High-level planning and process for product security.
View All Tags
In July 2026, ENISA published the Secure by Design and Default Playbook, a practical guide aimed at small and medium-sized manufacturers building products with digital elements (ENISA publication, PDF). It is a welcome addition to the CRA guidance landscape: clear principles, repeatable engineering actions, and release gates that lean teams can actually use.
On 12 May 2026, CISA highlighted an updated version of the joint Secure-by-Design guidance, co-sealed by additional international cybersecurity agencies. The update reinforces the core message behind the movement: technology providers should take ownership of customer security outcomes, be transparent about their security posture, and treat security as an executive-level product responsibility (CISA Secure-by-Design resource).
The UK's Ministry of Defence (MOD) recently published a thought-provoking document via its Defence Science and Technology Laboratory (Dstl) that every product security leader should read: the Secure by Design Problem Book.