Executive summary

Modern products with digital elements are increasingly expected to be secure by design and secure by default . However, many organisations – in particular small and medium-sized enterprises, in which development teams are small and security expertise can be limited – may face distinct challenges in applying these concepts consistently, requiring targeted solutions.

This report puts forward a set of principles and tangible guidance on the application of secure by design and default requirements throughout the life cycle of a product. In particular, the report focuses on explaining these principles in clear, repeatable actions that can be applied to existing engineering, product and release processes.

The secure by design principles are organised into two groups, namely architectural foundations

and operational integrity . The former addresses how the system is designed, implemented and built, while the latter focuses on how the system is distributed, installed, managed and maintained. Similarly,

the secure by default principles are grouped into the categories default hardening and guided

protection . The former ensures that products start in a secure and restrictive state, while the latter aims to support users in maintaining the secure baseline through clear defaults, warnings and recovery mechanisms.

A core part of this document is a set of practical Secure by Design and Default playbooks. Each playbook presents the principle’s objective, practical actions, and a set of evidence that could support the demonstration of its implementation. Annex C provides an indicative mapping of the principles presented in this report to the essential requirements set out in Annex I to the European Union’s Cyber Resilience Act.

The report also presents an illustrative example of a machine-processable attestation, demonstrating how voluntary, manufacturer-issued machine-processable artefacts are able to provide a high-fidelity record of a product’s security posture. Rather than proposing a new schema or prescribing a specific format, the example illustrates how machine-processable attestations can express security claims, supporting evidence and verification results in a structured format, enabling automated processing and validation.

This approach also allows for the automation of security checks and release decisions, which helps to ensure that secure by design and default properties are maintained over time. This capability is particularly valuable for small and medium-sized enterprises with limited security resources, because it reduces the need for manual audits while increasing confidence in the product’s security posture.

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

• ENISA -