Business & Policy
Cybersecurity regulation
Cybersecurity regulation commonly asks organisations to manage risk across secure design, vulnerability handling, updates, supply chains and incident response.
Why it matters
A regulator or customer will need evidence that the chosen implementation reduces defined risks in the delivered product—not only a general description of CHERI.
In brief
Cybersecurity regulation commonly asks organisations to manage risk across secure design, vulnerability handling, updates, supply chains and incident response. CHERI is most relevant as an architectural control within secure design and defence in depth.
Key considerations
1. Requirement
Translate broad duties into testable product and process requirements with named owners.
2. Contribution
Show which CHERI mechanisms support each requirement, which threats remain and which additional controls close the gap.
3. Traceability
Link requirements to design decisions, implementations, tests, releases and post-market monitoring.
Evidence and caveats
Compliance does not prove security, and CHERI adoption does not automatically prove compliance. Both require product-specific analysis.
Show assumptions, ranges, dates and owners for economic or policy claims. Recheck legislation, guidance, product status and prices at the decision date.