Marvell, Microsoft and Oracle form an Open Compute Project working group aimed at standardizing data center hardware security

Marvell Technology, Microsoft and Oracle announced a collaborative effort aligned with the Open Compute Project, or OCP, focused on standardizing data center hardware security. The announcement, reported by Yahoo Finance on Oct. 13, described the initiative as a working group designed to bring industry participants toward shared expectations for security at the hardware layer.

The Open Compute Project is an industry initiative that publishes open specifications for data center infrastructure, with the goal of making designs interoperable and easier to deploy at scale. In this case, the companies said their effort is aimed at security, an area that often varies across platforms and suppliers and can complicate how systems are built, validated, and operated in large cloud environments.

Beyond establishing the working group, the announcement as reported did not lay out a detailed technical roadmap or spell out which specific security functions would be standardized first. It also did not disclose timelines for drafts, testing milestones, or how final outputs would be adopted across existing hardware and software stacks.

Marvell, which supplies semiconductor and networking technology used in data center equipment, Microsoft, which runs cloud services such as Azure, and Oracle, which provides cloud infrastructure and related enterprise services, all have direct reasons to pursue clearer hardware security baselines. For cloud operators, consistent security expectations can streamline procurement decisions and simplify the validation work required to operate heterogeneous fleets of servers and related components.

The companies did not, in the reported summary, identify deliverables such as a particular specification document, reference designs, or certification criteria. They also did not indicate whether the group would seek formal endorsement from OCP governance bodies or whether participation would be limited to the three named companies and their ecosystem partners.

Industry observers have long noted that data center security is not just a software issue. Hardware-rooted trust features, secure boot mechanisms, and supply chain safeguards can affect everything from system bring-up to incident response. A shared set of hardware security expectations could, in theory, reduce the effort required for operators to map security controls across different vendors and platforms.

Still, what is not yet clear is the scope of standardization. The companies did not disclose which categories of security controls are in scope, how legacy systems are expected to fit in, or how they plan to measure compliance. Without those details, it is difficult to assess how quickly the working group’s outputs could translate into operational changes for customers and partners.