Secure by Design
What is Secure by Design?
An approach to product development that integrates security considerations from the earliest design phases rather than adding them after development.
Terms that appear alongside secure by design
Each of these is named in at least one of the same controls as secure by design. The number is how many controls name both.
- cisa 5 shared controls
- cybersecurity 5 shared controls
- transparency 2 shared controls
- secure development lifecycle 2 shared controls
- vulnerability 2 shared controls
- vulnerability disclosure 2 shared controls
- accountability 2 shared controls
- integrity 2 shared controls
Frameworks that govern secure by design
What the standards actually require on secure by design
Requirements naming secure by design across 6 standards, quoted from the control text.
Name a top business executive publicly as the owner of the secure by design programme, turning product security from a task delegated to technical teams into a business concern with the authority to make structural change.
secure-by-design-a-guide-for-manufacturers-cisa::P2-BP1 · Publicly name a secure by design executive sponsor →Secure by Design principles and practices are followed throughout the software development life cycle.
ISM-0401 · Secure by Design in software development →Security is designed into essential-function systems, the attack surface is minimised and no single vulnerability should disrupt the function.
uk-ncsc-caf::B4.a · B4.a Secure by design →Article 8 imposes security obligations on the National Cyber Hubs and Cross-Border Cyber Hubs as integral parts of the Alert System: technical and organisational measures to ensure confidentiality, integrity and availability of the Hub infrastructure and the d...
CSA-Art.8 · Security of the Alert System (Article 8) →Operate OT supply chain + asset lifecycle + physical security per NIST SP 800-82 Rev 3 Chapter 6 + Chapter 7. OT Supply Chain Security must (a) qualify OT vendors and suppliers per NIST SP 800-161 Supply Chain Risk Management tailored to OT (vendor cybersecuri...
NISTSP82-8 · OT Supply Chain Security, Asset Lifecycle, and Physical Security →Technology manufacturers and vendors whose products support quantum-vulnerable cryptography should begin planning and testing for PQC integration, reviewing NIST's PQC standards (drafts when the factsheet was issued, final as FIPS 203, 204 and 205 since August...
nsa-guidance-for-transition-to-quantum-resistant-cryptography::R-VENDORRESP · R-VENDORRESP Vendors plan and test PQC integration and prepare to support it as soon as NIST standards are final →Questions people ask about secure by design
What is Secure by Design?
Why is Secure by Design important for compliance?
Which compliance frameworks address Secure by Design?
Where can I learn more about Secure by Design?
See how Secure by Design applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.