By baking minimum expectations into procurement conversations, the plan is to steer software makers to “secure-by-design and default” basics.