight, CAICT, Riscure Keysight and UL), the security consultancy Prove & Run, and TrustCB, which acted as the certification body. PSA stands for Platform Security Architecture, the specification Arm created for a security-principles approach to device security.

The split of roles follows the Common Criteria (ISO/IEC 15408) logic. The Level 1 questionnaire defines them: the evaluation laboratory performs the technical review and submits the application; the certification body receives applications, issues certificates, maintains the scheme and ensures consistency across laboratories. GlobalPlatform now publishes its own list of member certification bodies approved for PSA Certified and SESIP, so check that list rather than assuming a single body.

Date	Event	Source
13 February 2019	Level 1 questionnaire v1.0, public release	Questionnaire v3.1, revision history
10 February 2020	Level 1 v2.0 beta: alignment with ETSI EN 303 645, NIST IR 8259 and California SB-327	Questionnaire v3.1, revision history
18 May 2022	Level 1 v2.2: draft alignment with Matter and ioXt	Questionnaire v3.1, revision history
November 2022	SESIP Profile for PSA Certified Level 3 (JSADEN011 v1.0 REL 02)	PSA Certified
10 November 2023	Level 1 v3.0 beta: new section 7 on regulations	Questionnaire v3.1, revision history
31 July 2024	Level 1 v3.1 beta: NIST IR 8425 and the US Cyber Trust Mark, updates for the CRA and the RED	Questionnaire v3.1, revision history
September 2025	Arm donates the PSA Certified scheme to GlobalPlatform	GlobalPlatform, PSA Certified
November 2025	SESIP Profiles for Level 2 (GPS_SPE_112, claim SESIP 2) and Level 3 (GPS_SPE_111, claim SESIP 3)	GlobalPlatform
December 2025	PSA Certified Attack Methods v1.0 (GPS_SPE_104, previously JSADEN004)	GlobalPlatform
April 2026	Level 1 questionnaire v3.1, first GlobalPlatform public release	GlobalPlatform

The PSA Root of Trust

The scheme certifies a security component called the PSA Root of Trust (PSA-RoT), the root of trust of a System on Chip. The Level 1 questionnaire places in the chip scope the elements of the Secure Processing Environment (SPE):

the Immutable Platform Root of Trust: boot ROM, root parameters, the isolation hardware between the Non-secure and Secure Processing Environments (NSPE and SPE), and hardware lifecycle management;
the updatable Platform Root of Trust: the main bootloader, the partition manager of the SPE and the PSA services such as attestation, secure storage and cryptography;
any trusted subsystem the PSA-RoT relies on, for example a secure element.

The questionnaire notes that the isolation between NSPE and SPE can be implemented with TrustZone, with dual cores or with processor privilege levels: the scheme is architecture neutral. The open-source Trusted Firmware-M (TF-M) project is the reference implementation of the PSA-RoT services.

The levels, as PSA Certified defines them

Level	What it demonstrates	Scope	Method	Fixed lab effort	SESIP claim
Level 1	Good security principles applied	Chip, system software or device	Questionnaire reviewed by a laboratory	Not fixed	None
Level 2	PSA-RoT protects against scalable software attacks	Chip PSA-RoT	Vulnerability analysis and penetration testing, white box	25 days	SESIP 2 (GPS_SPE_112)
Level 2 + Secure Element	Level 2 plus substantial physical protection of keys and crypto operations	Chip PSA-RoT with trusted subsystem	Level 2, with the subsystem certified to at least Level 3 RoT Component, SESIP 3 or AVA_VAN.3	Not stated	Level 2 profile
Level 3	PSA-RoT protects against substantial hardware and software attacks	Chip PSA-RoT	Vulnerability analysis and penetration testing, white box, physical attacks in scope	35 days	SESIP 3 (GPS_SPE_111)
Level 3 + Secure Element	Level 3 with a trusted subsystem certified to Level 4 iSE/SE	Chip PSA-RoT with trusted subsystem	Level 3	Not stated	Level 3 profile
Level 4 iSE/SE	High robustness of an integrated secure enclave or external secure element	Trusted subsystem	SESIP profile JSADEN023	Not stated	See profile
Level 2 or 3 RoT Component	Subset of the PSA-RoT requirements, for IP components	IP component	SESIP profiles	Not stated	See profile

The day counts come from PSA Certified: the 25 or 35 days cover Security Target review, vulnerability assessment, test plan, testing and the Evaluation Technical Report, and elapsed calendar time can differ. The SESIP profiles state the same figures as person-days for the AVA_VAN activities on a standard PSA-RoT, assuming source code is available, no added requirement, no reuse and one algorithm per cryptographic requirement.

