+1.1 Objectives
---+1.1.1 Intended outcomes

1.1 Objectives

Secure by design represents a fundamental shift in product security, with protective measures embedded from conception rather than retrofitted post-development. For small and medium-sized enterprises (SMEs), including microenterprises, that manufacture products, the transition to a secure by design approach presents distinct challenges requiring tailored solutions (1).

Secure by design is increasingly expected, including under the European Union’s Cyber Resilience Act (CRA) (2). This report does not provide legal guidance but offers practical, technically grounded approaches that can support manufacturers in applying the relevant principles in practice. It is intended as a practical starting point, rather than an exhaustive or prescriptive implementation framework. Its application should be adapted to the product’s intended use, context and associated risks and to the applicable requirements. For reference, Annex C provides an indicative mapping of the secure by design and default principles described in this report to the essential requirements set out in Annex I to the CRA, which are themselves listed in Annex B.

The report aims to bridge the gap between aspirational security principles and practical implementation within SME constraints, providing guidance that development teams can immediately apply during design, build and deployment phases.

The report takes into account the persistent challenges that SMEs face in translating security principles into engineering practice, acknowledging limitations on time, budget, expertise and resources. It provides structured, easy-to-follow checklists enabling organisations to:

  • Identify relevant security controls (quick wins). Determine a priority set of protective measures that align with specific product requirements.
  • Implement controls systematically (approachability). Apply security measures through technically feasible approaches.
  • Enable measurable improvement. Establish measurable baselines and use relevant evidence to assess whether security processes and controls operate as intended, to guide improvement.

1. Přehled

1.1.1 Intended outcomes

Applying this playbook is intended to contribute to:

  • fewer recurring and preventable vulnerabilities;
  • products delivered with safer default configuration and reduced unnecessary exposure;
  • earlier identification and treatment of security risks;
  • better visibility and stronger protection of dependencies, build processes, releases and updates;
  • faster detection, remediation and communication of vulnerabilities;
  • reduced likelihood and impact of cybersecurity incidents throughout the product life cycle.

These outcomes benefit users and operators through safer and more resilient products. Manufacturers benefit through more consistent security decisions, while customers and integrators benefit through clearer and more traceable security evidence.

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace