1.2 Scope and methodology

This guidance was developed with SMEs, including microenterprises, in mind, particularly SME manufacturers developing products with digital elements, such as embedded software, internet of things (IoT) devices, connected systems, stand-alone software and any hardware incorporating programmable components. It addresses security requirements throughout the product life cycle, from product design to decommissioning.

An SME is defined as an organisation with fewer than 250 employees and an annual turnover below EUR 50 million (3). SME manufacturers typically face (4):

• budget constraints – limited financial resources for security investments (5);
• limited expertise – no dedicated security personnel, reliance on general IT staff;
• skills gaps – minimal specialist security knowledge within the organisation;
• time pressures – security competing with core business priorities.

For the purpose of this report, ENISA performed an analysis of existing security frameworks, such as those previously published by ENISA and other EU-based cybersecurity agencies, and relevant guidance from the US National Institute of Standards and Technology (NIST) and the Open Worldwide Application Security Project (OWASP) (6). We identified common requirements and implementation patterns, which were evaluated against SME capabilities to determine feasibility and adaptation requirements.

While this report can support a solid technical foundation for making products secure by design and default, it serves as introductory guidance rather than a comprehensive compliance manual. Adherence to the principles outlined in this report does not inherently ensure certification against specific international standards or compliance with regulatory mandates. Instead, it acts as a foundational bridge to help teams navigate the complexities of secure product development.

Cybersecurity threats, technologies and good practices continue to evolve. This playbook may therefore be updated or complemented over time by additional guidance and resources, such as the ENISA technical advisories (7). For example, while embedded, field-level and industrial products fall within the scope of this report, the guidance may need to be adapted or supplemented to account for their specific technical and operational constraints.

1. Prezentare generală

1.1 Referințe

1.2 Cerințe identificate

1.3 Reglementări asociate

2. Cerințe identificate

3. Reglementări asociate

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.