PSA Certified also offers Level 2 Ready, a pre-certification for FPGA or development systems that assesses only the claimed functions. No Level 2 certificate is issued, only the right to a "Level 2 Ready" logo.

Level 1: the questionnaire

The current text is the Level 1 questionnaire v3.1 (April 2026). PSA Certified describes it as a 50-question assessment built from IoT threat models, the Platform Security Model and its 10 security goals, and government requirements. The 10 goals are an input, not a list of 10 requirements.

Element	What the questionnaire v3.1 says
Who fills it in	The chip vendor (section 4), the system software vendor (section 5) or the device OEM (section 6)
Layering	A certificate for a layer applies only if the lower layers hold a Level 1 certificate or are covered in the same evaluation; a device certificate is valid for one system software and chip combination
Answers	Yes, Partial or N/A, each with a description or rationale
Pass threshold	At most one question per section not answered as the "Expected answer" on the marking sheet, with a rationale of why security is unaffected; optional questions are not counted
Laboratory role	Checks that each rationale is consistent with the requirement, may ask for clarification, then submits the application to the certification body
Certificate number	A globally unique EAN-13 number, published with the product reference
Reuse	A variant with exactly the same answers can be submitted directly to the certification body, with no laboratory action, and gets a new EAN-13
Best practices (Annex A)	Organisational practices; laboratory verification of the assessable ones is optional but recommended

Section 7 is optional and covers regulations: the UK PSTI regulations (in force 29 April 2024), the EU Cyber Resilience Act and the RED cybersecurity requirements. Annex B maps the questionnaire to ETSI EN 303 645, NIST IR 8259A, NIST IR 8425 and the US Cyber Trust Mark, California SB-327, Matter and ioXt.

Level 2: scalable software attacks

PSA Certified states that Level 2 evaluation laboratories use vulnerability analysis and penetration testing to establish whether the nine security functional requirements of the PSA-RoT Protection Profile are met, against seven threats. Two equivalent routes lead to the same certificate: the CSPN-style Level 2 Protection Profile (simpler for a first certification) or the SESIP Profile GPS_SPE_112, preferred when the result will be reused in composition. Under the SESIP route, the SESIP standard can be the GlobalPlatform text or EN 17927.

A chip can obtain Level 1 and Level 2 at once, because Level 2 assesses both sets of requirements. For device makers using a Level 2 chip, PSA Certified asks that keys stored in the PSA-RoT be unique per device, so that one device does not become a honeypot for physical attacks.

Level 3: physical attacks in scope

Level 3 targets chips that must resist substantial hardware and software attacks. PSA Certified lists nine threats for the level, including T.PHYSICAL and T.SIDE_CHANNEL, and a 35-day white-box evaluation. The SESIP route uses GPS_SPE_111; the CSPN-style route uses the Level 3 Lightweight Protection Profile. PSA Certified says both should result in the same testing by the laboratory, are assessed by the same certification body team and lead to the same certificate.

Requirements per level (SESIP profiles)

Annex A of the Level 2 SESIP profile lists the security functional requirements by level. Y is mandatory, O optional, N/A not applicable.

SESIP requirement	Level 2	Level 3	Level 3 iSE/SE or Level 4 iSE/SE (trusted subsystem)
Attack rating in scope	0 to 15	0 to 20	0 to 20 (Level 3), 0 to 24 (Level 4)
Verification of Platform Identity	Y	Y	Y
Verification of Platform Instance Identity	Y	Y	O
Attestation of Platform Genuineness	Y	Y	O
Secure Initialization of Platform (the SESIP form of secure boot)	Y	Y	Y
Attestation of Platform State	Y	Y	O
Secure Update of Platform	Y	Y	Y
Physical Attacker Resistance	N/A	Y	Y
Isolation between SPE and NSPE	Y	Y	Y
Isolation between PSA-RoT and Application RoT	Y	Y	Y
Cryptographic Operation, Random Number Generator, Key Generation, KeyStore	Y	Y	Y
Secure storage (at least one form)	Y	Y	O
Audit Log Generation and Storage, Secure Debugging	O	O	O

Attack ratings and what is in scope

The Attack Methods document (GPS_SPE_104, December 2025) rates each attack by adding the points for identification and for exploitation, and sets the range a product must resist:

PSA Certified level	Attacks that must be considered	Out of scope
Level 2	Rating 0 to 15 inclusive	Above 15
Level 3	Rating 0 to 20 inclusive	Above 20
Level 4	Rating 0 to 24 inclusive	Above 24

The product fails if the evaluator shows one successful attack inside the range. The document also states that at Level 2 physical attacks on the target are out of scope in the exploitation phase: a fault injection on a sample counts only if it exposes a class secret (for example a symmetric key shared by all devices) that then allows a simple attack on any device. At Level 3 and Level 4, physical attacks during exploitation are permitted, and its worked example of a side-channel attack on AES is "only in scope for Level 3 and above".

