CISA's Secure by Demand guide gives organizations that buy software a list of questions to put to manufacturers, grouped under patching, authentication, vulnerability classes, intrusion evidence, supply chain and disclosure. It is guidance for buyers, not a regulation. Suppliers can prepare written answers to the same questions.
What the guide is
CISA describes it as a buyer-side companion to its Secure by Design guidance for manufacturers. The page offers questions and resources for judging a manufacturer's approach, and says the content can be used in talks with resellers and service providers too. It does not state that anything is mandatory.
The questions that touch supply chain and disclosure
These are paraphrased from the page, with short quotes.
| Topic | What the buyer may ask |
|---|---|
| General | Has the manufacturer taken the Secure by Design Pledge, and what progress reports has it published? How does it make installing patches simple? |
| SBOM | Does it generate an SBOM "in a standard, machine-readable format" and make it available to customers? |
| Dependencies | Does the SBOM list all third party dependencies, including open source? |
| Open source | How does it vet open source components, and does it have a process such as an open source program office? |
| CVE records | Are accurate CWE and CPE fields included in every CVE record for its products? |
| Disclosure | Has it published a vulnerability disclosure policy that authorizes testing by members of the public? |
The guide has other categories as well: authentication, eliminating classes of vulnerability, and evidence of intrusions.
How to prepare answers
- Write one paragraph per question and date it.
- Link to artifacts a reader can open: your disclosure policy, a sample SBOM, your patching policy page.
- Be exact about the pledge. If you have not signed it, say so. See what the pledge is.
- Keep the answer true on the day you send it. Buyers compare answers across suppliers.
Where this fits with agency rules
Since OMB M-26-05, agencies choose their own assurance requirements, so a buyer may borrow questions from this guide instead of using one form. Having ready answers helps with every variant. See what M-26-05 changed.
Try it yourself
Click through it at your own pace, or open it full screen.
Look for how transitive dependencies show up next to direct ones. The guide asks whether an SBOM lists all third party dependencies.
Quick check
Is Secure by Demand a certification?
No. It is a list of questions and resources for buyers.
Does it mention open source?
Yes. It asks how a manufacturer vets open source components and whether it has a process for that.
Safeguard provides SBOM and dependency scanning and policies and gates, which help produce the artifacts these questions ask about. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
