CISA Secure by Design: the principles and the pledge, explained

Secure by Design is CISA's name for two related but distinct things: a joint guidance whitepaper, written with the FBI, NSA and 17 international partner agencies, that sets out three principles for building security into a product before it ships; and a separate, voluntary Secure by Design Pledge that asks manufacturers to commit to seven measurable goals within a year of signing. Neither is a law. Both are increasingly cited by regulators, customers and procurement teams as the baseline description of what "we take security seriously" is supposed to look like in practice.

The joint guidance: three principles, not a checklist

CISA, the FBI and the NSA, joined at launch by cybersecurity authorities from Australia, Canada, the UK, Germany, the Netherlands and New Zealand, first published "Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software" in April 2023. In October 2023, CISA and 17 total partner agencies, adding the Czech Republic, Israel, Singapore, Korea, Norway, Japan's JPCERT/CC and NISC, and the OAS/CICTE CSIRTAmericas Network, released an updated version restating and expanding on three core principles:

#	Principle	What it asks of a manufacturer
1	Take ownership of customer security outcomes	Measure success by security results in customers' environments, not by internal effort or spend alone
2	Embrace radical transparency and accountability	Make security practices and incident history visible, and compete on the ability to do this well, rather than treating it as reputational risk to hide
3	Lead from the top	Make secure-by-design an executive priority with the organisational structure to back it, not an engineering team's unfunded mandate

The guidance deliberately stops at principles: it does not hand manufacturers a technical checklist, leaving the "how" to each company's own architecture and the pledge's more concrete goals below.

The Secure by Design Pledge: seven goals, one-year clock

CISA announced the voluntary pledge on 8 May 2024, with 68 companies, including Microsoft, Google, AWS, Cisco and IBM, signing at launch. As checked for this guide, CISA's pledge page states that over 200 manufacturers have since joined. Each signatory commits to demonstrate measurable progress, within one year of signing, on seven goals:

Goal	What signatories commit to within one year
Multi-factor authentication	Measurably increase MFA use across the manufacturer's products
Default passwords	Measurable progress reducing default passwords; unique per-device credentials rather than shared defaults
Reducing entire vulnerability classes	Measurable reduction in the prevalence of one or more vulnerability classes, for example SQL injection, cross-site scripting or memory-safety bugs
Security patches	Measurably increase the share of customers who install security patches, including via automatic updates
Vulnerability disclosure policy	Publish a VDP authorising public testing, committing not to pursue good-faith researchers, and permitting coordinated public disclosure
CVE record transparency	Include accurate CWE and CPE fields in CVE records, issued in a timely way for critical and high-severity vulnerabilities
Evidence of intrusions	Measurably increase customers' ability to gather evidence of intrusions, through logging, audit trails and intrusion-detection capability

The vulnerability disclosure policy goal overlaps directly with what regulators such as the EU and UK already require of connected-device makers; see vulnerability disclosure policy template and security.txt for a ready-to-use policy and the regulatory detail behind it.

Is signing the pledge the same as being compliant with anything?

No. CISA's own description is that the pledge is voluntary, and it sits outside any binding legal framework. Signing it, or meeting its seven goals, is not, by itself, documented anywhere as satisfying the EU Cyber Resilience Act, UK PSTI, or any other specific legal duty; this guide could not find an official statement making that equivalence, so treat any claim of legal credit for pledge compliance as to be confirmed, not assumed. What it is, in practice, is a public, named commitment that customers, auditors and journalists can hold a manufacturer to, and a reasonably concrete design target for teams that do not yet have one.

How this differs from "secure by design" in IEC 62443-4-1

The phrase "secure by design" also appears as one of the eight practices inside IEC 62443-4-1's secure product development lifecycle for industrial components; see IEC 62443-4-1: the secure product development lifecycle, explained. The two are not the same thing: IEC 62443-4-1 is a paywalled, certifiable process standard scoped to industrial automation and control system suppliers, while CISA's Secure by Design is free, voluntary guidance and a pledge aimed broadly at software and device manufacturers. A company can follow one, both, or neither; neither one substitutes for the other.

A workable starting point

1. Read the three principles before the seven goals. The pledge's goals are concrete, but CISA's own framing is that they flow from ownership, transparency and executive priority; treating the goals as a compliance checklist without the principles behind them misses the point CISA is making.
2. Start with the goal you can evidence fastest. A published vulnerability disclosure policy is usually the quickest of the seven to stand up, and it is already close to a legal duty in several jurisdictions regardless of the pledge.
3. Keep pledge evidence separate from regulatory evidence. Since no confirmed legal equivalence exists, document your CRA, PSTI or other compliance work on its own trail, and treat pledge progress as a complementary, public commitment rather than a substitute filing.
4. Revisit the one-year clock. The pledge's goals are time-bound from the signing date, not evergreen; a signatory should be able to show what changed in that first year, not just restate intent.

SoftWSP builds the SBOM, vulnerability-disclosure process and firmware evidence that back several of the pledge's seven goals, whether or not you have signed it: see device firmware security and PSIRT as a service.

This guide is general information, not legal advice.