PSA Certified API certification

Separate from the security levels, PSA Certified defines four APIs (Crypto, Secure Storage, Attestation, Firmware Update) and two compliance badges:

Badge	For whom	Requirement
PSA Certified API Compliance	Chip vendors, system software vendors, device manufacturers	Crypto API and Storage API (ITS, PS or both) mandatory; Attestation API and Firmware Update API optional
PSA Certified Crypto API Compliance	Crypto vendors (software libraries, accelerators, secure elements)	Compliance with the Crypto API specification

Compliance is shown by passing the API test suites. PSA Certified states that API compliance "is not necessary to achieve PSA Certified security evaluation", and that chips running TF-M are automatically compliant because TF-M is a reference implementation. An API badge says nothing about attack resistance.

The PSA attestation token

PSA attestation is specified in RFC 9783 (June 2025, an Independent Submission, not an IETF standard) as a profile of the Entity Attestation Token, encoded in CBOR and protected by COSE.

Claim	Content	Presence
Nonce	Challenge from the caller, 32, 48 or 64 bytes, proving freshness	Mandatory
Client ID	Security domain of the caller (negative for NSPE, positive for SPE)	Mandatory
Instance ID	Unique identifier of the Initial Attestation Key (33 bytes)	Mandatory
Implementation ID	Identifies the hardware assembly of the immutable PSA-RoT	Mandatory
Security Lifecycle	Current lifecycle state of the PSA-RoT	Mandatory
Software Components	Measurements of the software loaded by the PSA-RoT	Mandatory for PSA Security Model conformant implementations
Profile Definition	Token profile in use	Mandatory
Certification Reference	EAN-13 plus a five-digit version, linking to the PSA Certified database entry	Optional
Boot Seed	Value distinguishing boot sessions	Optional

There is no "certification level" claim: a verifier finds the certification status through the Certification Reference or the Implementation ID.

PSA Certified, the RED and the CRA

RED Article 3(3)

The RED cybersecurity requirements of Article 3(3)(d), (e) and (f) apply since 1 August 2025. Presumption of conformity comes from EN 18031-1, -2 and -3, cited with restrictions by Implementing Decision (EU) 2025/138. PSA Certified is not a harmonised standard. The Level 1 questionnaire v3.1 lets a developer answer the RED technical requirements of the standardisation request, but its section 7.3 still describes EN 18031 as prEN 18031 drafts in progress. A PSA certificate can support the technical file; it does not replace the EN 18031 assessment of the radio product.

Cyber Resilience Act

The CRA (Regulation (EU) 2024/2847) applies reporting obligations from 11 September 2026 and in full from 11 December 2027. Microprocessors and microcontrollers with security-related functionalities are class I important products (Annex III), tamper-resistant microprocessors and microcontrollers are class II, and smart cards or similar devices, including secure elements, are critical products (Annex IV). Presumption of conformity comes from harmonised standards cited in the Official Journal, common specifications, or certificates under a European cybersecurity certification scheme adopted under Regulation (EU) 2019/881 (Article 27). PSA Certified is a private scheme and none of these.

Section 7.2 of the questionnaire v3.1 offers an optional CRA evidence table that can be self-assessed or reviewed by a PSA Certified laboratory. It describes itself as a "preliminary mapping" and is based on the European Parliament "Texts Adopted" of 12 March 2024, not on the Regulation as published in the Official Journal. Check article and annex references against the final text before reusing it.

