How Secure by Design Helps Developers Build Secure Software

This document presents CIS and SAFECode’s guide, “Secure by Design: A Guide to Assessing Software Security Practices,” aligning with CISA’s Secure by Design initiative and frameworks such as NIST SSDF, CIS Controls, and SAFECode’s DGs. It provides practical, maturity-based guidance for integrating security throughout the software lifecycle across six areas: secure design, development, secure default configuration, supply chain security, code integrity, and vulnerability remediation. The guide prioritizes threat modeling, secure defaults, disciplined use of third-party components, protection of build and tooling environments, and structured vulnerability intake and root cause analysis, with attention to real-world development contexts and AI/ML implications.