# Review HSM controls, payment boundaries and certificates

**Recorded synthetic examples; computer-generated narration.** These lessons document the implemented evaluation console, not production accreditation, vendor commands or compliance attestation.

## 1. Review HSM control metadata

**Chapter:** 00:00:00.000

This lesson covers specialist review workspaces. Step one. Open HSM assurance. Review owner, firmware, dual-control and backup-test metadata, then open device evidence for the associated rule outcomes. Synthetic vendor examples are not native integrations or health measurements.

## 2. Treat custody as metadata, not quorum

**Chapter:** 00:00:21.600

Step two. Scroll to the ceremony custody template. It represents three primary cards and three backup cards across three custodians. The authorization threshold remains unknown. Do not infer a quorum, copy card contents or use this template as vendor ceremony instructions.

## 3. Review payment trust boundaries

**Chapter:** 00:00:43.600

Step three. Open Payment review. Inspect the explicitly synthetic merchant, controlled-service and external-party trust boundaries, along with stored service findings. This view does not process transactions, detokenize data or provide a PCI attestation.

## 4. Import one public certificate privately

**Chapter:** 00:01:02.800

Step four. In a private local installation, select Import evidence and choose one public PEM or DER certificate. This recording uses only the supplied public synthetic certificate. Shared demo mode rejects certificate imports. Never upload a private-key file or certificate bundle.

## 5. Inspect encoded certificate metadata

**Chapter:** 00:01:24.133

Step five. Open Certificates. Inspect issuer, declared public-key algorithm, encoded expiry and evidence status. Use the filter to find a certificate. The renewal window is configurable in CAS metadata policy; the default is thirty days.

## 6. Review expiry and quantum findings

**Chapter:** 00:01:43.400

Step six. Click the certificate and inspect its rule results. An encoded-validity pass proves neither trust-chain validity nor endpoint deployment. RSA is flagged for quantum exposure even when a certificate has not expired. Chain, revocation and interoperability remain unverified.

## 7. Export and route for human review

**Chapter:** 00:02:05.000

Step seven. Return to Overview and export the certificate assessment. Route evidence gaps and remediation proposals to the responsible owner. Use the setup guide for private deployment and backups; these videos cover console use, not production accreditation or device-changing commands.