Security

Nordic takes security to the next level

The importance of security

Nordic Semiconductor is a leading provider of low-power wireless communication solutions. We offer a range of security features within all product series and have partnered with leading security providers to offer a complete end-to-end security solution for our customers.

Security is becoming increasingly important within the IoT and wireless connectivity. Given the increasing sophistication of modern cybersecurity threats, it is important to prioritize and define security requirements early in the design process. Nordic offers security enablers that ensure a successful implementation of the security level needed for your specific IoT device.

Nordic is committed to resolving vulnerabilities to meet the needs of our customers and associated industry regulations. If you have discovered a potential security vulnerability in a Nordic Semiconductor product or service, please submit a vulnerability report.

Cyber-resilience, from chip to cloud

There are already an estimated 20 billion connected IoT devices in the world, and by 2030 that number is expected to nearly double[1]. Attackers have noticed: in 2025, the average household faced around 29 attack attempts a day, nearly triple the year before[2]. Regulators are responding. The EU Cyber Resilience Act (CRA) makes cyber-resilience a legal requirement for most connected products sold in the EU from design to decommissioning, covering secure design, lifecycle and vulnerability management, security updates and vulnerability reporting.

Meeting that bar takes more than security features in silicon. Nordic’s chip-to-cloud security covers the whole product lifecycle:

  • Secure hardware: next-generation SoCs with built-in protection such as isolation, cryptographic acceleration and tamper detection
  • Secure firmware: IronSide, Nordic’s secure firmware, built on industry best practices and optimized for Nordic hardware, secure by design and by default.
  • Lifecycle management: nRF Cloud and Nordic’s SDKs for firmware updates, CVE monitoring, vulnerability notifications and long-term support, so you can update and observe devices wherever they are deployed.


Additionally, Nordic provides comprehensive technical documentation, DevAcademy courses and world-class technical support and tooling to enable developers implement secure products with ease. Explore Nordic’s CRA resources further through this link.

[1] IoT Analytics, State of IoT 2025.
[2] Bitdefender and NETGEAR, 2025 IoT Security Landscape Report.

Creating secure products with ease

 The industry is coming together to create streamlined best practices, frameworks, and certifications. Nordic aligns with PSA CertifiedTM to provide a standardized approach to security that guides customers through their individual security journey. Below we have highlighted a few simplified steps, guiding you towards a successful result:

Analyze - Threat models & security analysis

Analyze - Threat models & security analysis

Understand the critical assets that need to be protected in your product, and what threats that have the potential to compromise it, to identify the most effective security measures.
Architect - Hardware & firmware specifications

Architect - Hardware & firmware specifications

Once the analysis is concluded it needs to be translated into technical specifications.
Implement - Firmware Source code

Implement - Firmware Source code

The required features must be implemented in the firmware, based on high-level APIs that interface to the hardware root of trust.
Icon of a document with a medal on it

Certify - Independently tested

The final step to confirm that all requirements have been satisfied and to establish the reliability of your product is an independent security assessment of your device.

Security goals and objectives

At Nordic we have a clear goal when it comes to security. Enable everyone to design and deploy secure products, by:

  1. Making the right choices from the start.
  2. Understanding the threats and value of security
  3. Protecting critical assets against common threats

IoT product security can be divided into a few simple objectives every product should meet.

Secure boot and secure update with anti-rollback

Secure boot and secure update with anti-rollback

Security starts at boot time to ensure that only authorized software can be executed and updated on a device. Reinstating previous software versions should be prevented to ensure that fixed security issues don't become exposed.
Isolation between secure and non-secure environments

Isolation between secure and non-secure environments

There must be separation between trusted and un-trusted services to avoid compromising the entire device. Un-trusted services should interact with trusted services through APIs that ensure functionality while keeping confidentiality of critical data and resources.
Secure storage

Secure storage

Critical assets must be uniquely bound to each device and protected from any intrusion, to ensure confidentiality and integrity.
Attestation and unique identification

Attestation and unique identification

Every device should be uniquely identifiable and attestable so that a trusted interaction can be established. See the nRF Cloud Security Services for more information.

Security Lifecycle

Security Lifecycle

Device security must be defined through different product lifecycle phases, from initial assembly to decommissioning and every step in between. The nRF Cloud Security Services can simplify some of the lifecycle phases.
Cryptographic services

Cryptographic services

A secure product sits on top of a set of trusted cryptographic services to enable the implementation of all required security features.