Claims the texts contradict

Common claim (including earlier versions of this page)	What the texts say
PSA Certified Level 2 maps to SESIP3, Level 3 to SESIP4 and SESIP5	The Level 2 SESIP profile (GPS_SPE_112) claims SESIP 2; the Level 3 profile (GPS_SPE_111) claims SESIP 3
Arm runs the scheme, with TrustCB as the only certification body	Arm donated the scheme to GlobalPlatform in September 2025; GlobalPlatform lists the approved certification bodies
Six founding companies	PSA Certified lists seven, including UL
Level 1 checks ten requirements	About 50 questions, split into chip, system software and device sections; the 10 security goals of the Platform Security Model are one of the inputs
Level 2 includes entry-level side-channel and fault-injection attacks	Physical attacks in the exploitation phase are out of scope at Level 2; Physical Attacker Resistance is N/A at Level 2 and mandatory at Level 3
Level 2 takes several months; no fixed effort is published for Level 3	PSA Certified publishes fixed evaluation efforts of 25 days (Level 2) and 35 days (Level 3); calendar time can differ
Level 3 overlaps Common Criteria EAL4+ to EAL5	The Level 3 profile claims SESIP 3 with an attack rating range of 0 to 20
The attestation report carries the PSA certification level	RFC 9783 has an optional Certification Reference (EAN-13 plus version), no level claim
API certification is needed for a security certificate	PSA Certified: API compliance is not necessary to achieve PSA Certified security evaluation
"PSA Certified Lite" is a Level 1 variant for small MCUs	No such programme appears in the PSA Certified level list or certification resources
PSA L2 or L3 will be recognised as a CRA conformity route	Article 27 of the CRA gives presumption only through cited harmonised standards, common specifications or schemes under Regulation (EU) 2019/881
NIST IR 8425 covers consumer-grade routers	NIST IR 8425 is the profile of the IoT core baseline for consumer IoT products; the questionnaire maps it to the US Cyber Trust Mark

Practical points for a product team

Read the certificate scope. A Level 1 device certificate is valid for one system software and chip combination; a chip certificate does not certify the device.
Pick the route by reuse. The CSPN-style profiles are simpler for a first certification; the SESIP profiles are the route when the result feeds a composition, for example a SESIP evaluation of the device.
Check the attack range, not the level name. A Level 2 chip is not evaluated against physical attacks in exploitation. If keys must resist a local attacker, look at Level 3 or Level 2 + Secure Element.
Keep per-device keys. PSA Certified asks device makers using Level 2 chips to keep PSA-RoT keys unique per device.
Keep the regulatory file separate. PSA evidence can support an EN 18031 or CRA technical file; it does not give presumption of conformity.

Going further

ETSI EN 303 645: consumer IoT cybersecurity, one of the Level 1 mappings
Cyber Resilience Act: European regulation applicable in full from 11 December 2027
RED pillar: general European radio framework and article 3.3
Glossary: definitions for root of trust, attestation, secure boot

Sources & references

GlobalPlatform, What is PSA Certified? (scheme donated by Arm in September 2025), GlobalPlatform globalplatform.org/what-is-psa-certified/
PSA Certified, About PSA Certified: founding companies and donation to GlobalPlatform, PSA Certified www.psacertified.org/about/
PSA Certified, What are the PSA Certified levels?, PSA Certified www.psacertified.org/getting-certified/
PSA Certified, Level 1: 50-question assessment and regulatory mappings, PSA Certified www.psacertified.org/getting-certified/silicon-vendor/overview/level-1/
PSA Certified, Level 2: 25-day evaluation, nine SFRs, two evaluation routes, PSA Certified www.psacertified.org/getting-certified/silicon-vendor/overview/level-2/
PSA Certified, Level 3: 35-day evaluation, threats and SFRs, PSA Certified www.psacertified.org/getting-certified/silicon-vendor/overview/level-3/
PSA Certified, Certification resources (current questionnaire, profiles and attack methods), PSA Certified www.psacertified.org/development-resources/certification-resources/
PSA Certified Level 1 Questionnaire v3.1, Public Release, April 2026, GlobalPlatform / PSA Certified www.psacertified.org/app/uploads/2026/04/GPS_SPE_101_PSACertified_Level1Questionnaire_v3.1_PublicRelease_signed.pdf
SESIP Profile for PSA Certified Level 2 v1.0 (GPS_SPE_112), November 2025, GlobalPlatform / PSA Certified www.psacertified.org/app/uploads/2025/12/GPS_SPE_112_PSACertified_Level_2_SESIP_Profile_v1.0.pdf
SESIP Profile for PSA Certified Level 3 v1.0 (GPS_SPE_111), November 2025, GlobalPlatform / PSA Certified www.psacertified.org/app/uploads/2025/12/GPS_SPE_111_PSACertified_Level_3_SESIP_Profile_v1.0_PublicRelease-2.pdf
PSA Certified Attack Methods v1.0 (GPS_SPE_104), December 2025, GlobalPlatform / PSA Certified www.psacertified.org/app/uploads/2025/12/GPS_SPE_104_PSACertified_AttackMethods_v1.0_PublicRelease_signed.pdf
PSA Certified, API certification and compliance badges, PSA Certified www.psacertified.org/getting-certified/functional-api-certification/
RFC 9783, PSA Attestation Token (Arm Platform Security Architecture), June 2025, RFC Editor www.rfc-editor.org/rfc/rfc9783
Arm Platform Security Architecture, specifications, Arm developer.arm.com/architectures/security-architectures/platform-security-architecture
GlobalPlatform SESIP, evaluation methodology for IoT platforms, GlobalPlatform globalplatform.org/sesip/
Regulation (EU) 2024/2847, Cyber Resilience Act, EUR-Lex eur-lex.europa.eu/eli/reg/2024/2847/oj
Implementing Decision (EU) 2025/138, citation of EN 18031-1/-2/-3 under the RED, EUR-Lex eur-lex.europa.eu/eli/dec_impl/2025/138/oj
NIST IR 8259A, IoT Device Cybersecurity Capability Core Baseline, NIST csrc.nist.gov/publications/detail/nistir/8259a/final
NIST IR 8425, Profile of the IoT Core Baseline for Consumer IoT Products, NIST csrc.nist.gov/pubs/ir/8425/final
ETSI EN 303 645, cyber security for consumer IoT (publication directory), ETSI www.etsi.org/deliver/etsi_en/303600_303699/303645/

