How Government Agencies Can Strengthen Software Security with Secure by Design

Summary

CIS and SAFECode describe how government agencies can use Secure by Design practices to assess vendor software, build security into development, address legacy risks, and support zero-trust and resilient services.

Key points

• The article recommends building security into software from the start rather than relying on reactive patching and incident response.
• Agencies are advised to assess vendors’ development, testing, and vulnerability-management practices instead of relying solely on product features or self-attestation.
• For internally developed or customized software, the guide supports integrating security throughout planning, design, coding, testing, and deployment.
• Secure by Design can help agencies identify inherited risks during legacy modernization and establish stronger software foundations for zero-trust architectures.
• The approach is presented as a way to improve audit readiness, procurement confidence, operational resilience, and use of limited security resources.
• CIS and SAFECode developed a guide that incorporates frameworks, maturity models, role-based guidance, and artifact-driven verification.

Industries