20 May 2026 4 min read Security
Why default settings matter for conformity and what 'secure by default' actually requires.
What it means
Products should ship in a secure configuration out of the box: no default passwords, unnecessary features off, and safe defaults for updates and exposure.
Checklist
- No shared or hardcoded default credentials.
- Unused ports/services disabled by default.
- Automatic security updates where feasible.
- Clear guidance when users must opt into less-secure options.
Evidence
Document the default configuration and the rationale; show how users are warned before weakening it.
This is an educational explainer. For the canonical regulation reference, see the dedicated Security page — or run an assessment to see how it applies to your product.