Removed: the option of treating security as something to add after launch. The guidance makes it a prerequisite.
Outcome: a published position, signed by ten national agencies, that manufacturers should not ship features first and secure them later.
The April 2023 joint guidance on security-by-design and -default, co-signed by CISA, NSA, the FBI, the UK NCSC and six more national cyber agencies, tells manufacturers to “prioritize the integration of product security as a critical prerequisite to features and speed to market.”
Security before features, and not from a consultancy — from the agencies that spend their year dealing with the consequences. When an industry’s own regulators phrase it that way, “we will secure it later” stops being a schedule and starts being a design flaw.
Source: CISA, Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Security-by-Design and -Default (13 April 2023)