>Framework. vPro Enterprise Framework devices actually meet HSI level 4, but they unfortunately do not handle firmware updates properly. They have not shipped a single firmware for their 13th generation over a year since its release date, and over 6 months since the disclosure of LogoFail. While they do ship some updates for other devices, how they have been handling so far is not acceptable if you need a secure device.

Using open boot and a neutered Intel ME is a good start but nothing too unique nowadays.

Also at this point hardware privacy is all well and good but if you are going to dump stock Windows 11 on it, well it is called Windows for a reason, lets all your data out of one.