Business & Policy
Assurance and certification
Assurance is the structured argument and evidence that a system meets defined security properties.
Why it matters
Decision-makers need to connect architectural claims such as enforced bounds or permissions to the actual implementation, configured system and threat model they are assessing.
In brief
Assurance is the structured argument and evidence that a system meets defined security properties. Certification applies a stated scheme or assessment process to a product or organisation. CHERI can strengthen an assurance case, but it does not certify the surrounding software, hardware or operational controls by itself.
Key considerations
1. Claim
Define the property precisely: which accesses are prevented, which components are isolated and under what assumptions.
2. Evidence
Combine specifications, implementation tests, formal models, toolchain behaviour and system-level evaluation at the assurance level required.
3. Lifecycle
Record versions, configurations, suppliers and recertification triggers so the argument remains valid after change.
Evidence and caveats
The CHERI Enabled programme describes conformance to CHERI principles based on submitted evidence; it does not guarantee overall product security or currently provide independent product testing.
Show assumptions, ranges, dates and owners for economic or policy claims. Recheck legislation, guidance, product status and prices at the decision date.