Compliance
In-depth guides and analysis on compliance from the Safeguard engineering team.
304 articles
Aikido Trust Center walkthrough: certifications, pentesti...
A walkthrough of the Aikido Security trust center: what its SOC 2, ISO 27001, and annual pentest claims actually mean, and what's missing for a real vendor risk review.
CMMC 2.0 Phase Two: What November 10, 2026 Means for Contractors
CMMC Phase 1 began in November 2025. Phase 2 lands on November 10, 2026, requiring mandatory C3PAO Level 2 assessments. We unpack the contractor implications.
Permissive License Explained: MIT, Apache 2.0, and BSD Risks
What a permissive license is, how MIT, BSD, and Apache 2.0 differ, and the compliance and security risks teams overlook when they assume permissive means risk-free.
NIST CVE Data Explained: How the NVD Works and Why the Backlog Matters
What NIST's role in CVE data actually is, how the NVD enriches records with CVSS and CPE, and why the 2024 analysis backlog changed how teams should consume it.
Maven SBOM: How to Generate a Software Bill of Materials for Java Builds
A Maven SBOM inventories every direct and transitive dependency in your Java build. Here is how to generate one with the CycloneDX plugin and put it to work for security.
FedRAMP 20x Phase Two: What Moderate Pilots Are Teaching Us
FedRAMP 20x Phase Two is running Moderate-baseline pilots through Q2 2026. We walk through KSIs, machine-readable OSCAL, and the path to wide-scale adoption.
BSD 3-Clause License Explained
The BSD 3-clause license is one of the most permissive open source licenses in wide use — here's what its three conditions actually require and how it differs from MIT and Apache 2.0.
OSS Licenses Explained: Compliance and Risk Management
OSS licenses govern how you can use open-source dependencies, and ignoring them creates real legal and business risk. Here is how the main license types work and how to stay compliant.
Cloud Security Standards & Frameworks (ISO/IEC, NIST, CIS)
ISO 27001:2022, NIST CSF 2.0, and CIS Benchmarks now expect software supply chain proof that cloud posture tools like Wiz can't provide alone. Here's what changed and why it matters.
The MIT Software License: What It Permits and What to Watch For
The MIT software license is short, permissive, and lets you do almost anything as long as you keep the copyright notice. Here is what it actually requires and where teams still get tripped up.
Cloud Compliance Tools: How to Choose the Right One
A practical guide to cloud compliance tools: the categories that exist, what each actually does, and how to pick tooling that maps to your frameworks.
Cloud Compliance Platform: A Buyer's Security Guide
A cloud compliance platform continuously maps your cloud configuration and evidence to frameworks like SOC 2 and ISO 27001. Here is what one actually does and how to tell a real one from a checkbox tool.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.