1.4 Structure of the report

The structure of the report is outlined below.

• Section 2 covers the product security life cycle and practical ways in which risk management activities and threat modelling can be applied in the context of an SME. The section includes a series of simple-to-follow steps showing how each of the activities can lead to tangible deliverables.
• Section 3 covers fundamental secure by design and secure by default principles. They are explained in an easy-to-understand manner. This section lays the foundation for the next sections. The report also includes a mapping of these principles to other ENISA security best practices and well-established resources, such as MITRE’s common weakness enumeration (CWE) and OWASP’s top 10 critical security risks for 2025.
• Section 4 , the most extensive part of the report, details each of the 22 principles by covering, for each, the objective, key elements to consider when applying it in an engineering context, means of collecting evidence that the principle has been followed and a set of criteria that can be used in a release review.
• Section 5 covers the concept of machine-processable attestation, offering an example of the implementation of a hierarchical data model that ensures that every high-level security claim is backed by granular technical evidence.
• The annexes summarise the CRA essential cybersecurity requirements, providing a mapping of the secure by design and default principles described in this report to those requirements, to show how the principles can support the implementation of the CRA.

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

• ENISA -