After the device successfully boots a signed image without generating any HAB events, it is safe to secure, or close, the device.
CL-SOM-iMX7 # fuse prog 1 3 0x2000000