Business & Policy
Business-case toolkit
A CHERI business case compares the cost and risk of continuing the current architecture with the cost, benefit and uncertainty of a staged transition.
What you’ll do
A CHERI business case compares the cost and risk of continuing the current architecture with the cost, benefit and uncertainty of a staged transition. It should use ranges and product-specific evidence rather than a single headline return figure.
Before you begin
The useful decision is usually whether to investigate, pilot, adopt in a product line or wait for a dependency—not whether CHERI is good in the abstract.
Text-only scenario worksheet
Record the evidence and a low, central and high estimate for each assumption:
- Products in service and intended support life.
- Current investigation, patching, recall, downtime and assurance costs.
- Evaluation team size and duration.
- Hardware, toolchain, training, porting and certification costs.
- Transition risks, dependencies and opportunity costs.
Compare scenarios as ranges. Do not present the result as guaranteed savings or a return forecast.
Steps
1. Baseline
Estimate current vulnerability investigation, patching, support, downtime, assurance and end-of-life exposure over the product lifetime.
2. Transition
Include hardware, software porting, supplier changes, tools, training, testing, certification and dual-platform support.
3. Outcomes
Model reduced exploitability, earlier fault detection, stronger containment and strategic options without treating any benefit as guaranteed.
Check your result
Avoid multiplying a general vulnerability percentage by your incident costs. The relevant proportion depends on your code, architecture, threat model and deployment controls.
Show assumptions, ranges, dates and owners for economic or policy claims. Recheck legislation, guidance, product status and prices at the decision date.