CISA's Secure by Design guidance lists three principles: take ownership of customer security outcomes, embrace radical transparency and accountability, and lead from the top. A software company can use them as year one themes: own what ships, be open about what you do, and make leadership visible in the plan.
What the guidance says
The joint publication, "Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software", was first published in April 2023 and updated on 25 October 2023 with expanded principles and eight new international co-sealers. CISA published it together with 17 U.S. and international partners. CISA says it urges software manufacturers to ship secure by design products, and describes the update as showing how manufacturers can demonstrate the principles to customers and the public.
It is guidance for manufacturers, not a certification or a legal standard, and nothing here should be read as a claim that a given company meets it.
Turning the principles into themes
| Principle | What it can mean for a 20 to 200 engineer company | Roadmap examples |
|---|---|---|
| Take ownership of customer security outcomes | Treat customer risk as your risk, not just your own infrastructure's | Default secure settings, fast handling of reported issues, a way to tell customers about fixes |
| Embrace radical transparency and accountability | Say plainly what you do and what you do not | Honest security page, public disclosure policy, clear advisories |
| Lead from the top | Leadership owns the security plan | Named executive owner, security on the leadership agenda each quarter |
These are interpretations, and you should adapt them.
Quarter by quarter
- Quarter 1: lead from the top. Name the owner, put security on the agenda, write the plan.
- Quarter 2: take ownership of outcomes. Scan, fix and ship secure defaults in the product.
- Quarter 3: transparency. Publish a security summary, a vulnerability reporting route, and a notice process for customers.
- Quarter 4: accountability. Review results against the plan and tell leadership, and where appropriate customers, what changed.
Questions to ask of each feature
- If a customer does nothing, is the default safe?
- Can they find out when we fix something?
- Would we be comfortable describing this control publicly?
If the answer to the last question is no, the control probably needs work or the claim needs trimming.
Where this connects to practice
A reporting route and a disclosure policy are small, concrete steps. They also tie to the CISA performance goals on vendors, which expect suppliers to notify customers of incidents and vulnerabilities, so you will meet the same expectation from buyers.
What to avoid
Do not turn principles into slogans on a web page. Each statement should link to something you do. If it is merely planned, say it is planned.
Safeguard's zero-day discovery and reachability analysis help a software producer find and prioritize issues in what it ships, and the free scan at gold.safeguard.sh is a way to begin.
Quick check
Is Secure by Design a certification?
No. It is guidance from CISA and partners for software manufacturers.
Do small companies need to follow it?
It is aimed at manufacturers broadly. Small companies can adopt the principles at a scale that suits them, and should not claim more than they do.
Sources
- CISA: Secure-by-Design
- CISA Cybersecurity Performance Goals (archived page that points to a newer version)
Last reviewed: 19 October 2026.
