Compliance
In-depth guides and analysis on compliance from the Safeguard engineering team.
100 articles
Who signs the CISA secure software attestation form?
The CISA form asks for the CEO or a designee who is an employee with authority to bind the company. Who qualifies, who does not, and what to prepare first.
Who should sign a SOC 2 management assertion, and what do they need?
The executive who owns the in-scope system signs a SOC 2 management assertion, after building a reasonable basis. Here is what to check and what to expect.
Who should own the trust page and approve its claims?
A trust page needs one named owner, a claims approver, and a review date. Here is a simple ownership model that stops stale or overstated security claims.
Who should approve a fleet wide firmware rollout before it starts?
Require a second person with the right permission to review every new or changed rollout before it begins. What to check and what to record.
Who owns open source risk? How to answer the governance question
Customers want a name or a role, not a committee. Learn how to describe ownership, escalation and review of open source risk without overclaiming.
Who do you name as responsible for security if you have no CISO?
Reviewers ask who owns security. How a small company can answer truthfully without a CISO: a named role, a deputy, a reporting line and a review rhythm.
Who answers for an SDK's data in your App Store privacy answers?
Apple's App Privacy details put third-party SDK data collection on the app developer. What that means for your review process and who fills in the answers.
Who does what for SSDF practices when you build on cloud platforms?
NIST says SSDF responsibility may be shared between a platform provider and its tenant. How to write down the split and ask providers to attest.
Who dismissed this finding? Preserving the audit trail in a migration
An imported dismissal that shows the migration account as its author is useless to an auditor. Here is how to keep the real decider and date visible.
Who counts as an independent reviewer for a code change?
An independent reviewer is someone other than the author with authority and context to judge the change. How to enforce that in GitHub and prove it.
Who can accept a risk in ISO 27001? Risk owners and sign-off
In ISO 27001 the risk owner accepts residual risk, with a recorded decision. An IT manager without business authority cannot quietly accept it. Why, below.
Who should approve security evidence before it goes to a customer?
Pre approve a base library, let sales share it freely, and route anything custom or sensitive to security for review. A short RACI keeps it fast and safe.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.