Policy Briefing — CISA Secure-by-Design and Default Guidance Released

Executive briefing: On 13 April 2023 the U.S. Cybersecurity and Infrastructure Security Agency (CISA), FBI, NSA, and allied agencies issued the Secure-by-Design and Secure-by-Default guidance.^{CISA advisory}^{Joint guide} The publication outlines expectations for software manufacturers to embed security into product roadmaps, including default configurations, vulnerability handling, and transparent communication. CISA has since launched a Secure by Design pledge that compels vendors to publish memory safety, secure default, and vulnerability disclosure milestones for quarterly oversight.^{Pledge launch}^{Pledge fact sheet}

Key recommendations

Eliminate default insecure settings. Vendors should ship secure defaults that minimise exposure without customer intervention.
Invest in memory-safe languages. Agencies urge migration away from memory-unsafe code where feasible and adoption of exploit mitigations such as Control-Flow Integrity.
Streamlined vulnerability disclosure. Vendors must publish clear vulnerability reporting channels, offer SBOMs, and avoid punitive terms for researchers.

Implementation guidance

Product roadmaps. Prioritise remediation of insecure defaults, aligning backlog grooming with the guidance’s checklist.
Engineering metrics. Track vulnerability remediation timelines, exploit maturity, and memory safety adoption to demonstrate progress.
Customer communication. Prepare transparent advisories and changelogs documenting security-impacting updates.

Enablement moves

Run cross-functional workshops with product, engineering, and legal teams to map guidance items to existing SDLC controls.
Update secure development policies to include memory-safety requirements and security-first backlog triage.
Coordinate with procurement teams to require secure-by-design attestations from third-party vendors.
Request Secure by Design pledge updates from strategic suppliers and tie their published milestones to executive and regulator briefings.^{Pledge launch}^{Pledge fact sheet}