CISA’s secure-by-design framing centres on three manufacturer principles

CISA’s public explanation of its updated secure-by-design guidance on 16 November 2023 highlights three principles: take ownership of customer security outcomes, embrace radical transparency and accountability, and lead from the top. [Source: CISA, 16 November 2023.]

Those principles describe a product-security approach; they are not a certification label for a particular supplier or product.

Expect buyers to ask what is secure by default, what still needs customer configuration and how the supplier handles product-security issues. Answer from approved product evidence. If a feature exists but is not enabled, or a customer action is still required, keep that dependency visible rather than treating “secure by design” as a substitute for the actual control description. This also helps partners avoid repeating a product-security claim more broadly than the supplier evidence permits.

Relevant programme: Develop product-security judgment with the ASTRA Cybersecurity Sales Specialist programme: https://www.astraready.com/programmes/