minor changes

## 1.4 Composite products

When boot manager functionality is integrated into larger products (such as operating systems, hypervisors, or embedded devices), the product manufacturer demonstrates conformance through evaluation of the complete product, with boot manager requirements may assessed as part of the whole.

When boot manager functionality is integrated into larger products (such as operating systems, hypervisors, or embedded devices), the product manufacturer demonstrates conformance through evaluation of the complete product, with boot manager requirements assessed as part of the whole.

Products integrating boot manager functionality may:

### 4.8.1 Assets

Boot managers protect critical system assets including boot chain integrity, cryptographic keys and certificates, boot configuration and security policies, measurement logs, and update mechanisms. Compromise of these assets can undermine the entire system's security posture.

Boot managers protect critical system assets including boot chain integrity, cryptographic keys and certificates, boot configuration and security policies, measurement logs, and update mechanisms. Compromise of these assets can undermine the entire system's security posture. An overview of boot manager assets is provided in Annex C.

### 4.8.2 Threat landscape

Each assessment in this clause follows a standardized format:

1. Applicability: Identifies which boot managers must comply (all or conditional based on capabilities).

2. Assessment objective: Defines the security property or capability being verified.

3. Assessment preparation: Describes the environment, setup, hardware requirements, and preconditions, including:

2. Objective: Defines the security property or capability being verified.

3. Preparation: Describes the environment, setup, hardware requirements, and preconditions, including:

  - Test environment (hardware, software, network setup)

  - Preconditions (configurations, credentials, operational states)

  - Required tools (testing software, analyzers, debuggers)

  - Vendor documentation references

4. Assessment activities: Provides step-by-step execution procedures, which may include:

4. Activities: Provides step-by-step execution procedures, which may include:

  - Documentation review

  - Security functional or penetration testing

  - Code or binary analysis

  - Review documentation of version tracking implementation

  - Identify where version information is stored:

    - Non-volatile memory location

    - Hardware security component (TPM, secure element)

    - Hardware security component

    - Protected storage mechanism

    - One-time programmable storage

  - Confirm mechanism type: