From Microsoft's Secure Boot OEM policy[0]:<p>> The firmware setup shall indicate if Secure Boot is turned on, and if it is operated in Standard or Custom Mode. The firmware setup must provide an option to return from Custom to Standard Mode which restores the factory defaults. On an ARM system, it is forbidden to enable Custom Mode. Only Standard Mode may be enabled.<p>[0]: <a href="https://docs.microsoft.com/en-us/windows-hardware/design/compatibility/systems#systemfundamentalsfirmwareuefisecureboot" rel="nofollow">https://docs.microsoft.com/en-us/windows-hardware/design/com...</a>