Enabling Comprehensive CWE-based Assurance for RISC-V Processors

Abstract This paper presents a scalable, Common Weakness Enumeration (CWE)–based security assurance methodology for third-party RISC-V processor IP, developed collaboratively by Cycuity, BAE Systems, and SiFive. The approach adapts the MITRE Corporation CWE framework to systematically derive security requirements, verification properties, and evidence for RISC-V cores treated as third-party IP. By introducing reusable assurance templates, portable security tests, and a “golden model” reference,