CISA has described and published a set of principles for the development of security-by-design and security-by-default cybersecurity products.

Hope this helps ;)