How does LrrK use MITRE EMB3D™?

Attributes uses MITRE’s published EMB3D properties, threats and mitigations to frame assessment questions for embedded devices. Mappings are planning candidates—not findings, scores, proof of vulnerability or safety, or a complete list. EMB3D is a MITRE model, not LrrK’s internal standard, and LrrK is not endorsed by MITRE. LrrK’s earlier HW-01–HW-09 labels are retired.

Does LrrK replace NIST CSF, IEC 62443 or SOC 2?

No. The proposed evidence method can link scoped observations and claims to relevant requirements; it does not replace a programme, audit, attestation or certification.

What does a Product Security Passport establish?

It is an evidence record with configuration, scope, time, review, limitations and reassessment triggers—not certification or a safety guarantee. Signing, publication and access depend on agreed scope.

How are negative or inconclusive results handled?

Record not established, rejected, inconclusive or not evaluated with method and limits. A missing result is not evidence of safety or absence.

How often is evidence updated?

A reassessment trigger or human-governed cadence is agreed within scope. This site does not claim continuous customer monitoring or automatic updates.

Does broader hardware coverage expand current offers?

No. Priority environments guide assessment questions; the current consumer-robotics catalog, request scopes and terms remain unchanged.

Reference

Assurance frameworks and bounded evidenceConnect requirements to evidence without overstating what either establishes.

Existing assurance programmes and LrrK’s proposed evidence method answer different questions. A scoped record helps a reviewer inspect sources, methods and limits for a deploy, update, operate or replace decision; it is not a replacement certification or proof of operating effectiveness. The November 1 standard v0.1 remains a proposed model.

List your device’s properties in the MITRE EMB3D™ mapper to see which threats and mitigations are worth asking about. The results are planning candidates, not findings. Current engagements focus on consumer robotics; suitability and any testing are confirmed during scope review.

Attributes →

Existing programmes and their scope

NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond and Recover.; Boundary — An organizational risk-management framework; apply it to an explicit profile and context.
IEC 62443: Security requirements for industrial automation and control systems.; Boundary — Applicability depends on system, component, role and the relevant part of the standard.
SOC 2: An attestation on controls within a defined system and reporting scope.; Boundary — Read the actual report scope and period; do not infer a whole-device safety claim.
ISO/IEC 27001: An information security management system.; Boundary — Management-system certification is not a guarantee about every component or operating configuration.

Requirements, claims and records

Keep the reasoning and evidence locator attached to a claim. A reader should be able to challenge an interpretation and inspect what was actually observed. No automatic security score substitutes for independent human review.

Requirement and evidence: An applicable programme identifies requirements and its reporting scope.; The proposed LrrK record attaches a source or method, configuration and time boundary to a claim.
Observed and inferred: Preserve the programme’s actual findings and qualifications.; Distinguish observation, inference, human judgment, recommendation and unknowns; do not collapse them into an automatic score.
Currentness: Read the assessment window and conditions in the original record.; Record reassessment triggers or an agreed human review cadence—not presumed continuous monitoring.

How the model complements existing assurance programmes

Requirement mapping: Link an evidence locator to a relevant requirement where appropriate; do not assert conformance from a citation alone.
Owner authority: Source review and testing have explicit boundaries. Physical testing requires separately agreed authority, access, capability and recovery/stop conditions.
Review and handoff: Independent human review challenges the claim and unknowns before a decision record and practical handoff.
Evidence category: Researched mechanisms, controlled demonstrations, operational incidents and scoped LrrK findings are not interchangeable.

Common questions

How does LrrK use MITRE EMB3D™?: Attributes uses MITRE’s published EMB3D properties, threats and mitigations to frame assessment questions for embedded devices. Mappings are planning candidates—not findings, scores, proof of vulnerability or safety, or a complete list. EMB3D is a MITRE model, not LrrK’s internal standard, and LrrK is not endorsed by MITRE. LrrK’s earlier HW-01–HW-09 labels are retired.
Does LrrK replace NIST CSF, IEC 62443 or SOC 2?: No. The proposed evidence method can link scoped observations and claims to relevant requirements; it does not replace a programme, audit, attestation or certification.
What does a Product Security Passport establish?: It is an evidence record with configuration, scope, time, review, limitations and reassessment triggers—not certification or a safety guarantee. Signing, publication and access depend on agreed scope.
How are negative or inconclusive results handled?: Record not established, rejected, inconclusive or not evaluated with method and limits. A missing result is not evidence of safety or absence.
How often is evidence updated?: A reassessment trigger or human-governed cadence is agreed within scope. This site does not claim continuous customer monitoring or automatic updates.
Does broader hardware coverage expand current offers?: No. Priority environments guide assessment questions; the current consumer-robotics catalog, request scopes and terms remain unchanged.

Where to read further

The evidence method explains applicability and handling. The Atlas illustrates the record structure using synthetic fixtures, not findings about fielded machines.

Read the Security Story method →Browse the Assurance Atlas →Request an assessment →

Nothing on this page is a certification, approval, warranty, or guarantee of safety. Atlas and Lab fixture interfaces are demonstrations; real request forms and published research are separate. No signing, publication or availability is implied by this reference.