Art. 76(4)

Art. 76(4)(b)'s manufacturing-and-test-phase coverage is domain-relevant to bootkit insertion, but scopes lifecycle risk management to those phases without naming an interdicting mechanism; secure boot would be the interdiction.

Boot memory and OTP fuse configuration are decided at 76(4)(b)'s manufacturing and test phases — secure-boot and root-of-trust are lifecycle obligations of risk management measures across these phases.

Boot-chain integrity is established at 76(4)(b)'s manufacturing and test phases — secure-boot configuration, OTP fuses, and golden-image baselines are decided in this lifecycle stage.

76(4)(a) explicitly covers the conception and design phases including preparatory activities to manufacturing — the lifecycle stage EXF-0008 attacks via developer-environment compromise.

76(4)(b)'s coverage of manufacturing, assembly, integration, verification, validation, and qualification phases — the manufacturing and test lifecycle — is exactly the phase IA-0001 attacks pre-flight.

76(4)(b) explicitly covers manufacturing, assembly, integration, verification, validation, and qualification phases — the ATLO lifecycle stage IA-0012 attacks; risk-management measures must extend through ATLO.

76(4)(c)(i) explicitly covers the transport, commissioning, launch and early orbit phase (LEOP) — the lifecycle stage LM-0006 attacks via launch-vehicle interfaces.

76(4)(c)(i) covers transport, commissioning, launch and early orbit phase (LEOP) as part of the lifecycle the operator must address with risk-management measures — limiting the leakage of launch information is part of that lifecycle protection.