Educational guidance by GC Solutions LLC. Not a formal assessment, certification or production change authorization.
Start with the control claim
An HSM can be an important protection boundary, but a platform name does not establish how that boundary is configured, operated or relied upon. Begin by stating the claim you need to evaluate: who can administer the device, who can authorize a key operation, what custody procedures apply, and which business services depend on the result.
Distinguish a documented control from evidence that it has operated. A procedure may describe dual control, while access assignments, ceremony records and approval traces are needed to evaluate whether the relevant activity required distinct authorized people.
Make the evidence chain usable
For each material control, record an owner, the relevant system or key domain, the evidence source, the review date and any limitations. Include version-specific configuration records, access reviews, ceremony documentation, exception decisions and recovery exercise results where permitted.
Do not transfer production exports or key material through a marketing form. Agree a secure evidence channel and a minimized review scope first. A useful evidence register should identify what can be inspected without collecting material that the assessor does not need.
Review the whole lifecycle
Generation, import, storage, use, rotation, backup, recovery and retirement can involve different owners and authorization paths. A control that works during ordinary use may be ineffective during an emergency recovery or vendor maintenance event. Review exception paths as well as the normal procedure.
Split knowledge and dual control are related but distinct safeguards. Do not infer a quorum or a custody threshold from the number of backup cards or custodians listed in a document. Confirm the actual authorization model and its implementation for the exact platform and version.
Give unknowns an owner
Missing or stale evidence should remain an explicit limitation, not become a passing assessment. Prioritize the gap according to consequence: which payment, identity or communications function could be affected, what evidence would resolve the question, and who can obtain it.
An executive briefing should separate observed findings, documented assertions and unresolved questions. That distinction supports targeted remediation and defensible investment without promising certification or a risk-free environment.