3.2.2 Guided protection

Guided protection addresses the interaction between the user and the system’s security features. It acknowledges that human error is a primary cause of breaches and uses automated prompts, mandatory set-up steps and clear feedback to ensure that the user cannot easily or accidentally leave the system in an insecure state.

• Mandatory security onboarding. Critical security features should not be hidden in a settings menu; they should be part of the initial set-up wizard. For instance, requiring a user to configure MFA or an encryption key during the first-run experience ensures that the system enters a secure state before it is exposed to the internet.
• Automated maintenance and updates. A secure default posture must be sustainable. By enabling automatic security updates by default, the manufacturer ensures that the product remains protected against newly discovered vulnerabilities without requiring the SME to have a dedicated IT team to manually manage patching cycles.
• Transparent security posture. The system should clearly communicate its security status to the user. If a user chooses to disable a security feature or if a specific configuration increases risk, the system must provide a clear, understandable warning and offer a one-click path to return to the secure baseline.
• Secure recovery and ownership life cycle. The product should provide guided, low-friction recovery and transfer processes (credential reset, account recovery, secure factory reset and ownership transfer) that are simple for users to follow but resistant to account takeover and social engineering.

1. Преглед

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

3. Свързани регулации

• ENISA -