Frequently asked questions

Who runs PSA Certified today?: GlobalPlatform. The PSA Certified evaluation scheme was originally built by seven founding companies (Arm, the laboratories SGS Brightsight, CAICT, Riscure Keysight and UL, the consultancy Prove & Run, and TrustCB, which acted as the certification body) and Arm donated it to GlobalPlatform in September 2025. Work on the scheme now happens in the PSA Certified Working Group of the GlobalPlatform SESIP Committee, and the Level 1 questionnaire v3.1 of April 2026 is the first version published by GlobalPlatform.
What distinguishes Level 1, Level 2 and Level 3?: Level 1 is a questionnaire (about 50 questions, split into chip, system software and device sections) reviewed by an evaluation laboratory, with no penetration testing. Level 2 is a laboratory evaluation of the chip PSA Root of Trust against scalable software attacks, with a fixed effort of 25 days. Level 3 adds physical and side-channel attacks in the exploitation phase, with a 35-day effort. The Attack Methods document sets the attack ratings in scope at 0 to 15 for Level 2, 0 to 20 for Level 3 and 0 to 24 for Level 4.
Which SESIP level do PSA Certified Level 2 and Level 3 correspond to?: The SESIP Profile for PSA Certified Level 2 (GPS_SPE_112, v1.0, November 2025) claims SESIP 2. The SESIP Profile for PSA Certified Level 3 (GPS_SPE_111, v1.0, November 2025, previously JSADEN011) claims SESIP 3. They do not map to SESIP3, SESIP4 or SESIP5 as is often written. Each level can also be evaluated through the older CSPN-style Protection Profile, which leads to the same certificate.
Does Level 2 include side-channel and fault injection testing?: Not as an exploitation attack. The Attack Methods document states that at Level 2 physical attacks on the target are out of scope in the exploitation phase. A fault or side-channel attack on one sample is considered only if it exposes a class secret, such as a symmetric key shared by all devices, that then enables a simple software attack. Physical Attacker Resistance is a mandatory requirement only from Level 3.
What does PSA Certified API certification validate?: It validates that an implementation passes the PSA Certified API test suites. Two badges exist: PSA Certified API Compliance (Crypto API and Storage API mandatory, Attestation and Firmware Update APIs optional) and PSA Certified Crypto API Compliance for crypto vendors. PSA Certified states that API compliance is not necessary to obtain a PSA Certified security evaluation, and that chips running TF-M are automatically compliant because TF-M is a reference implementation.
Does a PSA Certified certificate give presumption of conformity under the RED or the CRA?: No. Under the RED, presumption for Article 3(3)(d), (e) and (f) comes from EN 18031-1, -2 and -3 as cited, with restrictions, by Implementing Decision (EU) 2025/138. Under the CRA, it comes from cited harmonised standards, common specifications or European cybersecurity certification schemes under Regulation (EU) 2019/881 (Article 27). PSA Certified is none of these. The Level 1 questionnaire v3.1 has optional sections that help collect CRA and RED evidence, but they are based on the European Parliament text of March 2024 and on the draft prEN 18031.
What is in a PSA attestation token?: RFC 9783 (June 2025) specifies the PSA attestation token as a profile of the Entity Attestation Token, CBOR-encoded and signed with COSE. Mandatory claims include the nonce, client ID, Instance ID (identifying the attestation key), Implementation ID, security lifecycle, software components and profile. The certification reference, an EAN-13 number plus a five-digit version, is optional, and there is no claim carrying a PSA Certified level.