ENISA Secure by Design and Default Playbooks

A practical collection of 22 Secure by Design and Secure by Default playbooks for SMEs, based on the ENISA Secure by Design and Default Playbook: A Practical Guide to Secure by Design and Default for SMEs.

About

Secure by Design represents a fundamental shift in product security, embedding protective measures from conception rather than retrofitting them post-development. Secure by Default ensures products ship with the most secure configuration reasonably possible, reducing reliance on user expertise and limiting the potential for misconfiguration.

This repository provides a list of playbooks that aims to bridge the gap between aspirational security principles and practical implementation within SME constraints. It provides structured, easy-to-follow checklists that development teams can apply during design, build, deployment, maintenance, and decommissioning.

The guidance is intended as a practical starting point rather than an exhaustive or prescriptive implementation framework. Its application should be adapted to the product’s intended use, context and associated risks, as well as applicable requirements. It does not provide legal guidance.

Playbook structure

Each playbook contains:

• Principle
• Objective
• Checklist
• Minimum evidence
• Release gate

Playbooks

Secure by Design

Secure by Design embeds protective measures into products during development, rather than adding them retrospectively.

• Architectural Foundations — structural design choices that make a product inherently difficult to compromise or exploit.
• Operational Integrity — human and procedural practices that maintain product security throughout development, deployment, operation, and retirement.