+1.2 Scope and methodology

1.2 Scope and methodology

This guidance was developed with SMEs, including microenterprises, in mind, particularly SME manufacturers developing products with digital elements, such as embedded software, internet of things (IoT) devices, connected systems, stand-alone software and any hardware incorporating programmable components. It addresses security requirements throughout the product life cycle, from product design to decommissioning.

An SME is defined as an organisation with fewer than 250 employees and an annual turnover below EUR 50 million (3). SME manufacturers typically face (4):

  • budget constraints – limited financial resources for security investments (5);
  • limited expertise – no dedicated security personnel, reliance on general IT staff;
  • skills gaps – minimal specialist security knowledge within the organisation;
  • time pressures – security competing with core business priorities.

For the purpose of this report, ENISA performed an analysis of existing security frameworks, such as those previously published by ENISA and other EU-based cybersecurity agencies, and relevant guidance from the US National Institute of Standards and Technology (NIST) and the Open Worldwide Application Security Project (OWASP) (6). We identified common requirements and implementation patterns, which were evaluated against SME capabilities to determine feasibility and adaptation requirements.

While this report can support a solid technical foundation for making products secure by design and default, it serves as introductory guidance rather than a comprehensive compliance manual. Adherence to the principles outlined in this report does not inherently ensure certification against specific international standards or compliance with regulatory mandates. Instead, it acts as a foundational bridge to help teams navigate the complexities of secure product development.

Cybersecurity threats, technologies and good practices continue to evolve. This playbook may therefore be updated or complemented over time by additional guidance and resources, such as the ENISA technical advisories (7). For example, while embedded, field-level and industrial products fall within the scope of this report, the guidance may need to be adapted or supplemented to account for their specific technical and operational constraints.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer