diff --git a/CMakeLists.txt b/CMakeLists.txt
index b50dac9fc9..b52058aa6a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -294,6 +294,8 @@ add_subdirectory(3rdparty)
 
 add_subdirectory(library)
 
+add_subdirectory(tf-psa-crypto)
+
 add_subdirectory(pkgconfig)
 
 #
diff --git a/Makefile b/Makefile
index 3f62b6636c..0f1f3da8fd 100644
--- a/Makefile
+++ b/Makefile
@@ -96,7 +96,7 @@ install: no_test
 	mkdir -p $(DESTDIR)/include/mbedtls
 	cp -rp include/mbedtls $(DESTDIR)/include
 	mkdir -p $(DESTDIR)/include/psa
-	cp -rp include/psa $(DESTDIR)/include
+	cp -rp tf-psa-crypto/include/psa $(DESTDIR)/include
 
 	mkdir -p $(DESTDIR)/lib
 	cp -RP library/libmbedtls.*    $(DESTDIR)/lib
diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
index e11e2715af..755efedd1c 100644
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -3,20 +3,13 @@ option(INSTALL_MBEDTLS_HEADERS "Install Mbed TLS headers." ON)
 if(INSTALL_MBEDTLS_HEADERS)
 
     file(GLOB headers "mbedtls/*.h")
-    file(GLOB psa_headers "psa/*.h")
 
     install(FILES ${headers}
         DESTINATION include/mbedtls
         PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
-
-    install(FILES ${psa_headers}
-        DESTINATION include/psa
-        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
-
 endif(INSTALL_MBEDTLS_HEADERS)
 
 # Make mbedtls_config.h available in an out-of-source build. ssl-opt.sh requires it.
 if (ENABLE_TESTING AND NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR})
     link_to_source(mbedtls)
-    link_to_source(psa)
 endif()
diff --git a/tf-psa-crypto/.gitignore b/tf-psa-crypto/.gitignore
new file mode 100644
index 0000000000..f3c7a7c5da
--- /dev/null
+++ b/tf-psa-crypto/.gitignore
@@ -0,0 +1 @@
+Makefile
diff --git a/tf-psa-crypto/CMakeLists.txt b/tf-psa-crypto/CMakeLists.txt
new file mode 100644
index 0000000000..1425abb4c6
--- /dev/null
+++ b/tf-psa-crypto/CMakeLists.txt
@@ -0,0 +1,38 @@
+#
+# CMake build system design considerations:
+#
+# - Include directories:
+#   + Do not define include directories globally using the include_directories
+#     command but rather at the target level using the
+#     target_include_directories command. That way, it is easier to guarantee
+#     that targets are built using the proper list of include directories.
+#   + Use the PUBLIC and PRIVATE keywords to specify the scope of include
+#     directories. That way, a target linking to a library (using the
+#     target_link_libraries command) inherits from the library PUBLIC include
+#     directories and not from the PRIVATE ones.
+# - TF_PSA_CRYPTO_TARGET_PREFIX: CMake targets are designed to be alterable by
+#   calling CMake in order to avoid target name clashes, via the use of
+#   TF_PSA_CRYPTO_TARGET_PREFIX. The value of this variable is prefixed to the
+#   tfpsacrypto and apidoc targets.
+#
+
+# We specify a minimum requirement of 3.10.2, but for now use 3.5.1 here
+# until our infrastructure catches up.
+cmake_minimum_required(VERSION 3.5.1)
+
+# https://cmake.org/cmake/help/latest/policy/CMP0011.html
+# Setting this policy is required in CMake >= 3.18.0, otherwise a warning is generated. The OLD
+# policy setting is deprecated, and will be removed in future versions.
+cmake_policy(SET CMP0011 NEW)
+# https://cmake.org/cmake/help/latest/policy/CMP0012.html
+# Setting the CMP0012 policy to NEW is required for FindPython3 to work with CMake 3.18.2
+# (there is a bug in this particular version), otherwise, setting the CMP0012 policy is required
+# for CMake versions >= 3.18.3 otherwise a deprecated warning is generated. The OLD policy setting
+# is deprecated and will be removed in future versions.
+cmake_policy(SET CMP0012 NEW)
+
+if(LIB_INSTALL_DIR)
+    set(CMAKE_INSTALL_LIBDIR "${LIB_INSTALL_DIR}")
+endif()
+
+add_subdirectory(include)
diff --git a/tf-psa-crypto/include/.gitignore b/tf-psa-crypto/include/.gitignore
new file mode 100644
index 0000000000..f3c7a7c5da
--- /dev/null
+++ b/tf-psa-crypto/include/.gitignore
@@ -0,0 +1 @@
+Makefile
diff --git a/tf-psa-crypto/include/CMakeLists.txt b/tf-psa-crypto/include/CMakeLists.txt
new file mode 100644
index 0000000000..dea92fe6ef
--- /dev/null
+++ b/tf-psa-crypto/include/CMakeLists.txt
@@ -0,0 +1,16 @@
+option(INSTALL_PSA_CRYPTO_HEADERS "Install PSA Crypto headers." ON)
+
+if(INSTALL_PSA_CRYPTO_HEADERS)
+
+    file(GLOB psa_headers "psa/*.h")
+
+    install(FILES ${psa_headers}
+        DESTINATION include/psa
+        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
+
+endif(INSTALL_PSA_CRYPTO_HEADERS)
+
+# Make includes available in an out-of-source build. ssl-opt.sh requires it.
+if (ENABLE_TESTING AND NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR})
+    link_to_source(psa)
+endif()