Key takeaways
- Use the April 2025 fact sheet's "Questions I Should Ask" column as literal vendor-call script, since it was built from the same 12 elements specifically to speed up that conversation.
CISA's Secure by Demand guide — formally "Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products," published 13 January 2025 and marked TLP:CLEAR (distributable without restriction) — tells OT owners and operators what to require from manufacturers before they buy, rather than after a compromise. It was authored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) together with the NSA, FBI, EPA, TSA, Australia's ASD Cyber Security Centre, Canada's Centre for Cyber Security, the European Commission's DG CONNECT, Germany's BSI, the Netherlands' NCSC-NL, New Zealand's NCSC-NZ and the UK's NCSC-UK. As a U.S. government work distributed TLP:CLEAR, it carries no reuse restriction.
Why the guide exists
The guide's own Summary frames the problem directly: "cyber threat actors, when compromising operational technology (OT) components, target specific OT products rather than specific organizations." It names the recurring weaknesses those actors exploit — "weak authentication, known software vulnerabilities, limited logging, insecure default settings and passwords, and insecure legacy protocols" — and argues that when "security is not prioritized nor incorporated directly into OT products, it is difficult and costly for owners and operators to defend their OT assets against compromise." The guide is CISA's Secure by Demand counterpart to its broader Secure by Design campaign: Secure by Design asks manufacturers to build security in; Secure by Demand asks buyers to require it at the procurement stage, using purchasing power to "send a message to manufacturers to stimulate the supply of Secure by Design products."
The 12 priority security elements
The guide's own "Considerations for OT Product Selection" section lists 12 elements and is explicit that "these elements are not in priority order":
| # | Element | What the guide says to look for |
|---|---|---|
| 1 | Configuration Management | Products that "backup and deploy system configurations in a secure and simple manner" |
| 2 | Logging in the Baseline Product | "Standardized access and change logs" using open logging formats, in the baseline version |
| 3 | Open Standards | Support for "open, interoperable standards to facilitate replacing or adding products" |
| 4 | Ownership | Full operator autonomy, "minimizing dependency on the vendor" |
| 5 | Protection of Data | Data "treat[ed]...as valuable and protect[ed]...at rest and during transit" |
| 6 | Secure by Default | No default passwords, insecure legacy protocols (e.g. SNMPv1/2, Telnet, SSL, TLS 1.0/1.1) disabled by default, no unnecessary exposed interfaces |
| 7 | Secure Communications | Authenticated communication with certificates that "fail loudly" without halting critical processes |
| 8 | Secure Controls | Resilience to malicious emergency/safety/diagnostic commands and active security scanning |
| 9 | Strong Authentication | Role-based access control plus "phishing-resistant multifactor authentication," no shared role-based passwords |
| 10 | Threat Modeling | "An up-to-date threat model that articulates the ways in which it might be compromised" |
| 11 | Vulnerability Management | A defined support period, free patches, an HBOM/SBOM provided with delivery, and a vulnerability disclosure program |
| 12 | Upgrade and Patch Tooling | A documented patch/upgrade process, with no-cost migration off an end-of-support OS |
The guide frames these as what buyers should "demonstrate" manufacturers are embedding into design and development — it is written for the procurement conversation, not as a conformity checklist a vendor self-certifies against.
How it connects to IEC 62443 and emerging EU law
On standards, the guide points buyers toward an existing reference rather than inventing a new one: "buyers should look for manufacturers that demonstrate their adoption of Secure by Design and International Society of Automation (ISA) 62443 standards," noting in its own footnote that "the ISA/IEC 62443 multi-part standard is internationally recognized as defining requirements and processes for implementing and maintaining electronically secure OT products, systems, and development lifecycles." See SoftWSP's guides to IEC 62443-4-2 component requirements and IEC 62443-4-1 secure development lifecycle for that standard's own device- and process-level detail, and IEC 62443-4-2 vs. the CRA for how the two map together.
On regulation, the guide notes that owners and operators "may need to consider regulatory requirements, such as the European Union's (EU's) NIS2 Directive, during digital systems acquisition," and its own footnotes flag the EU's Radio Equipment Directive delegated regulation (applying from 1 August 2025) and the Cyber Resilience Act (in force since 10 December 2024, requiring CE marking for in-scope products placed on the EU market) as examples of jurisdictions "laying down security-by-design in law." None of this makes Secure by Demand itself a legal requirement — it stays a voluntary procurement guide — but it explicitly signals that the same 12 elements overlap with obligations buyers may separately owe under EU law. See NIS2 explained and the Cyber Resilience Act for those legal duties directly.
The April 2025 fact sheet
Three months after the full guide, CISA published a shorter companion: the Secure by Demand Fact Sheet: Priority Considerations for Operational Technology Owners and Operators When Purchasing Digital Products (dated "as of April 2025," also TLP:CLEAR). The fact sheet states plainly that CISA "has based this list on the joint guidance" from January and "is providing it without ranking or priority" — it keeps the same 12 elements but reformats each into a two-column "Why This Matters" / "Questions I Should Ask" layout, designed as a faster reference to bring into an actual vendor conversation rather than the full 22-page guide's narrative detail.
A workable starting point
Build the 12 elements into RFPs and scoring criteria, not just a post-purchase checklist — the guide's own framing is about procurement leverage, asking manufacturers to "demonstrate" each element before a contract is signed. Use the April 2025 fact sheet's "Questions I Should Ask" column as literal vendor-call script, since it was built from the same 12 elements specifically to speed up that conversation. Cross-reference Vulnerability Management and Upgrade/Patch Tooling against your SBOM practice— the guide ties both elements to a manufacturer providing a bill of materials and a defined, free-patch support period, which lines up directly with SoftWSP's firmware SBOM guidance. Don't treat the 12 elements as ranked— the guide says so explicitly; weight them to your own OT environment's actual risk profile (safety-critical controllers vs. monitoring-only sensors, for instance) rather than working top-to-bottom. Track the EU regulatory footnotes separately from the voluntary guide itself— NIS2, the RED delegated regulation and the CRA are legal obligations with their own deadlines, not something Secure by Demand compliance alone satisfies.
SoftWSP's OT asset and firmware assessments can score an existing or prospective OT deployment against these 12 elements and flag the gaps before a purchase or a renewal: see OT Snapshot.
This guide quotes CISA's own published text of the January 2025 Secure by Demand guide and its April 2025 fact sheet; it is not a substitute for the full documents or procurement/legal advice.
Sources
- CISA, NSA, FBI, EPA, TSA, ASD's ACSC, CCCS, DG CONNECT, BSI, NCSC-NL, NCSC-NZ, NCSC-UK: Secure by Demand — Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products (PDF, 13 January 2025, TLP:CLEAR) — full text: Summary, 12 priority elements, ISA/IEC 62443 and regulatory footnotes, Resources, Disclaimer
- CISA: Secure by Demand — Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products (resource page)
- CISA: Secure by Demand Fact Sheet — Priority Considerations for Operational Technology Owners and Operators When Purchasing Digital Products (PDF, as of April 2025, TLP:CLEAR)
- CISA: Secure by Design (campaign hub, three core principles referenced by the Secure by Demand guide)
Frequently asked questions
What is the CISA Secure by Demand guide, and who published it?
"Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products" is a joint guide published 13 January 2025 by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) with the U.S. National Security Agency, U.S. Federal Bureau of Investigation, U.S. Environmental Protection Agency, U.S. Transportation Security Administration, Australia's ASD Australian Cyber Security Centre, the Canadian Centre for Cyber Security, the European Commission's Directorate-General for Communications Networks, Content and Technology (DG CONNECT), Germany's BSI, the Netherlands' NCSC-NL, New Zealand's NCSC-NZ and the UK's NCSC-UK. It is marked TLP:CLEAR, meaning "disclosure is not limited" and, "subject to standard copyright rules, TLP:CLEAR information may be distributed without restriction" — as a U.S. government work it carries no copyright restriction domestically. Per its own Summary, the guide "describes how OT owners and operators should integrate security into their procurement process when purchasing industrial automation and control systems as well as other OT products," because threat actors "target specific OT products rather than specific organizations" when many of those products "are not designed and developed with Secure by Design principles."
What are the 12 priority security elements OT buyers should look for?
Listed under the guide's own "Considerations for OT Product Selection" heading, with the guide stating explicitly "these elements are not in priority order": (1) Configuration Management — "supports controlling and tracking modifications to configuration settings and engineering logic"; (2) Logging in the Baseline Product — logs "all actions...in the baseline versions using open standard logging formats"; (3) Open Standards — "uses open standards to support secure functions and services"; (4) Ownership — "gives owners and operators full autonomy over said product"; (5) Protection of Data — "protects the integrity and confidentiality of data, services, and functions"; (6) Secure by Default — "delivered secure out of the box," eliminating default passwords and disabling insecure legacy protocols by default; (7) Secure Communications — "authenticated communication with digital certificates deployed that fail loudly"; (8) Secure Controls — "resilient to threat actors sending malicious emergency, safety, or diagnostic commands"; (9) Strong Authentication — role-based access control and "phishing-resistant multifactor authentication"; (10) Threat Modeling — "a full and detailed threat model"; (11) Vulnerability Management — "rigorously tested to help ensure they contain no known exploitable vulnerabilities," with a defined support period and free patches; (12) Upgrade and Patch Tooling — "a well-documented and easy to follow patch and upgrade process."
Does the guide reference IEC 62443 or any EU regulation?
Yes, both. On standards, the guide tells buyers to "look for manufacturers that demonstrate their adoption of Secure by Design and International Society of Automation (ISA) 62443 standards," adding in its own footnote that "the ISA/IEC 62443 multi-part standard is internationally recognized as defining requirements and processes for implementing and maintaining electronically secure OT products, systems, and development lifecycles" — see SoftWSP's [IEC 62443-4-2 component requirements](/guides/iec-62443-4-2-component-requirements/) guide for that standard's own device-level detail. On regulation, the guide notes owners and operators "may need to consider regulatory requirements, such as the European Union's (EU's) NIS2 Directive," and its own footnotes cite the EU's Radio Equipment Directive delegated regulation (applying from 1 August 2025) and the Cyber Resilience Act (in force since 10 December 2024) as examples of regions "laying down security-by-design in law," noting the CRA's CE marking requirement for products with digital elements placed on the EU market.
Is there a shorter companion document, and has Secure by Demand been updated since January 2025?
Yes — in April 2025 CISA published a companion "Secure by Demand Fact Sheet: Priority Considerations for Operational Technology Owners and Operators When Purchasing Digital Products." The fact sheet itself states it "has based this list on the joint guidance" from January 2025 "and is providing it without ranking or priority," reformatting the same 12 elements into a table of "Why This Matters" and "Questions I Should Ask" for each element, aimed at a quicker procurement-conversation reference than the full 22-page guide. This guide found no indication of a further substantive revision to the 12-element list since; confirm against CISA's own Secure by Design resource page before citing a newer version.
In this cluster
