diff --git a/plat/nvidia/tegra/include/t210/tegra_def.h b/plat/nvidia/tegra/include/t210/tegra_def.h
index 7e3789c..bbcfdc5 100644
--- a/plat/nvidia/tegra/include/t210/tegra_def.h
+++ b/plat/nvidia/tegra/include/t210/tegra_def.h
@@ -175,6 +175,8 @@
  ******************************************************************************/
 #define TEGRA_MISC_BASE			U(0x70000000)
 #define  HARDWARE_REVISION_OFFSET	U(0x804)
+#define  APB_SLAVE_SECURITY_ENABLE	U(0xC00)
+#define  PMC_SECURITY_EN_BIT		(U(1) << 13)
 #define  PINMUX_AUX_DVFS_PWM		U(0x3184)
 #define  PINMUX_PWM_TRISTATE		(U(1) << 4)
 
diff --git a/plat/nvidia/tegra/soc/t210/plat_psci_handlers.c b/plat/nvidia/tegra/soc/t210/plat_psci_handlers.c
index 7e176e6..b7d10af 100644
--- a/plat/nvidia/tegra/soc/t210/plat_psci_handlers.c
+++ b/plat/nvidia/tegra/soc/t210/plat_psci_handlers.c
@@ -473,6 +473,11 @@
 			offset = plat_params->tzdram_base - plat_params->sc7entry_fw_base;
 			tegra_memctrl_tzdram_setup(plat_params->sc7entry_fw_base,
 				plat_params->tzdram_size + offset);
+
+			/* restrict PMC access to secure world */
+			val = mmio_read_32(TEGRA_MISC_BASE + APB_SLAVE_SECURITY_ENABLE);
+			val |= PMC_SECURITY_EN_BIT;
+			mmio_write_32(TEGRA_MISC_BASE + APB_SLAVE_SECURITY_ENABLE, val);
 		}
 	}
 
diff --git a/plat/nvidia/tegra/soc/t210/plat_setup.c b/plat/nvidia/tegra/soc/t210/plat_setup.c
index d6b0853..9fb5169 100644
--- a/plat/nvidia/tegra/soc/t210/plat_setup.c
+++ b/plat/nvidia/tegra/soc/t210/plat_setup.c
@@ -157,6 +157,7 @@
 	const plat_params_from_bl2_t *plat_params = bl31_get_plat_params();
 	uint64_t sc7entry_end, offset;
 	int ret;
+	uint32_t val;
 
 	/* memmap TZDRAM area containing the SC7 Entry Firmware */
 	if (plat_params->sc7entry_fw_base && plat_params->sc7entry_fw_size) {
@@ -193,6 +194,11 @@
 				plat_params->sc7entry_fw_size,
 				MT_SECURE | MT_RO_DATA);
 		assert(ret == 0);
+
+		/* restrict PMC access to secure world */
+		val = mmio_read_32(TEGRA_MISC_BASE + APB_SLAVE_SECURITY_ENABLE);
+		val |= PMC_SECURITY_EN_BIT;
+		mmio_write_32(TEGRA_MISC_BASE + APB_SLAVE_SECURITY_ENABLE, val);
 	}
 }