diff --git a/cheriot/cheriot_state.cc b/cheriot/cheriot_state.cc
index 882e1cf..28edaec 100644
--- a/cheriot/cheriot_state.cc
+++ b/cheriot/cheriot_state.cc
@@ -36,6 +36,7 @@
 #include "mpact/sim/util/memory/tagged_memory_interface.h"
 #include "riscv//riscv_csr.h"
 #include "riscv//riscv_misa.h"
+#include "riscv//riscv_pmp.h"
 #include "riscv//riscv_state.h"
 
 ABSL_FLAG(uint64_t, revocation_ram_base, 0x8000'0000,
@@ -47,13 +48,14 @@
 namespace sim {
 namespace cheriot {
 
+using EC = ::mpact::sim::riscv::ExceptionCode;
 using ::mpact::sim::generic::operator*;  // NOLINT: used below (clang error).
 using ::mpact::sim::riscv::IsaExtension;
-using ::mpact::sim::riscv::RiscVXlen;
-using EC = ::mpact::sim::riscv::ExceptionCode;
 using ::mpact::sim::riscv::RiscVCsrEnum;
 using ::mpact::sim::riscv::RiscVCsrInterface;
+using ::mpact::sim::riscv::RiscVPmp;
 using ::mpact::sim::riscv::RiscVSimpleCsr;
+using ::mpact::sim::riscv::RiscVXlen;
 
 // These helper templates are used to store information about the CSR registers
 // used in CHERIoT RiscV (32 bits).
@@ -221,6 +223,10 @@
   // User level CSRs
   // None in CHERIoT.
 
+  // PMP CSRs
+  state->pmp_ = new RiscVPmp(state);
+  state->pmp_->CreatePmpCsrs<T, RiscVCheriotCsrEnum>(state->csr_set());
+
   // Simulator CSRs
 
   // Access current privilege mode. Omitted.
@@ -306,6 +312,7 @@
   delete pc_src_operand_;
   for (auto *csr : csr_vec_) delete csr;
   delete csr_set_;
+  delete pmp_;
   delete temp_reg_;
   revocation_db_->DecRef();
 }
diff --git a/cheriot/cheriot_state.h b/cheriot/cheriot_state.h
index 6d0ec7e..c736f71 100644
--- a/cheriot/cheriot_state.h
+++ b/cheriot/cheriot_state.h
@@ -40,6 +40,7 @@
 #include "riscv//riscv_csr.h"
 #include "riscv//riscv_fp_state.h"
 #include "riscv//riscv_misa.h"
+#include "riscv//riscv_pmp.h"
 #include "riscv//riscv_register.h"
 #include "riscv//riscv_state.h"
 #include "riscv//riscv_vector_state.h"
@@ -69,6 +70,7 @@
 using ::mpact::sim::riscv::RiscVMIp;
 using ::mpact::sim::riscv::RiscVMIsa;
 using ::mpact::sim::riscv::RiscVMStatus;
+using ::mpact::sim::riscv::RiscVPmp;
 using ::mpact::sim::riscv::RiscVSimpleCsr;
 using ::mpact::sim::riscv::RVVectorRegister;
 
@@ -448,6 +450,7 @@
   CheriotRegister *mscratchc_ = nullptr;
   CheriotRegister *mtdc_ = nullptr;
   CheriotRegister *temp_reg_ = nullptr;
+  RiscVPmp *pmp_ = nullptr;
   RiscVCsrInterface *mtval_ = nullptr;
   RiscVCsrInterface *mcause_ = nullptr;
   RiscVCheri32PcSourceOperand *pc_src_operand_ = nullptr;
diff --git a/cheriot/riscv_cheriot_csr_enum.h b/cheriot/riscv_cheriot_csr_enum.h
index 3988611..0000bb1 100644
--- a/cheriot/riscv_cheriot_csr_enum.h
+++ b/cheriot/riscv_cheriot_csr_enum.h
@@ -17,21 +17,6 @@
 #ifndef MPACT_CHERIOT__RISCV_CHERIOT_CSR_ENUM_H_
 #define MPACT_CHERIOT__RISCV_CHERIOT_CSR_ENUM_H_
 
-#include <any>
-#include <cstddef>
-#include <cstdint>
-#include <limits>
-#include <string>
-#include <type_traits>
-#include <vector>
-
-#include "absl/container/flat_hash_map.h"
-#include "absl/status/status.h"
-#include "absl/status/statusor.h"
-#include "absl/strings/string_view.h"
-#include "mpact/sim/generic/data_buffer.h"
-#include "mpact/sim/generic/operand_interface.h"
-
 // This file contains CHERIoT specific definitions for classes used to model the
 // RiscV control and status registers. For now, these are not modeled as actual
 // register state, instead, they're tied into the RiscV machine state a bit
@@ -112,7 +97,27 @@
   kMTval = 0x343,     // Machine bad address or instruction.
   kMIp = 0x344,       // Machine interrupt pending.
 
-  // Ignoring machine memory protection for now.
+  // PMP registers.
+  kPmpCfg0 = 0x3a0,    // PMP configuration register 0.
+  kPmpCfg1 = 0x3a1,    // PMP configuration register 1 (only for RV32).
+  kPmpCfg2 = 0x3a2,    // PMP configuration register 2.
+  kPmpCfg3 = 0x3a3,    // PMP configuration register 3 (only for RV32).
+  kPmpAddr0 = 0x3b0,   // PMP address register 0.
+  kPmpAddr1 = 0x3b1,   // PMP address register 1.
+  kPmpAddr2 = 0x3b2,   // PMP address register 2.
+  kPmpAddr3 = 0x3b3,   // PMP address register 3.
+  kPmpAddr4 = 0x3b4,   // PMP address register 4.
+  kPmpAddr5 = 0x3b5,   // PMP address register 5.
+  kPmpAddr6 = 0x3b6,   // PMP address register 6.
+  kPmpAddr7 = 0x3b7,   // PMP address register 7.
+  kPmpAddr8 = 0x3b8,   // PMP address register 8.
+  kPmpAddr9 = 0x3b9,   // PMP address register 9.
+  kPmpAddr10 = 0x3ba,  // PMP address register 10.
+  kPmpAddr11 = 0x3bb,  // PMP address register 11.
+  kPmpAddr12 = 0x3bc,  // PMP address register 12.
+  kPmpAddr13 = 0x3bd,  // PMP address register 13.
+  kPmpAddr14 = 0x3be,  // PMP address register 14.
+  kPmpAddr15 = 0x3bf,  // PMP address register 15.
 
   kMCycle = 0xb00,    // Machine cycle counter.
   kMInstret = 0xb02,  // Machine instructions-retired counter.