Secure by Design is not a single tool, product, or one‑time activity. It is a holistic approach that requires security to be deliberately embedded from the very beginning, at the point where systems, software, and services are conceived and designed. Rather than reacting to vulnerabilities after deployment, Secure by Design emphasizes anticipating risk early and addressing it through intentional design decisions, clearly defined security requirements, and accountability across the entire lifecycle.
Secure by Design: A Guide to Assessing Software Security Practices, created by CIS and SAFECode, expands on this concept and provides a practical, measurable way for organizations to strengthen software security from development through deployment.
Turning Secure by Design into Action
CIS and SAFECode work together to help developers and end users move from intent to execution by combining deep industry expertise with practical, implementation‑ready guidance for building security in from the start. CIS provides trusted, widely adopted security baselines, translates standards into practices that teams can apply consistently, and supports shared defense across organizations and ecosystems. SAFECode strengthens this work by bringing leading software security expertise and proven development practices that help organizations put Secure by Design into practice at scale.
Why is Secure by Design Important?
Secure by Design isn’t something you add later or manage in isolation. It’s a deliberate approach to building, operating, and defending systems, starting with secure foundations and reinforcing them consistently over time using tools like CIS Critical Security Controls® (CIS Controls®), CIS Benchmarks®, CIS Hardened Images®, and CIS SecureSuite®.
Whether you’re building commercial software or supporting public missions, Secure by Design helps reduce risk earlier, simplify security operations, and create systems that are resilient by design, not by reaction.
Security at Every Stage of Software Development
Secure by Design (SbD) refers to an approach to software security in which security is intentionally embedded throughout the entire software lifecycle. Vulnerabilities are prevented before release, security is a core engineering and business requirement, and responsibility for secure outcomes rests with the software producer rather than the customer.
Who Should Use Secure by Design Guidance?
- Technology and Product Vendors: Guidance on what to implement, how to show secure practices, what to ask, and how to evaluate software security.
-
Government: Empowers agencies to confidentially procure and deploy software that is secure from the start and built to protect sensitive public data.