The way this would likely end up being handled is the same as any other compliance. You define the threat model for your application and then justify why you'r

The way this would likely end up being handled is the same as any other compliance. You define the threat model for your application and then justify why you're safe. In this case we'd be adding an explicit point to ensure that there are controls for attackers who can exploit memory safety issues. You could end up with controls like: 1. We sandbox our code, so even though it's C we feel that we're safe 2. We use a memory safe language to reduce the risk of memory safety issues 3. We sanitizer inputs before providing them to the program etc etc What ends up being accepted as legitimate would be up to the auditors/ generally a matter of consensus.