CISA's Secure by Demand guide is a fact sheet that helps software buyers assess how a manufacturer approaches product security. It gives questions on patching, authentication, vulnerability classes, logging, supply chain and disclosure, usable before, during and after procurement. It is guidance, and it is the buyer side counterpart to Secure by Design.
Who it is for
The guide is aimed at organizations buying software, including through resellers or service providers. It pairs with CISA's Secure by Design guidance for manufacturers. CISA describes three moments to use it: before procurement by asking candidates about product security, during procurement by adding security requirements to contracts where appropriate, and after procurement by continually assessing the manufacturer.
The question areas
General. Has the manufacturer taken CISA's Secure by Design Pledge and published progress reports? How easily can customers install security patches, including automatically?
Authentication. Is standards based single sign-on available at no extra cost? Are multifactor authentication or passkeys on by default at no cost? Have default passwords been eliminated or reduced?
Eliminating classes of vulnerability. Which classes has the manufacturer systematically addressed, and what is the roadmap for the rest? The guide gives examples such as parameterized queries, web template frameworks, memory safe languages and secure defaults.
Evidence of intrusions. Are security logs part of the baseline product? For cloud and software as a service providers, the guide suggests retaining logs for at least six months at no extra charge, covering configuration changes, identity and network activity and data access.
Software supply chain. Does the manufacturer provide a machine readable SBOM listing all third party components, including open source? How does it vet open source components and contribute back, for example through an open source program office?
Vulnerability disclosure. Do CVE records carry accurate CWE and CPE fields? Is there a published vulnerability disclosure policy that authorizes public testing?
Turning it into a vendor review
Paste the six areas into your security review template and ask for written answers. Mark each answer as documented, demonstrated or only claimed. A demonstrated answer is one you can see, such as a sample SBOM or a log export.
Pay attention to the cost questions. The guide repeatedly asks whether a security feature is available at no extra cost, which is a pricing and packaging check as much as a technical one.
What the guide is not
It is not a certification, and the guide does not tell you what score to expect. Use it to structure the conversation. For a broader review process, see appsec vendor security review before you buy.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at the component list, which is the kind of machine readable inventory the supply chain question asks a manufacturer to provide.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning and compliance and evidence automation. A free scan is available at gold.safeguard.sh/scan.
Quick check
Is Secure by Demand a regulation?
It is a CISA fact sheet that helps buyers ask questions. It does not create obligations by itself.
Does it ask for an SBOM?
Yes. It asks whether the manufacturer provides a machine readable SBOM listing all third party components, including open source.
Sources
Last reviewed: 19 October 2026.
