Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The practical answer is to turn secure-by-design expectations into enforceable purchasing conditions. In Gary Barlet’s November 12, 2024 Dark Reading commentary, the Illumio public-sector chief technology officer argues that CISA’s Secure by Design goals should become mandatory and subject to audits, rather than relying mainly on voluntary promises and vendor self-reporting. That is Barlet’s policy prescription—not an enacted CISA rule.
What “power of the purse” means in cybersecurity
“Power of the purse” is procurement leverage. Government agencies can require security evidence in contracts, grants and renewals, giving software manufacturers a financial reason to change how products are designed, built and maintained.
Lawfare’s annotated review describes the intended spillover: a supplier that adopts common secure-development practices to qualify for public work may carry those practices into products sold to commercial customers. Procurement can create a strong incentive, but it cannot by itself guarantee that every product is secure or that every vulnerability will be prevented.
What CISA’s Secure by Design pledge actually requires
CISA’s May 2024 Secure by Design pledge is voluntary and not legally binding. Signatories make a good-faith effort to work toward seven goals during the following year. Manufacturers are asked to publicly document measurable progress; when progress is difficult to measure, they are encouraged to explain their approach, efforts and challenges to CISA and in public documentation.
#1 Best Overall
- ENTERPRISE ROLLOUT: 25 White PVC cards in one SKU sized for bulk procurement, one card per employee for both web authentication and building access
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP Level 1 for phishing-resistant login and passwordless sign-in where the service supports it
- BUILDING ACCESS: MIFARE DESFire EV2 applet with 4K AES storage adds door and facility access to the same card employees use for account security
- CERTIFIED SECURE ELEMENT: NXP JCOP 4 chip rated Common Criteria EAL 6+ augmented
- DUAL INTERFACE: Tap over NFC (ISO 14443) or use a contact reader (ISO 7816), backed by a 2-year warranty from Swiss company Cryptnox
The pledge is aimed at enterprise software products and services, including on-premises software and cloud services. Its document says physical IoT devices and consumer products are outside the pledge’s scope.
The seven goals described by Barlet
- Increase use of multifactor authentication.
- Reduce the use of default passwords.
- Achieve a measurable reduction in at least one vulnerability class.
- Increase customer installation of security patches.
- Publish a vulnerability-disclosure policy.
- Demonstrate transparency in vulnerability reporting.
- Increase customers’ ability to gather evidence of cybersecurity intrusions.
These goals combine product outcomes, customer capabilities and disclosure practices. They are not a certification that a product is secure.
Barlet’s proposal: mandatory goals and independent audits
Barlet’s criticism is that a voluntary pledge leaves too much discretion with the manufacturer: participation is optional, evidence is often self-produced, and consequences for falling short are unclear. His proposed change has two parts:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Make the recommended goals contractually mandatory
Agencies would write the relevant goals into solicitations, contracts, grants and renewal terms. A bid could require, for example, a documented vulnerability-disclosure process, evidence of patch adoption by customers, or a measurable reduction in a specified vulnerability class.
Rank #2
- 👉 [ STEALTHY ] Keeps your tokens and badge holder from clacking together.
- 👉 [ SHATTERPROOF ] Flexible, so it won't shatter or crack.
- 👉 [ EASY BADGE SWAP ] Taking badges out or sliding back in is a snap.
- 👉 [ LIGHTWEIGHT ] Only 14 to 16 grams depending on the model.
- 👉 [ 1, 2, 3, or 4 BADGES ] Holds up to 4 standard credit card sized badges (3-3/8" x 2-1/8").
Audit compliance rather than accept assertions
Manufacturers would need to provide evidence that an independent auditor—or an authorized government assessor—could examine. Audits could test whether stated controls exist, whether metrics are reproducible and whether remedial actions were completed. The exact auditor qualifications, sampling rules, reporting deadlines and remedies would need to be defined in the procurement regime; Barlet’s commentary does not establish those details.
Voluntary pledge versus enforceable procurement requirement
| Question | Voluntary pledge | Enforceable procurement condition |
|---|---|---|
| What is expected? | A good-faith effort toward CISA’s seven goals. | Specified controls, outcomes or evidence written into a contract or grant. |
| Who is covered? | Enterprise-software manufacturers that choose to participate; physical IoT and consumer products are outside the pledge’s stated scope. | Suppliers seeking the government business covered by the particular solicitation or funding program. |
| What evidence is produced? | Public progress documentation, or an explanation of approach and challenges where progress is not measurable. | Contract-defined records, metrics and test results available for review. |
| Who checks it? | Primarily the participating manufacturer and public readers. | An independent auditor or government-appointed assessor, if the contract requires one. |
| What happens after a shortfall? | The pledge itself is voluntary and non-legally binding, so its text does not create a universal penalty. | Possible contractual remedies, such as corrective-action plans or loss of eligibility, would depend on the applicable terms. |
This comparison describes policy mechanics, not a demonstrated performance ranking. A mandatory rule can improve accountability while still being poorly designed, underfunded or difficult to verify.
How procurement requirements could be designed
1. Define the covered product and supplier
State whether the requirement applies to enterprise software, cloud services, on-premises products, managed services, subcontractors or updates supplied after delivery. CISA’s pledge scope should not be silently expanded to physical devices or consumer products.
