Secure by design and secure by default
The two terms sum up what Annex I, Part I requires of every product: security is built into the design rather than bolted on later, and the product is configured securely out of the box.
Secure by design means that security is planned into the design and development of a product from the outset. Secure by default means that the product is secure in its delivered configuration, without the user having to change anything first.
Definition in the Regulation
The terms come from industry practice; Regulation (EU) 2024/2847 describes the substance in Annex I, Part I. Under Article 13(1), a product must be designed, developed and produced in accordance with these requirements when it is placed on the market. Annex I, Part I, point (1) requires an appropriate level of cybersecurity based on the risks. Point (2) lists the properties to be implemented on the basis of the risk assessment, where applicable. These include delivery without known exploitable vulnerabilities (point (2)(a)), a secure by default configuration with the possibility to reset the product to its original state (point (2)(b)) and the ability to address vulnerabilities through updates (point (2)(c)). They also include protection from unauthorised access (point (2)(d)), confidentiality and integrity of data (points (2)(e) and (f)) and data minimisation, availability, a minimal attack surface, logging and secure data removal (points (2)(g) to (m)).
What it means for manufacturers
Secure by default is where many industrial products fail today: default passwords, open services and debug interfaces in the delivered state. The Regulation allows a different configuration only for tailor-made products where this has been agreed with the business user (Annex I, Part I, point (2)(b)). For development, secure by design means that the risk assessment under Article 13(2) comes before the design and explains which requirements are implemented and how. Anything that does not apply must be justified in the technical documentation, not quietly left out (Article 13(4)). Harmonised standards that spell out the requirements are not yet listed in the Official Journal; for now, BSI TR-03183-1 and IEC 62443 serve as guidance, without a presumption of conformity. The requirements apply from 11 December 2027.
Free templatesCRA Reporting KitReporting playbook, awareness record, notification templates for the ENISA platform, call chain and deadline calculator. Six Word templates, two Excel workbooks and a handbook, free by e-mail.Request the kitRelated terms
- Annex I (essential cybersecurity requirements)
- Cybersecurity risk assessment
- Security update
- IEC 62443