---
title: Index of Secure by Design Principles
description: Index of Secure by Design principle identifiers, categories, source mappings, and cross-references
---

# Index of Secure by Design Principles

This document provides the index for the Secure by Design principles.
Each entry synthesizes related guidance from the UK Government Secure by Design Principles and the
Australian ASD/ACSC Secure by Design Foundations into a unified principle area.

## Principle catalog

| ID     | Title                      | Category               | UK Principle                                      | AU Foundation                                       |
|--------|----------------------------|------------------------|---------------------------------------------------|-----------------------------------------------------|
| SBD-01 | Security Governance        | Governance             | P1: Create responsibility for cyber security risk | F1: Holistic secure organisation                    |
| SBD-02 | Risk-Driven Approach       | Risk Management        | P3: Adopt a risk-driven approach                  | F2: Early and sustained security                    |
| SBD-03 | Secure Product Development | Secure Development     | P10: Make changes securely                        | F3: Secure product development                      |
| SBD-04 | Supply Chain Security      | Supply Chain           | P2: Source secure technology products             | F3: Secure product development (supply chain)       |
| SBD-05 | Usable Security Controls   | Usability              | P4: Design usable security controls               | F3: Secure by Default                               |
| SBD-06 | Detect and Respond         | Detection and Response | P5: Build in detect and respond security          | F5: Continuous assurance (monitoring)               |
| SBD-07 | Flexible Architecture      | Architecture           | P6: Design flexible architectures                 | —                                                   |
| SBD-08 | Minimize Attack Surface    | Attack Surface         | P7: Minimise the attack surface                   | F3: Secure product development (surface reduction)  |
| SBD-09 | Defense in Depth           | Layered Defense        | P8: Defend in depth                               | F2: Early and sustained security (defence in depth) |
| SBD-10 | Continuous Assurance       | Assurance and Testing  | P9: Embed continuous assurance                    | F4: Testing, F5: Continuous assurance               |
| SBD-11 | Secure Deprecation         | Deprecation            | P7: Minimise the attack surface (retire securely) | F6: Secure deprecation                              |

## Cross-reference matrix

Each principle document follows a consistent structure:

1. Source mapping — which UK principle and AU foundation the content derives from.
2. Description — what the principle covers and why it matters.
3. Principle checklist — observable indicators that the codebase or project adheres to the principle.
4. Controls and mitigations — defensive measures and implementation guidance.
5. Anti-patterns — common violations that indicate non-adherence.
6. OWASP cross-references — related OWASP Top 10 vulnerability identifiers.

## Source frameworks

### UK Government Secure by Design Principles

Source: UK Government Security Group, last updated February 2026.

10 mandatory principles for government delivery teams:

1. Create responsibility for cyber security risk
2. Source secure technology products
3. Adopt a risk-driven approach
4. Design usable security controls
5. Build in detect and respond security
6. Design flexible architectures
7. Minimise the attack surface
8. Defend in depth
9. Embed continuous assurance
10. Make changes securely

### Australian ASD/ACSC Secure by Design Foundations

Source: Australian Signals Directorate, Australian Cyber Security Centre, last updated July 2024.

6 foundations for technology manufacturers and consumers:

1. Holistic secure organisation
2. Early and sustained security
3. Secure product development
4. Testing
5. Continuous assurance
6. Secure deprecation

## Category groupings

### Governance

* SBD-01 Security Governance

### Risk Management

* SBD-02 Risk-Driven Approach

### Secure Development

* SBD-03 Secure Product Development
* SBD-04 Supply Chain Security
* SBD-05 Usable Security Controls

### Architecture and Design

* SBD-07 Flexible Architecture
* SBD-08 Minimize Attack Surface
* SBD-09 Defense in Depth

### Operations

* SBD-06 Detect and Respond
* SBD-10 Continuous Assurance
* SBD-11 Secure Deprecation

---

Content derived from works by the **UK Government Security Group** (Crown Copyright) licensed
under the [Open Government Licence v3.0](https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/)
and the **Australian Signals Directorate / ACSC** (© Commonwealth of Australia) licensed under
[CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/).
Modifications: Synthesized into structured principle-checklist format with OWASP cross-references;
merged UK and AU guidance into unified principle areas.

*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*
