Government Guidance
Public guidance increasingly asks technology producers to address memory safety, secure-by-design development, and long-term product resilience.
Governments and national cybersecurity authorities are treating memory safety as a strategic product-security issue. Their guidance focuses on outcomes: preventing recurring vulnerability classes, reducing attacker access, maintaining products, and making progress measurable.
Guidance to follow
Several public sources help place memory safety and CHERI in a wider security strategy:
- CISA’s Case for Memory Safe Roadmaps asks software manufacturers to set out how they will reduce memory-safety risk, including risk in existing code.
- CISA’s Product Security Bad Practices identifies avoidable practices and calls for roadmaps covering relevant existing products.
- The UK NCSC’s guidance on memory-safe languages explains the value of safer language choices and the challenge presented by established unsafe code.
- The UK NCSC’s work on cyber resilience at scale presents memory-safe languages and CHERI as complementary routes to more resilient technology.
- The UK Digital Security by Design programme developed and evaluated capability-based hardware and software through the Morello ecosystem.
Where CHERI fits
Memory-safe languages are a strong default for new software. CHERI addresses a related problem: how to enforce fine-grained memory access in low-level and existing code, and how to limit what a compromised component can reach. A roadmap can use both.
For example, an organisation might require Rust for new network services, compile an established C library for a pure-capability target, and place that library in a compartment. The roadmap should say which code each measure covers and how success will be verified.
Turn guidance into action
- Measure the organisation’s memory-unsafe code and vulnerability baseline.
- Segment software by exposure, privilege, lifespan, and feasibility of change.
- Choose language migration, CHERI protection, compartmentalisation, replacement, or combined controls for each segment.
- Set milestones for prototypes, production coverage, and evidence.
- Publish progress and limitations in language that customers can verify.
Guidance is not the same as law. Check the current source, applicable jurisdiction, and sector obligations before relying on it for compliance.