A Trusted Platform Module (TPM) is a dedicated, tamper-resistant hardware chip that securely generates, stores, and uses cryptographic keys, keeping those secrets isolated from the main operating system and processor. It provides a hardware root of trust that software alone cannot offer.
Because keys created inside a TPM can be bound so they never leave the chip in plaintext, malware running in the operating system cannot simply read them out of memory. This underpins several familiar features. Full disk encryption tools like BitLocker seal their keys to the TPM so the drive only unlocks on the same physical machine, and measured boot uses the TPM to record hashes of firmware and boot components, letting a system attest that it started in a known-good state. The specification is maintained as an international standard, and TPM 2.0 is a baseline requirement for some modern operating systems. A point candidates miss is that a TPM protects keys but is not an accelerator; its value is assurance and isolation, not raw cryptographic throughput.
Why does the TPM matter for the CISSP exam?
The TPM appears in Domain 3 (Security Architecture and Engineering), weighted at 13%. Understand hardware roots of trust, secure and measured boot, and key protection. Review Domain 3 Security Architecture and Engineering for the wider subject.