A secure boot computer system comprising a logic block and a controller, wherein: the logic block comprises one or more processing units (101a, 101b) that execute instructions and the logic block is preconfigured to, on power-up or reset of the logic block, communicate with the controller over a first interface according to a first communication protocol to request boot instructions over the first interface, wherein said preconfiguring of the logic block cannot be altered by software instructions executed by the logic block; the controller comprises an interface manager and a storage manager and is configured to implement a communications link to a second computer system and to receive the boot instructions from the second computer system via the communications link; the interface manager is configured to: communicate with the logic block over the first interface according to the first communication protocol, identify requests for data that are received from the logic block over the first interface, and communicate the requests to the storage manager over a second interface; the second interface is read-only at all times such that it is not possible for data to flow from the logic block to the storage manager except for the purpose of specifying data that should be read from the storage manager via the interface manager; the storage manager is configured to receive, over a third interface that is completely separate to the second interface, boot instructions that the controller received from the second computer system via the communications link such that the boot instructions can be changed via the third interface but cannot be changed via the second interface; and the system further comprises a control connection between the logic block and the controller, the controller being configured to use the control connection to power-up or reset the logic block to place the logic block in a predetermined active state resulting from executing the boot instructions such that software operating on the logic block prior to power-up or reset of the logic block cannot affect the predetermined active state. the logic block comprises one or more processing units (101a, 101b) that execute instructions and the logic block is preconfigured to, on power-up or reset of the logic block, communicate with the controller over a first interface according to a first communication protocol to request boot instructions over the first interface, wherein said preconfiguring of the logic block cannot be altered by software instructions executed by the logic block; the controller comprises an interface manager and a storage manager and is configured to implement a communications link to a second computer system and to receive the boot instructions from the second computer system via the communications link; the interface manager is configured to: communicate with the logic block over the first interface according to the first communication protocol, identify requests for data that are received from the logic block over the first interface, and communicate the requests to the storage manager over a second interface; the second interface is read-only at all times such that it is not possible for data to flow from the logic block to the storage manager except for the purpose of specifying data that should be read from the storage manager via the interface manager; the storage manager is configured to receive, over a third interface that is completely separate to the second interface, boot instructions that the controller received from the second computer system via the communications link such that the boot instructions can be changed via the third interface but cannot be changed via the second interface; and the system further comprises a control connection between the logic block and the controller, the controller being configured to use the control connection to power-up or reset the logic block to place the logic block in a predetermined active state resulting from executing the boot instructions such that software operating on the logic block prior to power-up or reset of the logic block cannot affect the predetermined active state.