[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572982-105":53,"doc-detail-572982-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","enisa-security-by-design-and-default-playbook-version-4-practical-guide","ENISA Security by Design and Default Playbook - Version 4 - Practical Guide","","Modern products with digital elements are increasingly expected to be secure by design and secure by default, but SMEs and small development teams often struggle to apply these concepts consistently. This playbook provides clear, repeatable principles and concrete guidance across a product lifecycle, translating security-by-design into actionable engineering, product, and release practices. It organizes principles into architectural foundations and operational integrity and includes practical playbooks plus machine-readable security attestation concepts.",{"@graph":63,"@context":122},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/enisa-security-by-design-and-default-playbook-version-4-practical-guide/572982/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/enisa-security-by-design-and-default-playbook-version-4-practical-guide/572982.png","ImageObject",442,249,{"name":88,"@type":89},"BigDaveOnline","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-19","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":76},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114,118],{"name":105,"@type":106,"acceptedAnswer":107},"What is the purpose of ENISA’s Security by Design and Default Playbook for SMEs?","Question",{"text":108,"@type":109},"It provides principles and tangible, repeatable guidance for applying security by design and secure by default across a product lifecycle, with actionable steps suited to engineering, product, and release processes.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How does the playbook structure its security-by-design principles?",{"text":113,"@type":109},"It organizes security by design principles into two groups: Architectural Foundations and Operational Integrity, covering how systems are designed and built, as well as how they are managed and maintained.",{"name":115,"@type":106,"acceptedAnswer":116},"What playbooks are included and what topics do they cover?",{"text":117,"@type":109},"The document includes playbooks on subjects such as threat modelling and trust boundaries, least privilege, identity and authentication architecture, attack surface minimisation, defence in depth, secure coding practices, and multiple lifecycle and operational controls.",{"name":119,"@type":106,"acceptedAnswer":120},"What does “machine-readable security attestation” refer to in this document?",{"text":121,"@type":109},"It focuses on demonstrability and verifiability of security, including incentives, existing frameworks and initiatives, and an example Machine-Readable Security Manifest (MSRM).","https://schema.org",{"og:url":78,"og:type":124,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":126,"canonical":78},"index,follow",{"doc_id":128,"site_id":56},572982,1792360078,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":88,"user_avatar":133,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":76,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":139,"language":140,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":61,"update_tm":144,"read_time":145},962090896214,"https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d","TLP-CLEAR  \nENISA Security by Design and Default Playbook  \nA Practical Guide to Security by Design and Default for SMEs  \nMARCH 2026  \nDocument History  \n//DRAFT ONLY-DELETE THIS SECTION AND PAGE UPON FINAL PUBLICATION  \n\n| Date | Version | Modification | Author |\n| --- | --- | --- | --- |\n| 19/03/2026 | 0.4 | Version for public consultation | ENISA |\n\n2  \nAbout ENISA  \nThe European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the  \nAgency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: [www.enisa.europa.eu](www.enisa.europa.eu).  \nCONTACT  \nFor contacting the authors, please use product_security@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.  \nLEGAL NOTICE  \nThis publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the Regulation (EU) No 2019/881 .  \nENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.  \nThird-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication.  \nCOPYRIGHT NOTICE  \n© European Union Agency for Cybersecurity (ENISA), 2026  \nGenerative AI was used in a limited capacity to support language refinement and preliminary document screening. All outputs were reviewed and validated by subject-matter experts. No AIgenerated content was used without substantive human oversight.  \nThis publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is  \nauthorised under the Creative Commons Attribution 4.0 International (CC BY 4 .0) licence ([https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that](https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that)[ ](https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that)[appropriate credit is given and any changes are indicated](appropriate credit is given and any changes are indicated)”.  \n3  \nTable of Contents  \nDocument History 2  \nAbout ENISA 3  \nExecutive Summary 6  \n1. Introduction 8  \n1.1 Objectives 8  \n1.2 Scope and methodology 8  \n1.3 Target audience 9  \n1.4 Report structure 9  \n2. Secure by Design and Default across a Product’s Lifecycle 12  \n2.1 Product Lifecycle 12  \n2.2 Risk Management Activities 15  \n2.3 Threat modelling 16  \n3. Secure by design and default principles 21  \n3.1 Security by Design Principles 21  \n3.2 Secure by Default Principles 24  \n4. Playbooks 28  \n4.1 Trust boundaries and threat modelling 29  \n4.2 Least Privilege 30  \n4.3 Strong identity and auth architecture 31  \n4.4 Attack surface minimisation 32  \n4.5 Defence in depth 33  \n4.6 Open Design 34  \n4.7 Lifecycle manage","cbCaicdSHlbQcCcJ","https://ap.wps.com/l/cbCaicdSHlbQcCcJ","pdf",2435457,73,"English","# Executive Summary\n# 1. Introduction\n## 1.1 Objectives\n## 1.2 Scope and methodology\n## 1.3 Target audience\n## 1.4 Report structure\n# 2. Secure by Design and Default across a Product’s Lifecycle\n## 2.1 Product Lifecycle\n## 2.2 Risk Management Activities\n## 2.3 Threat modelling\n# 3. Secure by design and default principles\n## 3.1 Security by Design Principles\n## 3.2 Secure by Default Principles\n# 4. Playbooks\n## 4.1 Trust boundaries and threat modelling\n## 4.2 Least Privilege\n## 4.3 Strong identity and auth architecture\n## 4.4 Attack surface minimisation\n## 4.5 Defence in depth\n## 4.6 Open Design\n## 4.7 Lifecycle management\n## 4.8 User centric design\n## 4.9 Secure coding practices\n## 4.10 Logging, monitoring, and alerting\n## 4.11 Configuration and change management\n## 4.12 Incident response and recovery\n## 4.13 Vulnerability and patch management\n## 4.14 Supply chain controls\n## 4.15 Minimisation of Default Services\n## 4.16 Restrictive Initial Access\n## 4.17 Secure Communication by Default\n## 4.18 Unique Device Identity and Secrets by Default\n## 4.19 Mandatory Security Onboarding\n## 4.20 Automated Maintenance and Updates\n## 4.21 Transparent Security Posture\n## 4.22 Secure Recovery and Ownership Lifecycle\n# 5. Machine Readable Security Attestation\n## 5.1 Demonstrability and verifiability\n## 5.2 Incentives\n## 5.3 Existing Frameworks and Initiatives\n## 5.4 Machine-Readable Security Manifest (MSRM) Example\n# 6. Bibliography / References\n# A Annex: Abbreviations\n# B Annex: CRA Essential Requirements\n# C Annex: Mapping Security Principles to CRA Annex I Essential Requirements","[{\"question\":\"What is the purpose of ENISA’s Security by Design and Default Playbook for SMEs?\",\"answer\":\"It provides principles and tangible, repeatable guidance for applying security by design and secure by default across a product lifecycle, with actionable steps suited to engineering, product, and release processes.\"},{\"question\":\"How does the playbook structure its security-by-design principles?\",\"answer\":\"It organizes security by design principles into two groups: Architectural Foundations and Operational Integrity, covering how systems are designed and built, as well as how they are managed and maintained.\"},{\"question\":\"What playbooks are included and what topics do they cover?\",\"answer\":\"The document includes playbooks on subjects such as threat modelling and trust boundaries, least privilege, identity and authentication architecture, attack surface minimisation, defence in depth, secure coding practices, and multiple lifecycle and operational controls.\"},{\"question\":\"What does “machine-readable security attestation” refer to in this document?\",\"answer\":\"It focuses on demonstrability and verifiability of security, including incentives, existing frameworks and initiatives, and an example Machine-Readable Security Manifest (MSRM).\"}]","ENISA Security by Design and Default Playbook - Version 4 - Practical Guide | PDF",1791930363,26]