Firmware-Based TPM 2.0 Security Comes to Variscite i.MX SoMs With SecEdge

Adding TPM 2.0 to an embedded product usually starts with a hardware question: where does the security chip go? On Variscite’s i.MX-based modules, there is now another answer. Variscite and SecEdge are bringing SecEdge’s TPM 2.0 firmware, anchored in the processor’s own security hardware, to Variscite’s i.MX System on Module portfolio.

What is Firmware TPM and How Does It Run on i.MX Processors?

The TPM 2.0 specification from the Trusted Computing Group (TCG) defines a protected environment that a device relies on for secure boot, for establishing its identity, and for storing and using cryptographic keys. It can be implemented either in a dedicated security chip or as firmware executed by the main processor. SEC-TPM takes the firmware route: it is a TCG-compliant fTPM that runs inside OP-TEE’s secure world, with Arm TrustZone providing the isolation. On Variscite’s i.MX 95 and i.MX 93 modules, SEC-TPM can draw on the processor’s built-in security architecture, with NXP’s EdgeLock Secure Enclave serving as its root of trust. In practice, the processor a team has already selected is all it takes to provide TPM 2.0 functionality.

What the Cyber Resilience Act Requires, and When

The European Union’s Cyber Resilience Act (CRA) has entered into force, and its first obligations already apply. Reporting obligations took effect on September 11, 2026, and they require manufacturers to report severe incidents, as well as vulnerabilities that are being actively exploited, within 24 hours, and to submit a complete notification within 72 hours. Full application follows on December 11, 2027, when products must be secure by default, must ship free of known vulnerabilities, must receive security updates at no cost for a support period of five years, and must complete a conformity assessment before they can carry CE marking.
All of these requirements rest on two capabilities: a device has to prove its identity, and it has to keep its keys protected. SEC-TPM gives system integrators and OEMs a standards-based approach to both, running on the processor that’s already designed in, with no board respin required.
Variscite backs its customers through this transition in several ways: maintained BSP branches that receive security fixes for both the kernel and packages, documentation for TPM integration and secure boot on the Variscite Developer Center, and longevity programs of 7 to 15 years, far exceeding the five-year support period the CRA sets as its default.

Variscite’s VAR-SOM-6UL

Already in the Field? Adding Security With No Board Respin

SEC-TPM isn’t reserved for new designs. Systems that have already been developed, or are already deployed, can adopt it too, provided secure firmware updates are supported on the device. For engineering teams, this opens a way to work toward CRA readiness before the regulation’s full application in December 2027, without redesigning the board. New designs can carry their security architecture forward as the next i.MX generations come along. And within each of Variscite’s pin-compatible families, upgrading to a more powerful module doesn’t require reworking the security design.

SecEdge and Variscite on Firmware TPM 2.0

“The future belongs to trusted devices. As regulatory requirements increase and cyber threats evolve, manufacturers need security that is both proven and practical,” said Sami Nassar, SecEdge CEO. “Our collaboration with Variscite brings hardware-anchored embedded TPM 2.0 security to millions of edge devices using the silicon already deployed in the field, accelerating the path to trusted and resilient digital infrastructure.”
“The CRA does not only apply to whatever our customers are designing now. It applies to everything they already launched and shipped to the market,” said Ofer Austerlitz, VP of Business Development and Sales at Variscite. “SEC-TPM is available across our i.MX-based modules, so implementing it on Variscite products allows our customers to reach TPM 2.0 seamlessly and with no need to redesign their hardware.”

Getting Started With SEC-TPM on Variscite SoMs

While SEC-TPM is already integrated and documented for Variscite’s i.MX 6, i.MX 7, i.MX 8, and i.MX 9 SoM families, it’s important to remember that TPM is only one layer of a device’s security, alongside secure boot, maintained BSPs, and ongoing security updates. Visit Variscite’s Software & Security hub to see how these pieces work together on your design.