Open your trust page in a private window and check six things: every link works, every section has a date, the security contact answers, each claim has evidence, downloads open, and nothing says certified, compliant, or guaranteed without proof. Fix or remove what fails. Repeat it each quarter.
Before you start
Use a browser with no login, so you see what a prospect sees. Have your claims record or a simple list of evidence nearby. Set a five-minute timer, and keep a note of anything that fails.
The six checks
1. Links (60 seconds). Click every link, including footer and download links. Note any that return an error or lead to a retired document.
2. Dates (45 seconds). Look for a last reviewed date on the page and on each major section. Anything over a quarter old gets flagged. If there are no dates, that is the first fix.
3. Contact (60 seconds). Find the security contact and send a short test message. A mailbox that nobody reads is worse than no mailbox. RFC 9116 stresses that contact information should be current, accessible, and controlled by the organization, and that stale data may be worse than none.
4. Claims (90 seconds). Pick three claims at random and find the evidence for each. If you need more than a minute to locate it, a customer will not get it quickly either.
5. Downloads (30 seconds). Open each file. Check that the SBOM or report is the current version and carries a timestamp. CISA's 2026 minimum elements define an SBOM timestamp as the date and time of the most recent update to the data.
6. Risky words (45 seconds). Use your browser's find tool for certified, compliant, guaranteed, secure, and unhackable. Each hit needs a reason to stay.
Score it
| Check | Pass | Needs work |
|---|---|---|
| Links | All work | Any broken |
| Dates | Every section dated | Missing or stale |
| Contact | Answers in one business day | No reply |
| Claims | Evidence found fast | Evidence missing |
| Downloads | Current and dated | Old or unlabeled |
| Words | Each backed by proof | Unsupported |
Fix anything marked needs work within a week, or take that line off the page until you can.
After the audit
Write down the date, who ran it, and what changed. This becomes part of your evidence that the page is maintained. If your auditors or customers ask how you keep the page accurate, you can show the log.
Then schedule the next one. A calendar reminder is enough. Add event triggers too: a new subprocessor, a new audit result, a product change, or an incident.
Try it yourself
Click through it at your own pace, or open it full screen.
See how controls map to evidence. Each claim on your page should trace to a control in the same way.
Where Safeguard fits
Safeguard's compliance and evidence automation helps teams keep evidence organized and current. You can also run a free scan at gold.safeguard.sh/scan.
Quick check
Who should run the audit?
Someone who did not write the page. Fresh eyes find more, and the owner then fixes what turns up.
What if a claim has no evidence?
Remove it or rewrite it to what you can show, then add the evidence to your record.
Sources
- RFC 9116: A File Format to Aid in Security Vulnerability Disclosure
- 2026 Minimum Elements for a Software Bill of Materials (SBOM), CISA
Last reviewed: 19 October 2026.
