Frequently Asked Questions

This site is for:

• Software manufacturers looking to improve their security practices (see Q-02)
• Developers and product managers building and maintaining software (see Q-07, Q-08)
• Executives and chief information security officers (CISOs) making investment decisions
• Board members overseeing software and cybersecurity risk (see Q-03)
• Security researchers and product security incident response teams (PSIRTs) identifying systemic issues
• Policy makers and regulators shaping the future of software safety (see Q-05)
• Procurers and acquirers evaluating the security posture of products (see Q-04)
• Investors and analysts assessing the security risk of the companies they fund or cover (see Q-06)
• Journalists and educators explaining cybersecurity to the public (see Q-01)

No matter your role, if you care about making software safer for everyone, you're in the right place.

CISA's Secure by Design whitepaper lists three core principles.

1. Take ownership of customer security outcomes (see P-01)

   Manufacturers, not customers, should bear the responsibility for preventing exploitation.

2. Embrace radical transparency and accountability (see P-02)

   Share root cause information, metrics, and architectural decisions that affect security.

3. Lead from the top (see P-03)

   Executive commitment and incentives should align with long-term security improvements, not short-term feature velocity.

Note that these principles are not about the technology, but about the factors that will lead to customer safety.