Option 6 — Enabled System Integrity Policy#

flowchart TD
    BOOT([System Boot / Policy Load]) --> ESP{Signed Policy\nin EFI Partition?}
    ESP -- Yes --> VERIFY_SIGN[Verify CMS Signature\nagainst UpdatePolicySigners]
    ESP -- No --> CHECK_OPT6{Option 6\npresent in policy?}

    VERIFY_SIGN --> SIGN_OK{Signature\nValid?}
    SIGN_OK -- Yes --> POLICY_LOAD[Policy Loaded into\nCI Kernel Driver]
    SIGN_OK -- No --> BOOT_FAIL([Boot Failure /\nPolicy Rejected])

    CHECK_OPT6 -- "Yes (unsigned OK)" --> POLICY_LOAD
    CHECK_OPT6 -- "No (must be signed)" --> CHECK_SIG{Is binary\nsigned?}
    CHECK_SIG -- Yes --> VERIFY_SIGN
    CHECK_SIG -- No --> BOOT_FAIL

    POLICY_LOAD --> EVAL[Runtime Code\nEvaluation]
    EVAL --> ALLOW_DENY{Allow or Deny?}
    ALLOW_DENY -- Allow --> EXEC([Execution Proceeds])
    ALLOW_DENY -- Deny --> BLOCK([Block + Event 3077])

    style BOOT fill:#162032,color:#58a6ff
    style ESP fill:#1a1a0d,color:#fde68a
    style VERIFY_SIGN fill:#162032,color:#58a6ff
    style CHECK_OPT6 fill:#1a1a0d,color:#fde68a
    style SIGN_OK fill:#1a1a0d,color:#fde68a
    style POLICY_LOAD fill:#0d1f12,color:#86efac
    style BOOT_FAIL fill:#1f0d0d,color:#fca5a5
    style CHECK_SIG fill:#1a1a0d,color:#fde68a
    style EVAL fill:#162032,color:#58a6ff
    style ALLOW_DENY fill:#1a1a0d,color:#fde68a
    style EXEC fill:#0d1f12,color:#86efac
    style BLOCK fill:#1f0d0d,color:#fca5a5

graph TD
    O6["Option 6\nEnabled:Unsigned\nSystem Integrity Policy"]

    O6 -- "Removal requires\nUpdatePolicySigners populated" --> UPS["UpdatePolicySigners\nSection"]
    O6 -- "Removal requires\nSupplementalPolicySigners populated\n(if supplementals used)" --> SPS["SupplementalPolicySigners\nSection"]
    O6 -- "Governs whether\nEFI deployment is enforced" --> O9["Option 9\nAdvanced Boot\nOptions Menu"]
    O6 -- "Orthogonal but\nboth affect policy robustness" --> O8["Option 8\nRequired:EV Signers"]
    O6 -- "Unsigned policies can still\nrun in audit mode" --> O3["Option 3\nEnabled:Audit Mode"]
    O6 -- "Signed policy needed for\nhighest-assurance Kernel protection" --> O2["Option 2\nRequired:WHQL"]

    subgraph UNSIGNED ["Option 6 Present"]
        U1[No signing ceremony needed]
        U2[Policy can be replaced by admin]
        U3[EFI protection not engaged]
    end

    subgraph SIGNED ["Option 6 Removed"]
        S1[Signing required every update]
        S2[Policy replacement requires private key]
        S3[Can anchor to EFI — tamper-resistant]
    end

    O6 --> UNSIGNED
    O6 -. removal .-> SIGNED

    style O6 fill:#1a1a0d,color:#fde68a
    style UPS fill:#1c1c2e,color:#a5b4fc
    style SPS fill:#1c1c2e,color:#a5b4fc
    style O9 fill:#162032,color:#58a6ff
    style O8 fill:#162032,color:#58a6ff
    style O3 fill:#162032,color:#58a6ff
    style O2 fill:#162032,color:#58a6ff
    style U1 fill:#1a1a0d,color:#fde68a
    style U2 fill:#1a1a0d,color:#fde68a
    style U3 fill:#1a1a0d,color:#fde68a
    style S1 fill:#0d1f12,color:#86efac
    style S2 fill:#0d1f12,color:#86efac
    style S3 fill:#0d1f12,color:#86efac

flowchart TD
    START([Planning policy deployment]) --> Q1{Environment type?}

    Q1 -- Development / Lab --> DEV[Keep Option 6\nUnsigned mode\nSafe to iterate]
    Q1 -- Production --> Q2{Threat model includes\ncompromised admins\nor privileged insiders?}

    Q2 -- No --> Q3{Regulatory requirements\nfor policy signing?\nFIPS / CMMC / FedRAMP?}
    Q3 -- No --> UNSIGNED[Consider Option 6 enabled\nSimpler operations\nAcceptable risk]
    Q3 -- Yes --> SIGNED_PROD[Remove Option 6\nImplement signed policies]

    Q2 -- Yes --> SIGNED_PROD

    SIGNED_PROD --> Q4{Do you have PKI\ninfrastructure?}
    Q4 -- Yes --> DO_SIGN[Configure UpdatePolicySigners\nRemove Option 6\nSign and deploy]
    Q4 -- No --> PKI_FIRST[Set up PKI first\nTest on unsigned pilot\nThen remove Option 6]

    DEV --> OUT_DEV([Option 6: ENABLED\nNo risk, fast iteration])
    UNSIGNED --> OUT_U([Option 6: ENABLED\nAcceptable for low-risk envs])
    DO_SIGN --> OUT_S([Option 6: REMOVED\nHigh security, tamper-resistant])
    PKI_FIRST --> OUT_P([Option 6: ENABLED now\nPlan to REMOVE after PKI ready])

    style START fill:#162032,color:#58a6ff
    style Q1 fill:#1a1a0d,color:#fde68a
    style Q2 fill:#1a1a0d,color:#fde68a
    style Q3 fill:#1a1a0d,color:#fde68a
    style Q4 fill:#1a1a0d,color:#fde68a
    style DEV fill:#1c1c2e,color:#a5b4fc
    style UNSIGNED fill:#1a1a0d,color:#fde68a
    style SIGNED_PROD fill:#0d1f12,color:#86efac
    style DO_SIGN fill:#0d1f12,color:#86efac
    style PKI_FIRST fill:#1a1a0d,color:#fde68a
    style OUT_DEV fill:#1c1c2e,color:#a5b4fc
    style OUT_U fill:#1a1a0d,color:#fde68a
    style OUT_S fill:#0d1f12,color:#86efac
    style OUT_P fill:#1c1c2e,color:#a5b4fc