2. Separate outcomes from process evidence
Require both results and the practices used to produce them. Outcome measures might include patch-installation rates or a reduction in a named vulnerability class. Process evidence might include secure-development records, ownership of security decisions and a tested vulnerability-response procedure.
Rank #3
- I want you to be nice... until it's time to not be nice.
- Vibrant colors
- Each button/badge is 2.25 Inch in diameter. (About the size of a soda can)
- 5 Buttons in each package
- High Quality Pinback Buttons
3. Set evidence and audit rules before award
Specify acceptable evidence, retention periods, sampling, auditor independence, confidentiality protections and the timetable for reporting findings. Without these details, “auditable” can become another self-attestation exercise.
4. Provide correction paths and meaningful consequences
Contracts should distinguish a remediable finding from a material breach, set deadlines for corrective action and identify consequences for missing them. Requirements should be proportionate so smaller suppliers are not excluded solely by paperwork that does not improve security.
5. Reassess requirements as threats and technology change
Security goals should be reviewed at renewal or on a defined schedule. A fixed checklist can become obsolete, while a measurable objective—such as faster patch adoption—can remain useful if its measurement method is updated.
Secure by design is a development-process responsibility
CISA’s broader secure-by-design principles, as summarized by Lawfare, put responsibility on the producer rather than placing the entire burden on customers. They emphasize ownership of security outcomes, radical transparency and accountability, and leadership and organizational structures that prioritize security.
Rank #4
- ID Badge Clip Blanks Convention Meeting Security 20mm Disc Pack of 10
- High quality, jewelry findings and hardware for all your crafting needs
- Color: Silver Tone
- Quantity per pack: 10 pieces
NIST’s Secure Software Development Framework (SSDF) provides process context without certifying a product. Its four practice groups are:
- Prepare the organization: establish roles, training, policies and risk-management practices.
- Protect the software: secure source code, build systems, dependencies and release infrastructure.
- Produce well-secured software: use threat modeling, code review, testing and secure configuration throughout development.
- Respond to vulnerabilities: receive reports, analyze and remediate flaws, issue fixes and communicate with affected customers.
A framework checklist is useful evidence of a disciplined process, but it is not proof that a particular release contains no exploitable defect.
What changed after the pledge?
On January 17, 2025, CISA and the FBI issued product-security bad-practices guidance and described it as voluntary while strongly encouraging software manufacturers to follow it. That guidance is distinct from Barlet’s proposal for mandatory goals and audits. The materials summarized here do not establish whether later laws, regulations or sector-specific rules changed the position for every industry or jurisdiction, so compliance teams must check the requirements that apply to their own contracts.
How agencies and buyers can evaluate a supplier
- Ask which of the seven goals the supplier measures and obtain the measurement method, baseline and reporting period.
- Request the vulnerability-disclosure policy and escalation contacts before purchase.
- Examine how customers receive, install and verify security patches.
- Check whether multifactor authentication is available and whether insecure default passwords are eliminated or forced to change.
- Require evidence that customers can collect intrusion-related logs or other forensic data.
- Confirm who owns security decisions, how leadership reviews risk and how vulnerabilities are handled after release.
- Agree on audit access, confidentiality, remediation deadlines and contract remedies in advance.
Limits and trade-offs of the “power of the purse”
It reaches vendors that depend on public business
Procurement conditions have the strongest effect on suppliers that need government contracts or grants. A vendor with little public-sector exposure may have less incentive to change, so procurement is not the same as economy-wide regulation.
Best Value
- DUAL-APPLICATION CARD: Combines FIDO2 hardware two-factor authentication and MIFARE DESFire EV2 (4K, AES) physical access on one Swiss-engineered NFC smart card
- CUSTOMIZABLE WHITE PVC: Blank printable face ready for in-house printing of employee photos, names, and company logos to double as a branded ID badge
- FIDO ALLIANCE CERTIFIED: Meets FIDO2 v2.1 and CTAP Level 1 for phishing-resistant MFA and passwordless sign-in where the service supports it
- CERTIFIED SECURE ELEMENT: A Common Criteria EAL6+ secure element generates and stores private keys as non-exportable keys on a tamper-resistant chip
- CONTACTLESS ONLY: Works over NFC (ISO 14443) with no contact chip, no batteries and no charging required, backed by a 2 year warranty
Compliance can become paperwork
More attestations do not necessarily mean safer software. Requirements should favor reproducible evidence, technical testing and outcomes over documents that merely describe intent.
Audits have cost and scope limits
An audit samples processes and evidence; it cannot inspect every line of code or predict every future attack. Agencies must balance assurance, supplier burden, confidentiality and the risk that sensitive audit material could itself be exposed.
Security goals can conflict with speed or access
Stronger release gates, logging and patch requirements may raise costs or delay deployment. Contracts should prioritize high-impact risks and provide realistic remediation windows rather than encouraging vendors to hide problems.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBottom line for the policy question
Should CISA make its Secure by Design goals mandatory? Barlet argues yes, using government purchasing power and independent audits to replace an honor-system model. The current pledge remains voluntary and non-legally binding, and the January 2025 CISA-FBI guidance described here is also voluntary. Turning the goals into effective policy would require clear scope, measurable outcomes, credible audits and proportionate contract remedies—not simply a new declaration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
