Business & Policy
Procurement
Procurement can turn secure-by-design intent into demand by asking suppliers for measurable properties, implementation evidence and lifecycle commitments.
Why it matters
Well-formed criteria let suppliers propose suitable architectures while giving buyers evidence they can compare and enforce after contract award.
In brief
Procurement can turn secure-by-design intent into demand by asking suppliers for measurable properties, implementation evidence and lifecycle commitments. CHERI should appear as a means to achieve defined memory-safety and compartmentalisation outcomes, not as a brand-only requirement.
Key considerations
1. Outcome
Define the threats, components and security properties in scope, including required fault detection and containment behaviour.
2. Evidence
Request architecture and ABI details, test results, toolchain and software status, vulnerability handling, support periods and independent assurance where proportionate.
3. Lifecycle
Cover updates, component changes, end-of-support notice, recertification triggers, data access and exit arrangements.
Evidence and caveats
Overly prescriptive requirements can exclude valid alternatives; vague ‘CHERI-ready’ language can be impossible to verify. Use scored, evidence-based criteria.
Show assumptions, ranges, dates and owners for economic or policy claims. Recheck legislation, guidance, product status and prices at the decision date.