# Boot Startup Security Boot startup security is the combined policy governing which firmware, bootloader, operating-system image, recovery path, and external boot medium a device will execute. ## Stage placement The policy spans hardware-rooted state, pre-OS firmware, bootloader lock and rollback rules, signed images, recovery configuration, and—where supported—network boot. ## Evidence to preserve Record the exact device and platform generation, firmware version, secure-boot state, enrolled keys, boot order, external-boot policy, bootloader lock, rollback level, recovery mode, and any one-time-programmable or fuse-backed state. ## Evidentiary boundary A blocked boot, visible warning, or locked setting identifies a policy outcome. It does not alone identify who set the policy or whether that authority was legitimate. ## Source [[Index - Stages of Interception#Stage 3 — Pre-OS firmware, boot policy, and network boot|Stage 3]] · [[Pre-OS Trust Boundary]] · [[Factory Reset Protection]].