Documentation for secure installation, operation and use, the security concept and known issues, and the documents certification needs, including a software bill of materials (SBOM). Pitfalls: too much detail, hiding issues, legalistic language.

The Project Lead is responsible, supported by developers, marketing and communications, and Product Security. Deliverables:

• Installation and operation guidance and security user guidance.
• Release notes, known issues and residual risks.
• Security concept and intended use.
• Certification documentation.
• SBOM: the machine-readable list of every component and version in the product, so customers can check it against new CVEs themselves.

It runs draft → review → sign-off → publish, on a website or customer portal. Good practice is a broad review, clear language and a defined glossary. The pitfalls defeat the purpose. A customer cannot configure the product securely from a document that is too detailed or too legalistic. Hidden issues come out eventually, and then the customer loses trust in the manufacturer.

Go deeper:

• Software supply chain and SBOM (Wikipedia) — what an SBOM contains and the SPDX and CycloneDX formats

It goes wrong through lack of expertise and awareness, low priority, increasing complexity, lack of collaboration and lack of testing. It is driven by laws and regulations, vulnerabilities and incidents, market requirements, customer satisfaction and requirements from other fields such as safety and privacy.

* Five causes lead to security issues; five drivers push companies to fix them. *

Causes of security issues:

• Lack of expertise and awareness: developers aren't trained to think like attackers.
• Low priority or wrong focus: features and deadlines beat non-functional requirements.
• Increasing complexity: more components, more interfaces, more third-party code.
• Lack of collaboration between R&D, security, product management and operations.
• Lack of testing: no security testing, or none until just before release.

Drivers:

• Laws and regulations: CRA, FDA, UN R155 and others make it a market-access condition.
• Vulnerabilities and incidents: the cost of a breach or recall.
• Market requirements: certifications that tenders and big customers demand.
• Customer satisfaction: customers expect safe, trustworthy products.
• Requirements from other fields: safety and privacy depend on security.