Secure by Design for Connected Products

A product review should identify the users, operating environment, sensitive functions and foreseeable misuse. Secure design questions belong in requirements and architecture work, not only in a final penetration test. For connected equipment, include service interfaces, update channels and dependencies that can affect the product after delivery.

CISA guidance asks manufacturers to take ownership of customer security outcomes and to make products secure by design and default. Review which protective features operate when the product is first used and which rely on optional customer action. A technically available control may provide limited protection if its deployment is obscure or unnecessarily difficult.

Security tradeoffs involve product priorities, support commitments and allocation of engineering effort. NCQM practice consideration: record who accepts residual security risk and on what evidence. Connect unresolved findings to release decisions. A product team should be able to explain the decision without relying solely on the fact that a scheduled launch date was reached.

A usable vulnerability reporting channel, triage process and correction route support the product throughout its supported life. Determine how users learn about material issues and how updates reach affected versions. Test the update mechanism as a product function. A promise to publish fixes has limited value if users cannot reliably obtain or install them.

NCQM practice consideration: ask suppliers for evidence tied to the delivered version and its support arrangements. Treat a pledge, self-description or marketing badge as a statement to examine, rather than proof of technical performance. Separate commitments from completed engineering work and distinguish an independent assessment from a manufacturer’s own account.

Secure by Design publications do not replace applicable privacy, sector security, radio, electrical or product safety requirements. Some procurement arrangements may adopt particular security conditions separately. Record those obligations in the requirement register. Refer to CISA’s current publications for the guidance and avoid describing NCQM or a vendor as government approved through use of these principles.