Marvell, Microsoft and Oracle Establish OCP Working Group to Standardize Data Center Hardware Security

What the announcement says

Marvell, Microsoft and Oracle said they have formed a new working group within the Open Compute Project’s Security Track to standardize an integrated hardware security module (HSM) that meets NIST FIPS 140-3 Level 3 for cloud and hyperscale data center infrastructure. The group’s stated charter is to define open specifications for an integrated HSM to provide secure key caching and cryptographic key lifecycle management at the server level, with the goal of reducing latency, improving scalability and strengthening cloud workload security. The companies said most current servers rely on network-attached HSMs or software-only key management, which requires keys to traverse networks or reside in unprotected, non-FIPS 140-3 Level 3 memory. (Source: S1)

Sources: S1

Timing and deliverables

The companies indicated an initial draft of the technical specification is targeted for release around the 2026 OCP Global Summit (October 12-15) and that a version 1.0 would follow. The announcement also states the companies plan to demonstrate the new technology in their exhibit booths and during Security Track presentations at the OCP Global Summit in San Jose, California. (Source: S1)

Sources: S1

Why this may matter (inference)

If adopted, an open specification for an integrated server-level HSM could change how cryptographic keys are stored and used in cloud and hyperscale environments by placing a certified hardware boundary directly in the server. The companies describe expected benefits as reduced latency for key operations, improved scalability for key management, and the ability to cryptographically prove workload integrity to relying parties. These are drawn from the companies’ stated goals and do not constitute independent verification of outcomes. (Source: S1)

Sources: S1

Issuer context and statements

Marvell framed the initiative as offering industry-wide availability through an open specification and emphasized compliance and performance benefits. Microsoft highlighted the role of OCP in advancing interoperability and post-quantum cryptography adoption. Oracle described the effort as establishing a common foundation for industry adoption. The release includes forward-looking statements and cautions about risks, uncertainties and assumptions. (Source: S1)

Sources: S1

What remains uncertain

• All technical benefits and adoption outcomes are described by the issuing companies in the press release; independent verification of security, performance, interoperability, or industry adoption is not provided in the source.
• Target dates for the initial draft and version 1.0 are issuer targets stated as "targeted for release around the 2026 OCP Global Summit"; the announcement does not guarantee those dates or specify an exact publication timeline.