System and method for system-wide firmware downgrade control

An information handling system, comprising:

• a basic input/output system configured to update an attribute of a system-wide firmware downgrade security policy prior to booting to an operating system of the information handling system, wherein the attribute of the system-wide firmware downgrade security policy is used to determine whether to allow or to disallow downgrade of a firmware to a version;
• and
• a processor configured to:
• perform the downgrade of the firmware, wherein the downgrade of the firmware includes the processor further configured to check the attribute of the system-wide firmware downgrade security policy and to store a firmware image in a scratchpad;
• and
• if the attribute of the system-wide firmware downgrade security policy allows the downgrade of the firmware to the version, then continue with the downgrade of the firmware otherwise discard the firmware image in the scratchpad.

A method of enforcing a system-wide firmware downgrade security policy, the method comprising:

• updating an attribute in the system-wide firmware downgrade security policy, wherein the attribute is associated with whether to allow to disallow a downgrade of a firmware;
• enabling, by a basic input/output system, a firmware lockdown of a device of an information handling system during a system boot prior to booting to an operating system, wherein the firmware lockdown of the device allows a staged firmware management protocol process;
• downgrading the firmware of the device wherein the downgrading is based on the attribute of the system-wide firmware downgrade security policy;
• and
• if the downgrade of the firmware is allowed, then continuing with the downgrading of the firmware via the staged firmware management protocol process.