CyberForte
0/32 guides done, see your progress

Home Secure by Design and Default Playbook 19

Playbook 19 of 22 · Secure by Default · Guided Protection

Mandatory security onboarding

The product will not go to work until the safety steps are done.

Guided ProtectionSecure by Default
CyberForte's summary · not ENISA text

In plain words

Optional security set-up tends to be skipped. This playbook makes the essentials non-negotiable: the product does not enter normal operation until key steps, such as creating a proper admin account or setting up encryption, are complete.

Make that set-up guided and easy, so no expert knowledge is needed. And if someone later resets or removes a critical setting, bring the onboarding back until it is fixed.

Picture this: A new router that will not connect to the internet until you have set your own admin password is mandatory onboarding in action.

Your turn

Practical checklist

A short, practical version for small teams, written by CyberForte from the ENISA playbook. The full ENISA checklist, evidence list and release gate are in the original text below. Your ticks are saved only in this browser.

Original text · unchanged

The full ENISA playbook

Source: ENISA Secure by Design and Default Playbooks, 19-mandatory-security-onboarding.md, European Union Agency for Cybersecurity (ENISA), licensed under CC BY 4.0. Reproduced word for word; only converted from Markdown to this page.

Mandatory security onboarding

Principle

(secure by default)

Require critical security controls to be configured during initial set-up. Do not allow products to enter an operational state until essential security steps are completed.

Objective

Ensure that systems start in a secure state by preventing or limiting use before baseline security controls, such as strong authentication or encryption, are configured.

Checklist

Identify mandatory security steps

  • Define the minimum security controls required before the product can be used (e.g. MFA, encryption keys, admin account set-up).

Enforce security set-up during first use

  • Integrate mandatory security steps into the initial set-up or onboarding flow.
  • Do not allow users to skip or defer required security configuration.

Block operation until onboarding is complete

  • Prevent normal operation, privileged actions and external connectivity until mandatory security steps are completed.

Provide clear, guided configuration

  • Guide users through security set-up with clear instructions and sensible defaults.
  • Avoid requiring expert knowledge to complete onboarding securely.

Re-trigger onboarding when security is incomplete

  • Re-enforce onboarding if critical security settings are removed, reset or left unconfigured.

Minimum evidence

  • Mandatory security steps defined: documentation identifies which security controls must be completed during onboarding.
  • Onboarding enforces a security set-up: configuration, screenshots or test evidence shows that critical security steps cannot be skipped.
  • Operation blocked pre-onboarding: configuration, screenshots or test evidence shows that the product cannot enter normal operation before onboarding is complete.
  • Guided set-up is provided: screenshots, configuration flows or documentation shows that clear user guidance is provided on security set-up.
  • Onboarding is re-enforced on incomplete security configuration: configuration, screenshots or test evidence shows that onboarding is re-triggered if required security settings are missing.

Release gate

  • [ ] Mandatory security steps are defined and enforced during initial set-up
  • [ ] Users cannot bypass or skip critical security configuration
  • [ ] Product cannot enter normal operation before onboarding completion
  • [ ] Security onboarding provides clear guidance and secure defaults
  • [ ] Onboarding is re-enforced if critical security settings are removed
↑ ↓ to moveEnter to openEsc to close