A discrete TPM is a small part, but adding one to a shipping carrier board is not a small job. It means a new BOM line, a new footprint and a board respin. On 20 October 2026 Variscite announced a software alternative for its NXP i.MX system-on-modules. It is SEC-TPM from SecEdge, a firmware TPM 2.0 that runs in the processor's secure world rather than on a separate chip. In its newsroom announcement, Variscite says SEC-TPM is now integrated and documented for its i.MX 6, i.MX 7, i.MX 8 and i.MX 9 SoM families.
The timing is tied to regulation. Variscite presents the integration as a way to meet the EU Cyber Resilience Act (CRA). In the company's account, the CRA's reporting obligations took effect on 11 September 2026, with 24-hour and 72-hour reporting windows, and the regulation applies in full from 11 December 2027.
What SEC-TPM actually is
Variscite describes SEC-TPM as a TCG-compliant firmware TPM (fTPM). It does not run in the normal Linux world. It runs inside OP-TEE, the open-source trusted execution environment, and Arm TrustZone provides the isolation. Variscite frames the aim as giving a device a provable identity and protected cryptographic keys, delivered from inside the SoC rather than from a separate IC on the board.
The weak point of any fTPM is its root of trust: what protects the secrets the firmware TPM holds? Variscite's answer depends on the silicon. On its i.MX 95 and i.MX 93 modules, SEC-TPM can use NXP's EdgeLock Secure Enclave as the root of trust. That enclave is a hardware security subsystem built into those processors. The announcement does not describe an equivalent hardware anchor for the older i.MX 6, 7 and 8 families. Teams with strict threat models should therefore treat the i.MX 93/95 configuration as the stronger case and ask Variscite or SecEdge directly about the older parts.
The product itself is not new. SecEdge announced SEC-TPM for NXP i.MX 6, 7, 8 and 9 series processors on 19 November 2025, in a release datelined Seattle and distributed via EIN Presswire. It described a TPM 2.0-compliant fTPM integrated into the NXP i.MX BSP, with no external IC required. In the same release, NXP's Denis Noël was quoted saying the approach may remove the need for a separate hardware TPM, using the EdgeLock Secure Enclave in select i.MX processors, and that SecEdge has been in the NXP Partner Program since 2020. What changed this week is that a SoM vendor has done the BSP integration and documentation work for its own module lines.
The retrofit angle
For many embedded teams, the most important line in Variscite's announcement is about hardware already in the field. Variscite says deployed systems can adopt SEC-TPM provided secure firmware updates are supported on the device. That condition is a real constraint. A fleet that cannot securely deliver a new OP-TEE image and BSP cannot gain a firmware TPM after the fact. For products that already have a trusted update path, though, adding TPM 2.0 services becomes a software release rather than a hardware revision.
Variscite connects this to its longevity programs, which it puts at 7 to 15 years. A module designed in today may still be shipping well after the CRA applies in full. A security feature that can be added in the field fits that lifecycle better than one that needs a new board revision.
The announcement includes a quote from Sami Nassar, SecEdge's CEO, and one from Ofer Austerlitz, Variscite's VP Business Development and Sales. Austerlitz frames the CRA as applying to everything customers have already shipped, and says SEC-TPM lets them reach TPM 2.0 with no hardware redesign.
What the developer documentation shows
Variscite has published integration notes on its Developer Center. One example is the SEC-TPM page for the VAR-SOM-MX8M-MINI on Yocto Scarthgap. These notes give a practical picture of the integration and some caveats that the press release leaves out:
- It runs in OP-TEE's secure world with TrustZone, which matches the announcement.
- The TPM is available only after Linux boots. This matters. A discrete TPM is typically reachable earlier in the boot chain. This fTPM, as documented, is not available in that pre-OS stage. Teams that depend on firmware-stage measurements should check how their boot chain fits with this.
- Licensing is per device. Each license file is valid for a single device. The device needs either a license file or a "Day-0" bundle downloaded from a self-service portal, which the page says is available only to registered customers. The dev kit's license file is copied to
/etc/sectpm/. - Activation needs internet access. This affects air-gapped and factory-provisioned products, which need a plan for activation.
- Build requirements: a Yocto build with the
meta-seftpm-opteelayer, OP-TEE, systemd and Python. - Evaluation: the SecEdge Development Kit includes a 90-day free trial.
Two of these points change the usual engineering trade-offs. With a discrete TPM, the cost is a part on the board. With SEC-TPM, it becomes a per-unit license, and the provisioning step needs network access. Neither is necessarily a dealbreaker, but both should be decided in the BOM and manufacturing plan rather than found out late.
What It Means for Makers
Who it's for: mainly professional product teams building on Variscite i.MX 6, 7, 8 or 9 SoMs that sell into the EU and need a TPM 2.0 story for CRA readiness. That includes hardware startups, industrial and medical OEMs, and small-batch makers turning a Variscite-based prototype into a commercial product. Hobbyists running a Variscite dev kit on the bench can also use the SecEdge Development Kit's 90-day free trial to try out a firmware TPM under OP-TEE without adding hardware.
What it replaces or enables: a discrete TPM chip and the board change needed to fit one. According to Variscite, systems already in the field that support secure firmware updates can adopt it. On i.MX 93 and i.MX 95 modules, the EdgeLock Secure Enclave serves as the root of trust. Keep in mind the documented caveats: the TPM is available only after Linux boots, licensing is per device, and activation needs internet access.
Price and availability: Variscite says SEC-TPM is integrated and documented for its i.MX 6, 7, 8 and 9 SoM families as of its 20 October 2026 announcement. None of the sources gives per-device license pricing. The only stated cost figure is that the SecEdge Development Kit includes a 90-day free trial. SecEdge's 2025 release says the i.MX 8 and 9 upgrade is offered under a per-chip licensing model, sourced through authorized NXP i.MX distributors and SoM vendors, so production licensing should be arranged through those channels.
