Bill Gates launched Microsoft's Trustworthy Computing initiative with a memo dated 15 January 2002. According to Wikipedia, it named four key areas: security, privacy, reliability and business integrity. The lasting lesson is that a security change at scale starts with leadership declaring it a priority, then backing that with process.
What the sources say
The Wikipedia article on trustworthy computing states the memo date, and that it cited an internal whitepaper by Craig Mundie. It lists the four areas above. It does not describe the Secure Development Lifecycle, which appears only as a link to a separate page, so this post does not describe it either.
Why 2002 matters in this history
Look at the dates in other posts in this series. Code Red appeared in 2001 and Slammer in 2003. The memo sits between two widely known worm outbreaks. The sources cited here do not say that the worms caused the memo, so do not assume a direct link.
What the memo shows about how change happens
A few general points that hold for any organisation, offered as experience and not as claims about that company:
- A priority needs an owner. Security work competes with feature work unless someone senior says which wins.
- Process outlasts a memo. The memo is the announcement. Training, checklists, reviews and gates are what change daily behaviour.
- Several goals at once. The four areas included privacy and reliability, which reminds teams that security is one part of trust.
Applying this at a small company
You do not need a company wide memo. You do need a short, written statement that answers three questions:
- What will we not ship?
- Who can block a release for security reasons?
- How do we find out when something slips?
Put it in the engineering handbook. Revisit it when you hit your first real incident.
What this post cannot confirm
It does not cover the outcome of the initiative or its measured effect. Those would need further sources, and it is better to leave them out than to guess.
Turning a statement into practice
A statement of intent works when it becomes a rule that someone enforces. One approach is to pick three release rules that can be checked automatically, such as no known critical flaws in dependencies, no secrets in source, and a second reviewer for changes to authentication code. Write them down, assign an owner, and report the pass rate monthly. The first month will be messy. That is useful information. The aim is a steady habit, not a one time announcement, and the evidence of the habit is what customers eventually ask to see.
Quick check
What date was the memo?
15 January 2002, according to the source cited below.
What were the four key areas?
Security, privacy, reliability and business integrity.
Safeguard supports policies, gates and guardrails so a written security commitment becomes a rule in the pipeline, and a free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
