CISA's Secure by Design guidance says security features such as multi-factor authentication, logging and single sign-on should come with a product at no extra cost. It is guidance, not law, but enterprise reviewers increasingly read gated security features as a signal. Treat SSO and audit logs as part of the product, not an upsell.
What CISA actually says
The CISA Secure by Design page states that multi-factor authentication, logging and single sign-on should be available out of the box, at no extra cost. Separately, the Secure by Design pledge has seven goals, and goal seven covers customers' ability to gather evidence of intrusions. Its example approaches for cloud and SaaS products include retaining logs for a set timeframe, with six months given as an example, at no additional charge.
Two cautions. The pledge is voluntary and aimed at software manufacturers who sign it. And the six months is an example in CISA's text, not a mandate for every product.
Why buyers care in a customer review
An enterprise security team asks three practical things about your product:
- Can we log in with our identity provider, so we control joiners and leavers?
- Can we see who did what in our tenant, so we can investigate?
- Can we get that data into our own monitoring?
If the answers are "yes, on a higher tier", the reviewer may still approve, but it adds a negotiation to the deal. If you are selling to a team that has read CISA's guidance, the gate itself becomes a finding.
A decision guide for a small team
| Situation | Reasonable approach |
|---|---|
| You have no SSO yet | Say so plainly in the questionnaire, give a quarter you can commit to, and support MFA meanwhile |
| SSO exists, gated behind a plan | Consider moving it to the base product, or be ready to explain the reasoning |
| Audit logs exist but only in the admin UI | Add an export or API, and document retention |
| Logs exist but are short lived | State the retention period honestly and publish it |
None of this tells you how to set your plans. That is a business decision. The point is that the security features buyers ask about are cheap to defend when they are standard and awkward to defend when they are an add-on.
What to document either way
- Which identity protocols you support and how a customer enables them.
- Which events your audit log records, with a sample record.
- How long customers can read logs, and how they can export them.
- Who inside your company can see customer logs, and under what approval.
Put these on your trust page so reviewers find them before they ask.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how ongoing signals, not one time checks, are what give a reviewer confidence.
Safeguard offers policies, gates and guardrails plus compliance evidence automation, which help you keep the record of who changed what. You can try the free scan on a repository to start.
Quick check
Is charging for SSO prohibited?
No. CISA's Secure by Design material is voluntary guidance. It says features like SSO and logging should be available at no extra cost, but it does not forbid pricing models.
Is six months of logs required?
No. Six months appears as an example in CISA's pledge text for cloud and SaaS products. Set a retention period that fits your risk and state it clearly.
Sources
- CISA, Secure by Design: statement that MFA, logging and SSO should come at no extra cost. Paraphrased.
- CISA, Secure by Design Pledge: seven goals and the example of log retention at no additional charge. Paraphrased.
Last reviewed: 19 October 2026.
