Today, CISA and the FBI jointly published “Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem.” The guide is designed to help organizations drive a secure technology ecosystem by ensuring their software manufacturers prioritize secure technology from the start.
The acquisition personnel of an organization generally possess a foundational understanding of the fundamental cybersecurity requirements associated with a specific technology acquisition. However, they frequently don’t assess whether a supplier has implemented practices and policies that ensure security is regarded as a core consideration from the early phases of the product development lifecycle.
This guide is intended to assist organizations by presenting a series of questions to consider when acquiring software, recommending considerations for integrating product security throughout various stages of the procurement process, and providing resources to evaluate the security maturity of a product in accordance with secure by design principles.
The Secure by Demand Guide is a counterpart to CISA’s Secure by Design guidance for technology manufacturers, which lays out three secure by design principles:
- Take ownership of customer security outcomes,
- Embrace radical transparency and accountability, and
- Build organizational structure and leadership to achieve these goals.
Organizations can integrate product security considerations into various stages of the procurement lifecycle:
- Before procurement, by posing questions to understand each candidate software manufacturer’s approach to product security.
- During procurement, by integrating product security requirements into contract language, as appropriate.
- Following procurement, by continually assessing software manufacturers’ product security and security outcomes.
This guide compliments the “Software Acquisition Guide for Government Enterprise Consumers: Software Assurance in the Cyber-Supply Chain Risk Management (C-SCRM) Lifecycle” that was recently published. CISA encourages organizations to review both the Secure by Demand Guide and Software Acquisition Guide and implement recommended actions. Access the full guide at CISA.
