Reference Integrity Manifest (RIM)
A Reference Integrity Manifest (RIM) is a signed, machine readable set of reference measurements for a platform or component. It identifies who issued it and which product or firmware version it covers. A Verifier compares these expected values with measurements reported by the device, such as its boot event log and TPM quotes, to detect changes that do not match the expected state. RIMs can be updated as firmware or configuration evolves over the device's life.
Core capabilities
What RIMs deliver
A structured description of what a platform or component should measure when it is in a known good state.
Each RIM states who issued it and exactly which product and version its values apply to.
The issuer signature protects the Base RIM, and hash links extend that protection to any Support RIM files.
Expected values can cover updatable code, firmware built into the device, and the configuration that is measured.
A platform RIM can point to RIMs published by component suppliers instead of duplicating their values.
Reference values can be extended or corrected as firmware and configuration change after deployment.
RIMs supply the reference side of the comparison, while the appraisal decision stays under the Verifier policy.
[ 01 ]
A structured description of what a platform or component should measure when it is in a known good state.
Each RIM states who issued it and exactly which product and version its values apply to.
The issuer signature protects the Base RIM, and hash links extend that protection to any Support RIM files.
Expected values can cover updatable code, firmware built into the device, and the configuration that is measured.
A platform RIM can point to RIMs published by component suppliers instead of duplicating their values.
Reference values can be extended or corrected as firmware and configuration change after deployment.
RIMs supply the reference side of the comparison, while the appraisal decision stays under the Verifier policy.
Appraisal of firmware releases and boot configuration.
Firmware checks on integrated network and storage components.
Distinguishing approved updates from unexplained changes.
Reference values for onboarding, fleet attestation, and supply-chain checks.
Investigation of measured state after maintenance or incidents.
Primary features
Key capabilities of the RIM specifications
[ 01 ]
RIM Information Model
[ 02 ]
Direct, indirect, and hybrid payloads
[ 03 ]
Issuer signatures and integrity-protected links
[ 04 ]
PC Client SWID-format Base RIMs
[ 05 ]
Component RIM model with SWID and CoSWID binding
[ 06 ]
Primary, supplemental, and patch RIM links
[ 07 ]
Scope set by binding and available measurements
RIM Information Model
Organizes reference information into Base RIMs, optional Support RIMs, and RIM Bundle Collections.
Direct, indirect, and hybrid payloads
Measurements can sit in the Base RIM, in linked Support RIMs, or be split between the two.
Issuer signatures and integrity-protected links
Signatures and hash references ensure no RIM file can be altered or swapped without detection.
PC Client SWID-format Base RIMs
Defined formats for expected PCR values and event log assertions on PC Client platforms.
Component RIM model with SWID and CoSWID binding
Carries reference information at the component level, so suppliers can publish values for their own firmware.
Primary, supplemental, and patch RIM links
Relationships between RIMs make it possible to track how reference values evolve over time.
Scope set by binding and available measurements
Coverage depends on the binding used. The PC Client RIM covers boot-cycle measurements, not general runtime service inventory.
capability 01
Work Groups
Related TCG Work Groups that leverage RIM
Infrastructure
Defines the RIM Information Model and Component RIM Information Model.
PC Client
Defines the PC Client RIM binding and component RIM binding, including formats and reference information for appraising boot measurements.
Attestation
Uses RIM assertions as reference values when appraising evidence from an Attester.
Trusted Platform Module (TPM)
Provides the PCR measurement and quote functions used in TPM-based platform attestation.
Cyber Resilient Technologies (CyRes)
Can use reference measurements to help detect unexpected firmware or configuration changes.
Reference sources
Explore the RIM documentation
TCG Reference Integrity Manifest (RIM) Information Model
Defines the structure of Base RIMs, Support RIMs, and RIM Bundle Collections.
View moreTCG PC Client Reference Integrity Manifest Specification
Defines the RIM formats used to appraise boot measurements on PC Client platforms.
View moreTCG Component Reference Integrity Manifest Information Model
Extends the RIM model to reference information issued for individual platform components.
View moreTCG Component RIM Binding for SWID and CoSWID
Defines how component RIM information is expressed in SWID and CoSWID formats.
View moreReference sources
Explore the RIM documentation
Explore other Technologies
Trusted Platform Module (TPM)
TCG's standardized hardware Root of Trust for protecting keys, recording platform measurements and supporting attestation across every class of device.
Block Integrated Trust (BIT)
TCG's component-level hardware Root of Trust for constrained devices, giving integrated components their own identity and attestation.
Storage Security
TCG's architecture for interoperable security on trusted storage devices: self-encrypting drives, access control, locking and Opal, Ruby and Opalite classes.
Explore other Technologies
Trusted Platform Module (TPM)
TCG's standardized hardware Root of Trust for protecting keys, recording platform measurements and supporting attestation across every class of device.
Block Integrated Trust (BIT)
TCG's component-level hardware Root of Trust for constrained devices, giving integrated components their own identity and attestation.
Storage Security
TCG's architecture for interoperable security on trusted storage devices: self-encrypting drives, access control, locking and Opal, Ruby and Opalite classes.
Become part of TCG
Membership is open to corporations, start‑ups, government, academia, and non‑profits. Join to influence specs in Work Groups, access drafts, network with experts, and submit products for TCG Certification.