To increase the overall level of security, security should be “built in” and considered from the very beginning. Therefore, the Charter of Trust defined “Security by Default” as one of its ten key principles.

By Sudhir Ethiraj, Global Lead, Cyber Security Strategy & Charter of Trust, TÜV SÜD

With the exponential growth of digitization in our everyday lives, there is also a potential widening of the attack surface. This fuels up the need to consider the principle of “Security by Design” or “Security by Default”. In other words: To increase the security level, security should be “built in” and considered from the very beginning.

The Charter of Trust defined Security by Default as one of its ten key principles. The objective: To adopt the highest appropriate level of security and data protection and ensure that it is preconfigured into the design of products, functionalities, processes, technologies, operations, architectures, and business models. It involves taking security into account right from the design phase. This helps avoid potential vulnerabilities, cyber risks and the costs associated with those risks.

Security by Default – end to end view

The principle should encompass more than just a product. It should include the processes behind the underlying architectures and the operations that enable the processes. This helps incorporate security aspects right from the outset considering a broad systemic view rather than having a narrow focus in scope. This could range from anywhere between enabling basic security trainings for the employees of an organization to following secure development principles to having a proper cyber risk management in place.

A collective responsibility

The concept of security by default also demands an immense amount of commitment from various stakeholders. It is therefore a collective responsibility of multiple stakeholders ranging from product managers to experts who are responsible for internal cyber security of an organization and to normal employees who need a basic amount of cyber security awareness. This collective responsibility must be anchored at the top of an organization. This is demonstrated very well with the work done at the Charter of Trust where we have companies across industries join hands to define what they see and perceive as necessary yardsticks to achieve Security by Default.

Addressing harmonization

We also live in a world, where standards and laws are currently being developed to address this. Within the Charter principle of “Security by Default”, we also look at the global standards and best practices which have been written from sometimes very different yet good perspectives and try to harmonize them by creation of the so-called “baseline cyber security requirements”. These are then aimed to enhance the Cyber Security stance of organizations who are currently starting out to ensure cyber security.

Ensuring Security by Default – Verification

These requirements also need to be verifiable in order to make sure that regular monitoring and audit processes can take place to measure the success of adoption and compliance to these requirements. It is not just enough to put down requirements, but it is equally important to follow them.

The current state of play, proves very often that the very basic pieces of the puzzle are still missing when it comes to security. This has been proven time and again, especially in connection to the recent attacks on hospitals and PPE manufacturers during the COVID crisis. Lack of basic security policies in place can have massive repercussions. These repercussions go beyond just the organizations being targeted and sometimes can have an impact at a global level.

Therefore, ensuring security by default from a systemic perspective is a great opportunity to get started in security and enabling organizations to tackle any sort of security challenges that may arise and help manage the security risks in the most effective manner.

Learn more about the Charter of Trust Principle 3 Baseline Requirements for products, functionalities and technologies here.

You may also like

Advancing Regulatory Alignment at RSA Conference 2025
icon External Engagement

Advancing Regulatory Alignment at RSA Conference 2025

In the face of rising global cyber threats, over 50 CISOs have called for greater international alignment of cybersecurity regulations to strengthen defenses and reduce fragmentation. This message was echoed at RSAC 2025, where experts from the OECD, European Commission, academia, and industry emphasized the need for principle-based collaboration. The Charter of Trust, a long-time advocate for regulatory harmonization, continues to support coordinated, effective approaches that prioritize clarity over complexity.
May 01, 2025
Richards Skalt takes over the Advocacy Workstream
icon External Engagement

Richards Skalt takes over the Advocacy Workstream

We are delighted to welcome Richard Skalt, Advocacy Manager at TÜV SÜD, as the new Leader of the Advocacy Workstream at the Charter of Trust. Richard steps into the role following María del Pino González-Junco, who recently assumed the position of Chair of the Global External Engagement Working Group.

With a strong background in advocacy and a forward-looking vision, Richard brings renewed energy to our mission of shaping a secure digital future. As he puts it:

“My motivation is to preserve and build upon the strong foundation of advocacy activities we’ve developed over the past years. At the same time, I’m committed to ensuring we’re in a position to shape the policies that will define how our business model and operations evolve in the future – including the cybersecurity of products and systems, the use, deployment, and distribution of robust AI solutions, as well as cloud security and secure datacenters.”

In a world defined by accelerating digital transformation and increasingly complex regulatory challenges, principled leadership and effective collaboration are more vital than ever. Under Richard’s leadership, the Advocacy Workstream will continue to engage policymakers, raise public awareness, and strengthen education around key issues such as cybersecurity, AI governance, and secure digital infrastructures.
April 29, 2025
New Chairwoman for the Global External Engagement Group
icon External Engagement

New Chairwoman for the Global External Engagement Group

The Charter of Trust is proud to announce María del Pino González-Junco, Cybersecurity Alliances Manager at Siemens, as the new Chairwoman of the Global External Engagement Working Group. Her appointment marks a significant step forward in our shared mission to advance cybersecurity through strong international collaboration.

Pino’s election follows a dynamic Collaboration Week in Denmark, where Charter of Trust partners from around the world came together to align on strategy, strengthen partnerships, and reaffirm our commitment to a secure digital future. As a longstanding leader within the advocacy workstream, Pino has been instrumental in fostering open dialogue with key external stakeholders and promoting cybersecurity awareness across industries and institutions.

“A reliable digital world can only thrive if public and private institutions build trust and cyber-resilience together, share their expertise, and support society in this digital journey. Those are our goals at the Charter of Trust,” says Pino.

She takes over the role from Sumit Chanda, COO/CISO at Atos, who has guided the working group with vision and energy. We are pleased to share that Dr Chanda has since been elected Co-Chair of the Charter of Trust by the Board of Directors in February—ensuring his continued impact on the initiative’s strategic direction.

We extend our sincere thanks to Sumit for his outstanding leadership and warmly congratulate Pino on her new role.
April 24, 2025