NEW YORK — What happened
The Cybersecurity and Infrastructure Security Agency (CISA), alongside NIST, has released an updated framework detailing strict timelines for eliminating memory-unsafe languages like C and C++ from critical infrastructure software. The directive prioritizes new software development while setting phased remediation targets for legacy systems.
Why it matters
Memory safety vulnerabilities—such as buffer overflows and use-after-free errors—have accounted for a staggering percentage of exploitable security bugs for decades. By leveraging government purchasing power, regulators aim to force a systemic shift toward languages like Rust, Go, and modernized tooling.
Deep dive
The transition is far from simple. Rewriting millions of lines of legacy C code used in industrial control systems and operating systems presents monumental engineering hurdles. The guidance allows for wrapping legacy code in safe interfaces, but demands concrete plans for eventual rewrites.
Report check (claims vs what is verified vs still rumor)
Tech press claims suggest an outright ban on all C and C++ code in federal contracts by next year. Verified text shows a more measured, risk-based approach with multi-year transition windows and waiver processes for specialized hardware.
Open questions
Where will the industry find enough engineers certified in memory-safe systems programming to meet these growing demands? How will embedded systems with extreme hardware constraints handle the performance overhead of modern safety checks?