Memory Safety Roadmap

Open source rules engine · Client-side privacy

Generate your memory safety roadmap in minutes

CISA, NSA, and the EU Cyber Resilience Act expect software manufacturers to publish memory safety transition plans. Our generator produces CISA-aligned roadmaps, posture assessments, and risk registers — from a 10-minute questionnaire.

Generate Free Roadmap See plans ↓
Aligned to
CISA EU CRA UK PSTI OpenSSF NIST SSDF

How it works

Three steps. Ten minutes. Professional compliance documentation.

01

Answer the questionnaire

Eight sections covering your technology stack, security posture, regulatory targets, and transition readiness. Upload an SBOM for real dependency analysis.

02

Review your assessment

See your risk badge, OpenSSF Continuum level, estimated timeline, and priority actions — instantly. Everything processed in your browser.

03

Download your documents

Professional PDFs ready for auditors, regulators, and procurement teams. Your data never leaves your device.

Need help with the questionnaire? Open the questionnaire guide.

Have a previous baseline?

Company Information

Basic details about your organisation and the scope of this roadmap.

Technology Landscape

Your current programming languages, codebase characteristics, and deployment contexts.

Current Security Posture

Existing security tools, practices, and vulnerability history.

Memory-Safe Language Transition

Your current plans and experience with memory-safe languages.

Regulatory Context

Markets you serve and regulatory frameworks that apply.

Dependencies & SBOM

Third-party dependency management and Software Bill of Materials status.

Upload a CycloneDX or SPDX JSON file to auto-analyse your dependency risk. This replaces the manual fields above with actual data.

Transparency & Reporting

How you plan to communicate progress.

Additional Notes

Any additional context for your roadmap.

Frequently asked questions

Everything you need to know about memory safety compliance documentation.

What is a memory safety roadmap and why do I need one?
A memory safety roadmap is a structured plan for transitioning your codebase away from memory-unsafe languages or implementing mitigations where migration isn't feasible. CISA, NSA, and the FBI have jointly called on software manufacturers to publish these roadmaps. The EU Cyber Resilience Act and UK Product Security regulations increasingly expect evidence of secure-by-design practices — a documented roadmap demonstrates you're taking this seriously.
Is this a compliance certification?
No. The MSCD Generator produces compliance documentation, not certification. The generated documents are structured starting points that help show your organisation has assessed its memory safety posture, identified risks, and planned a transition strategy. They support conversations with auditors and regulators — but they're not a substitute for independent legal advice or third-party audit.
Does this provide CRA certification?
No. DOC-6 provides CRA readiness evidence mapping, not CRA certification, CE marking, legal advice, audit assurance, or a conformity assessment. It maps your questionnaire responses and generated documents to CRA-relevant readiness areas, deadlines, evidence already generated, and gaps to review.
Which regulatory frameworks does the generator cover?
The rules engine maps against CISA's "Case for Memory Safe Roadmaps", CISA/FBI "Product Security Bad Practices", the EU Cyber Resilience Act (CRA), UK Product Security and Telecommunications Infrastructure Act (PSTI), UK Software Security Code of Practice, the OpenSSF Memory Safety Continuum, and NIST SP 800-218 (SSDF). Pro documents include cross-mapping showing exactly which requirements your roadmap addresses.
Is my data safe? What do you store?
The generator runs entirely in your browser. Your company name, technology details, and security posture information are processed locally — never sent to our servers. PDFs are generated client-side too. We collect only anonymised, categorical usage data for service improvement. We use Burst Statistics — cookieless, self-hosted analytics with no personal data leaving your server. See our Privacy Policy.
How often is the rules engine updated?
We update when significant regulatory changes occur — new CISA guidance, EU CRA implementation milestones, OpenSSF updates, or UK government publications. Key dates include EU CRA Article 14 reporting obligations on 11 September 2026 and main CRA application on 11 December 2027.
Can I upload my SBOM for more accurate analysis?
Yes. The generator accepts CycloneDX and SPDX format SBOMs (JSON). When uploaded, the tool analyses your dependency tree to identify memory-unsafe libraries, native bindings, and language composition — using real data instead of estimates. The SBOM is parsed entirely in your browser. Available on all tiers.
What's the difference between Free and Pro?
Free generates the Executive Summary — a C-suite one-pager with your risk badge and key actions. Pro unlocks all six documents: Full Roadmap, Posture Assessment, MSL Selection Rationale, Executive Summary, Risk Register, and CRA Readiness Evidence Annex. Pro also includes regulatory cross-mapping, progress tracking with baselines, and JSON export.
Can I cancel at any time?
Yes. Cancel from your account page at any time. Access continues until the end of your billing period. We offer a 14-day refund window on subscriptions and renewals. See our Refund Policy.

Choose your plan

Start free. Upgrade when you need structured compliance documentation and CRA readiness evidence.

Billed monthly Billed yearly Save 35%
Free

Get started with your compliance baseline

£0
No card required
Generate Free Roadmap
Included:
  • Executive Summary document
  • 3 generations per day
  • Standard PDF output
  • CISA + EU CRA mapping
  • Client-side privacy
Pro

Structured documentation for software teams

£19
per month
Start Pro Plan
Everything in Free, plus:
  • All 6 compliance documents
  • 25 generations per day
  • Professional PDF quality
  • SBOM-aware analysis
  • Regulatory cross-mapping
  • CRA readiness evidence annex
  • Local attestation JSON
  • Consultant Output Mode
  • Progress tracking with baselines
  • JSON data export
Enterprise

Tailored for regulated organisations

Custom
Tailored to your organisation
Contact Sales
Everything in Pro, plus:
  • Unlimited generations
  • White-label output with platform branding removed
  • Custom document templates
  • Enterprise integration planning by agreement
  • Dedicated support