HP Sure Start's security event policy on the Z2 Tower G9
Three response levels to a critical firmware change, from a simple log entry to an automatic shutdown.
Continuous firmware monitoring
HP Sure Start continuously monitors the computer's firmware while the operating system is running, and reacts as soon as a critical security event is identified — meaning any modification to HP firmware.
Three possible response policies
The first option, Log Event Only, simply records all critical security events in the HP Sure Start audit log, kept in nonvolatile flash memory. The second, Log Event and Notify User, adds a notification directly within the operating system on top of the logging. The third, Log Event and Power Off System, goes further by automatically shutting down the computer as soon as an HP Sure Start security event is detected.
A trade-off to choose based on context
HP recommends reserving that third option — the automatic shutdown — for situations where the system's security integrity outweighs the risk of data loss, since an unexpected shutdown can naturally result in the loss of unsaved work.
A complementary safeguard for critical settings
A separate option, Sure Start BIOS Settings Protection, additionally locks all critical BIOS settings and reinforces their protection through nonvolatile flash memory — off by default, it combines with the security event policy for more complete firmware control.