Secure by Design means the vendor, not each school, carries more of the security burden: strong settings on by default, at no extra charge, and safe development practices. CISA and the Department of Education have asked edtech vendors to commit, through a voluntary pledge, to this approach.
Where the idea comes from
CISA's K-12 acquisition guidance ties itself to the National Cybersecurity Strategy, which calls for shifting security responsibility from customers to manufacturers. The stated purpose is to help the K-12 community acquire products that are Secure by Design.
CISA's update on its work with edtech vendors adds the reasoning. A relatively small number of vendors serve thousands of districts, so moving responsibility upstream to them is more realistic than asking each district to fix things alone. The brief asks vendors to ship "robust security settings by default at no additional charge," and CISA reported eleven vendors had committed to the voluntary K-12 pledge at the time of that update. Check the CISA K-12 page for the current roster before citing a number.
What it means in a software company
Three ideas are worth translating into engineering terms.
Safe defaults. Multifactor authentication, logging, and sensible permissions should be on when a district signs up, not hidden behind a premium tier. CISA notes that MFA is a key control but that schools struggle to deploy it because of limited support staff, spotty phone coverage, and classroom phone restrictions. A vendor that offers workable options removes that burden.
Owning your supply chain. If your product ships with open source code, you own what that code does in a classroom. A dependency list that is generated, reviewed, and acted on is part of the answer.
A repeatable development process. The NIST SSDF, SP 800-218 version 1.1, describes a core set of high level secure development practices intended to reduce vulnerabilities in released software and limit the impact of those you miss.
A starter list for a small team
- Turn on MFA and make it the default for staff and admin accounts. Offer a method that works without personal phones.
- Generate a dependency inventory on every build and keep it.
- Pick a rule for how you handle serious vulnerabilities, and write it down.
- Publish a way for researchers to report problems, such as a security contact page.
- Remove features and packages you no longer need.
- Tell customers when defaults change, and why.
What not to claim
Signing a pledge or following a framework is not a certification, and it does not prove that a product is secure. Describe your practices as practices. If you joined an initiative, say exactly which one and when.
Quick check
Is the CISA pledge mandatory?
No. CISA describes it as a voluntary initiative open to edtech vendors.
Does Secure by Design mean zero vulnerabilities?
No. It means building so that fewer are introduced, risk is reduced when they occur, and customers are not left to configure safety themselves.
Safeguard's policies and gates, dependency scanning, and compliance evidence automation are the kinds of tooling that help a team show these practices with records, and the free scan is an easy first step.
Sources
- Cybersecurity Guidance for K-12 Technology Acquisitions (CISA)
- Findings and updates on CISA's collaboration with education technology vendors
- NIST SP 800-218, SSDF Version 1.1
Last reviewed: 19 October 2026.
