The initial survey effort to begin the identification of a “Top-N” list for hardware was done by members of the SIG who each chose a prioritized set of 10 weaknesses from the 96 hardware entries in the CWE corpus. This process identified a total of 31 unique entries. The HW CWE team also provided a set of questions for participants to weigh during their thinking, including those applicable to prevalence and detection metrics, mitigation metrics, exploitability metrics, and other miscellaneous metrics. From an initial set of 27 questions, the SIG members identified 9 as particularly significant in their consideration for voting on the list:
How frequently is this weakness detected after it has been fielded?
Does the weakness require hardware modifications to mitigate it?
How frequently is this weakness detected during design?