The device RRAM has a boot region that can be made immutable before the CPU starts up.
Boot initiated from an immutable source allows later boot steps to be performed by authenticated code.
The boot region starts at address 0x00000000. This address contains the initial secure program counter (PC), the stack pointer (SP), and the interrupt vectors. The size and permissions of the region are configured using UICR register BOOTCONF.
After configuration, when there is a device reset, the hardware state-machine reads UICR fields and configures RRAMC. This enforces boot region protection before the Arm Cortex-M33 is released from reset.
For more information about the immutable boot region, see RRAMC — Resistive random access memory controller.