CISA's updated guidance focuses on encouraging software manufacturers to integrate cybersecurity into their products from the ground up. It emphasizes principles like transparency, accountability, and ownership of security outcomes, while also providing detailed methods for measuring the effectiveness of these security measures.

The updated guidance from CISA indicates that the secure-by-design principles are relevant to AI software systems as well. Although AI may differ from traditional software, fundamental security practices still apply, and some recommendations may need to be adjusted to fit the unique characteristics of AI.

CISA has conducted a listening tour, gathering feedback from hundreds of individuals, companies, and nonprofits to understand what aspects of the initial secure-by-design principles work effectively and which do not. This input has been instrumental in shaping the updated guidance.