Secure by Demand: Key takeaways for enterprise software buyers

This week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) took a major step forward as it continues to define federal software supply chain security policy. “Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem” serves as the official counterpart to the CISA’s landmark Secure by Design guidance (PDF), released in April 2023.

Secure by Design was one of the first federal initiatives aiming to shift the burden of software supply chain attacks away from the end user and onto those who create, ship, and maintain software products. Subsequently, CISA’s release of the Secure by Design Pledge just a few months ago further encouraged software producers to take steps to ensure they are following secure software development and maintaining practices.

But what was missing from Secure by Design’s message was a key piece of software supply chain security: the enterprise buyer. Commercial software risk remains one of the most under-addressed cybersecurity risks facing enterprises today. That's why security and risk leaders are inclined to check the security measures of the software products their enterprises are consuming. Secure by Demand embodies this sentiment.

Here are the key components of Secure by Demand, why they matter for enterprise buyers and software producers alike — and how enterprises can go beyond what CISA outlines.

Get White Paper: Assess & Manage Commercial Software RiskPlus: See the Webinar

How to hold software producers accountable

Secure by Demand aims to empower enterprise buyers with a set of checks that can be demanded of a software producer before, during, and after procurement. These checks speak not only to enterprise security, but also to product security, which CISA believes has been more of an afterthought when it comes to procurement compliance: