× 
STRIDE HW
Seven pillars and seventy-three controls for the bare-metal and colocation providers that host Solana validator hardware, each scored on a four-point scale from not implemented to verified.
Why STRIDE HW
A large share of Solana stake runs on hardware operated by a small number of hosting providers. A compromise at a provider reaches every tenant at once.
Existing standards stop above this layer. Node-operation and key-custody frameworks assess the validator operator, and facility certifications assess the building. None of them asks what software the provider adds to the OS image it delivers, or who inside the provider can open a console on a tenant machine. In June 2026, a breach of one provider's legacy monitoring system reached customer hosts through the agent the provider had installed. Validators across the ecosystem rotated keys and rebuilt.
STRIDE HW assesses the provider directly. The controls cover the facility, personnel, the management plane, the delivered OS image, the network, and the hardware supply chain. The assessment also records the concentration data behind the Solana Foundation's delegation criteria, which cap stake at 25% per ASN and 15% per facility.
Who it's for
The unit of assessment is the hosting provider, not the validator operator.
STRIDE HW covers bare-metal and colocation providers that host Solana validator hardware, and the component and firmware supply chain behind them. Asymmetric Research runs each assessment privately. Providers receive a scorecard and a prioritized improvement plan; we do not publish scores. Existing certifications such as SOC 2, ISO 27001, and facility tier certifications count as evidence and reduce the interview scope.
Methodology
The minimum bar for any provider that hosts stake-weighted validator hardware. The screening interview covers these controls alone.
Adds depth for providers hosting concentrated stake, or where the Core pass surfaced weakness.
Seven pillars
73 controls, 48 core
How an assessment runs
Tell us who you are and what you host. We schedule a kickoff call from there.
We request existing certifications and artifacts first. Each artifact you already hold removes questions from the interview.
Asymmetric Research engineers run an interview of 60 to 90 minutes covering the 48 Core controls.
We score each control from 0 to 3 and roll the results into pillar scores and a maturity band. You receive the scorecard privately, with prioritized recommendations.
The Extended controls apply where a provider hosts concentrated stake. Re-assessment tracks improvement over time.
Fast-track evidence
Artifacts that reduce the interview
Send what you already hold. Each artifact removes questions from the screening interview, and none is required to start.
Access control, change management, monitoring, vendor management.
ISMS scope, including the Annex A physical controls.
Facility redundancy for the certified site.
Business continuity and tested recovery objectives.
Physical access controls (Requirement 9).
Self-assessed cloud and data-center controls.
Direct evidence for the management-plane pillar.
Direct verification of management-network isolation.
Shows the power path has been tested under load.
Shows the sanitization process operates.
Dual control and evidence capture in practice.
Concentration disclosure against the delegation-program caps.
Every agent added to the stock distro, with privilege and egress.
Blast radius, including decommissioned management systems.
An enforceable opt-out with no SLA penalty.
Independent firmware and hardware review.
Residual risk transfer for tenant hardware.