NIST IR 8397 Guidelines on Minimum Standards for Developer Verification of Software 4.2: Ship secure defaults, verify all valid settings and keep supply chain integrity

What does 4.2 require?

Software releases include secure default settings and caveats about deviating from them; security verification covers all valid settings and, where possible, confirms that run-time checks reject invalid settings; the acquirer is warned that settings outside those explicitly permitted invalidate the developer's security assertions; and the integrity of the software through the supply chain to the acquirer is maintained, for example by signing and protecting the delivered artefacts.