Which process verifies that a device's software has not been altered from its approved baseline?

• A. Identity Proofing
• B. Privacy
• C. Attestation
• D. Non-Repudiation

Answer: (C)

Attestation is the mechanism used to prove that a device’s current software and configuration match a known good baseline. It works by collecting trusted measurements—such as hashes or PCR values—from boot components and software, storing them in a secure element (like a TPM) or a trusted enclave, and generating an attestation report signed by a trusted authority. When the measurements align with the approved baseline, the device demonstrates it has not been altered; if they don’t, it indicates tampering or deviation. This targets software integrity directly, unlike identity proofing (verifying a person’s identity), privacy (protecting data), or non-repudiation (ensuring a sender can’t deny an action).