- NSA released two reports addressing intentional threats to ASICs during development and manufacturing
- The ASIC threat catalog identifies 18 categories of potential adversary compromises
- NSA’s LoA1 report is the first of three planned publications on ASIC assurance
The National Security Agency has issued new guidance to help government agencies and industry contractors identify and mitigate threats to application-specific integrated circuits, or ASICs, the agency announced Tuesday.
NSA released two technical reports, the ASIC Best Practices Threat Catalog and the Application-Specific Integrated Circuit Level of Assurance 1, or LoA1, Best Practices, developed with the Department of War’s Joint Federated Assurance Center Hardware Assurance Laboratories. The reports address intentional threats that could affect ASICs during development and manufacturing.
The NSA’s ASIC guidance highlights the evolving cybersecurity challenges facing technologies critical to national security. The Potomac Officers Club’s 2026 Intel Summit on Sept. 24 will bring intelligence leaders and industry executives together to discuss AI, cyber capabilities, data and secure information-sharing. Save your seat today!
JFAC previously outlined three levels of hardware assurance in a 2022 technical report covering custom microelectronic components, including field-programmable gate arrays and application-specific integrated circuits, used in Department of War systems.
What Threats Do the NSA Reports Address?
The ASIC Best Practices Threat Catalog organizes potential adversary compromises into 18 categories and identifies mitigation measures for the threats. The categories cover parts of the ASIC development process, including design requirements, IT systems, electronic design automation software and third-party intellectual property.
The ASIC LoA1 Best Practices report marks the first of three planned publications on intentional threats to ASICs. The technical reports are intended to establish three levels of assurance for custom microelectronic hardware.
How Will the Assurance Reports Assess Threats?
The LoA reports will characterize threats from the catalog using factors including the access needed to conduct an attack, the technological complexity required and the resources needed to carry it out. The reports will also consider the potential effectiveness of an attack and how reliably an adversary could direct it toward a particular target, effect and time.
The first assurance report applies to ASIC-based designs in which system failure could potentially affect U.S. government capabilities. NSA said the report was developed using public use cases and input from subject matter experts specializing in ASIC design, hardware security, wafer manufacturing and supply chain assurance.
