Structuring trust: a quantitative and traceable framework for hardware security assurance

Abstract The security assurance of hardware systems is increasingly critical in connected and safety-sensitive infrastructures, where compromised components may endanger human safety or disrupt essential services. However, existing assurance practices remain largely qualitative and fragmented across overlapping standards, often leading to duplicated evaluation efforts and inconsistent interpretations of system trustworthiness. This paper introduces a structured, multi-level framework for hardware security assurance that links security requirements to verification evidence through six traceable layers. The framework establishes a traceable and structured evaluation process designed to enhance reproducibility and introduces a quantification-ready, structured aggregation methodology for analyzing subsystem assurance evidence. By integrating system decomposition, standards-derived requirements, and evidence-based verification, the approach supports transparent traceability across complex, multi-component hardware systems. The framework is demonstrated through a case study of a wireless fingertip oximeter used in healthcare infrastructure. The results illustrate how traceable assurance artifacts and structured aggregation can support measurable subsystem evaluation and provide diagnostic insight into system-level resilience.