1. Introduction

Secure by design represents a fundamental shift in product security, with protective measures embedded from conception rather than retrofitted post-development. For small and medium-sized enterprises (SMEs), including microenterprises, that manufacture products, the transition to a secure by design approach presents distinct challenges requiring tailored solutions (1).

Secure by design is increasingly expected, including under the European Union’s Cyber Resilience Act (CRA) (2). This report does not provide legal guidance but offers practical, technically grounded approaches that can support manufacturers in applying the relevant principles in practice. It is intended as a practical starting point, rather than an exhaustive or prescriptive implementation framework. Its application should be adapted to the product’s intended use, context and associated risks and to the applicable requirements. For reference, Annex C provides an indicative mapping of the secure by design and default principles described in this report to the essential requirements set out in Annex I to the CRA, which are themselves listed in Annex B.

The report aims to bridge the gap between aspirational security principles and practical implementation within SME constraints, providing guidance that development teams can immediately apply during design, build and deployment phases.

The report takes into account the persistent challenges that SMEs face in translating security principles into engineering practice, acknowledging limitations on time, budget, expertise and resources. It provides structured, easy-to-follow checklists enabling organisations to:

• Identify relevant security controls (quick wins). Determine a priority set of protective measures that align with specific product requirements.
• Implement controls systematically (approachability). Apply security measures through technically feasible approaches.
• Enable measurable improvement. Establish measurable baselines and use relevant evidence to assess whether security processes and controls operate as intended, to guide improvement.

This guidance was developed with SMEs, including microenterprises, in mind, particularly SME manufacturers developing products with digital elements, such as embedded software, internet of things (IoT) devices, connected systems, stand-alone software and any hardware incorporating programmable components. It addresses security requirements throughout the product life cycle, from product design to decommissioning.

An SME is defined as an organisation with fewer than 250 employees and an annual turnover below EUR 50 million (3). SME manufacturers typically face (4):

• budget constraints – limited financial resources for security investments (5);
• limited expertise – no dedicated security personnel, reliance on general IT staff;
• skills gaps – minimal specialist security knowledge within the organisation;
• time pressures – security competing with core business priorities.

For the purpose of this report, ENISA performed an analysis of existing security frameworks, such as those previously published by ENISA and other EU-based cybersecurity agencies, and relevant guidance from the US National Institute of Standards and Technology (NIST) and the Open Worldwide Application Security Project (OWASP) (6). We identified common requirements and implementation patterns, which were evaluated against SME capabilities to determine feasibility and adaptation requirements.

While this report can support a solid technical foundation for making products secure by design and default, it serves as introductory guidance rather than a comprehensive compliance manual. Adherence to the principles outlined in this report does not inherently ensure certification against specific international standards or compliance with regulatory mandates. Instead, it acts as a foundational bridge to help teams navigate the complexities of secure product development.

Cybersecurity threats, technologies and good practices continue to evolve. This playbook may therefore be updated or complemented over time by additional guidance and resources, such as the ENISA technical advisories (7). For example, while embedded, field-level and industrial products fall within the scope of this report, the guidance may need to be adapted or supplemented to account for their specific technical and operational constraints.

This guidance is structured as a technical companion for software and product developers, systems engineers and technical leads. It is intended for those tasked with the practical implementation of secure by design and default principles in their product development life cycle.

The primary groups that will benefit from this guidance include

• Software developers and engineers. Professionals seeking tactical methods to embed security into the codebase while operating within rapid delivery cycles.
• Technical product managers. Individuals responsible for balancing functional requirements with the need for fundamental security resilience.
• SME security leads. Personnel tasked with interpreting enterprise-grade frameworks for organisations with limited budgets, specialised niches or lean teams.
• System architects. Designers aiming to build robust infrastructures that prioritise security from the initial conceptual phase.

The structure of the report is outlined below.

• Section 2 covers the product security life cycle and practical ways in which risk management activities and threat modelling can be applied in the context of an SME. The section includes a series of simple-to-follow steps showing how each of the activities can lead to tangible deliverables.
• Section 3 covers fundamental secure by design and secure by default principles. They are explained in an easy-to-understand manner. This section lays the foundation for the next sections. The report also includes a mapping of these principles to other ENISA security best practices and well-established resources, such as MITRE’s common weakness enumeration (CWE) and OWASP’s top 10 critical security risks for 2025.
• Section 4 , the most extensive part of the report, details each of the 22 principles by covering, for each, the objective, key elements to consider when applying it in an engineering context, means of collecting evidence that the principle has been followed and a set of criteria that can be used in a release review.
• Section 5 covers the concept of machine-processable attestation, offering an example of the implementation of a hierarchical data model that ensures that every high-level security claim is backed by granular technical evidence.
• The annexes summarise the CRA essential cybersecurity requirements, providing a mapping of the secure by design and default principles described in this report to those requirements, to show how the principles can support the implementation of the CRA.