Demand Security When You Buy Software: Five Owner Questions from CISA’s Secure by Demand Guide

Vendors ship what customers ask for. CISA’s buyer guide shows how any SMB — not only federal agencies — can ask for product security before the next breach becomes your problem.

Most software diligence still looks like this: price, features, a SOC report about the vendor’s own offices, and a handshake. That packet tells you little about whether the product was built so attackers cannot walk in through default passwords, missing logs, or silent third-party libraries.

CISA’s Secure by Demand Guide is the customer counterpart to its Secure by Design work for manufacturers. It tells buyers — including small and mid-size firms — how to put product security into procurement before, during, and after the contract. The manufacturer principles it mirrors are simple: take ownership of customer security outcomes; embrace radical transparency and accountability; and build leadership that actually funds those goals.

I work with Hudson Valley and regional owners who feel outgunned in vendor calls. You do not need a federal acquisition shop. You need five questions and the discipline to write down the answers.

1. Will you give us secure authentication without a premium SKU?

Ask whether standards-based single sign-on (SSO) and multi-factor authentication (MFA) — preferably phishing-resistant options like passkeys — are available in the baseline product at no extra charge, and whether default passwords have been eliminated. CISA flags default passwords as an ongoing enabler of real attacks.

2. Do we get security logs we can actually use?

For cloud and SaaS, CISA asks manufacturers to retain and make available security logs for at least six months at no additional charge, covering configuration changes, identity/token events, and business-data access. If logging is an expensive add-on, that is a product-security signal — not a “nice to have.”

3. Will you share an ingredients list?

Ask for a machine-readable Software Bill of Materials (SBOM) covering third-party and open-source components, aligned with CISA’s 2026 Minimum Elements. Without it, the next library CVE becomes a scavenger hunt.

4. How transparent are you when something breaks?

Look for a public vulnerability disclosure policy, timely and accurate CVE records (with correct CWE/CPE fields), and whether the manufacturer has taken CISA’s Secure by Design Pledge with published progress. Enterprise security theater is not the same as product honesty.

5. What is our one-sentence ask to the MSP?

“Before we renew or buy [product], please get written answers on SSO/MFA defaults, six-month security log access, SBOM availability, and the vendor’s vulnerability disclosure / Secure by Design Pledge status — and put the replies in our vendor folder with today’s date.”

Why This Is an Owner Job, Not Just an IT Ticket

• Feature roadmaps bend toward whatever buyers demand in writing.
• Insurers and large customers increasingly ask how you select vendors — not only how you patch laptops.
• MSPs execute; owners set the bar. If “security add-on” is acceptable forever, it stays an add-on.

What “Good Enough” Looks Like This Month

• Top five software renewals listed with owners and dates.
• Secure-by-Demand question sheet attached to each renewal packet.
• Dated vendor replies (or explicit “declined / roadmap”) filed.
• No silent acceptance of “logging costs extra” without a compensating control note.

This is stewardship. You are not asking vendors to be perfect. You are refusing to buy blindness as a default feature.

If you want these five questions turned into a one-page owner procurement packet your MSP can run — Security Medic / CyberIntelPro can help. Calmly, with evidence, not theater.

References

1. CISA, Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem: cisa.gov/…/secure-demand-guide
2. CISA, 2026 Minimum Elements for a Software Bill of Materials (SBOM) (Jul 29, 2026): cisa.gov/…/2026-minimum-elements-software-bill-materials-sbom