CISA cybersecurity performance goals: 7 action items to boost your AppSec

CISA’s Secure by Design IT Sector-Specific Goals outline prioritized AppSec and product security practices for vendors and IT teams, including phishing-resistant MFA with user prompts, hardening and segmenting development environments, removing hardcoded secrets via secrets management, providing SBOMs, reducing flaws pre-release through automated scanning and memory-safe languages, publishing robust vulnerability disclosure policies with CWE/CPE detail, and establishing formal software supply chain risk management integrated into the SDLC. The guidance also aligns with ESF recommendations for binary analysis and reproducible builds, emphasizing transparency and proactive risk reduction across the software lifecycle.