Compliance
In-depth guides and analysis on compliance from the Safeguard engineering team.
100 articles
What is an ACR (VPAT) and why do public buyers ask for one?
An ACR is a vendor-written report on how software meets accessibility standards. Here is what it contains, how buyers use it, and what it cannot prove.
What is a vendor security assessment, and how is it not an audit?
A vendor security assessment is a buyer's review of your controls, often by questionnaire. An audit is an independent examination. Here is how they differ.
What is a SOC 2 management assertion and who writes it?
A SOC 2 management assertion is management's signed statement that the system description is fair and the controls meet the criteria. Here is how it works.
What is a control narrative and how do engineers write one?
A control narrative describes who does what, how often, in which system and with what evidence. Here is a simple template engineers can fill in today.
What is a CAIQ and how do you fill one in honestly?
The CAIQ is a yes or no questionnaire for cloud services. What it is, how it relates to the Cloud Controls Matrix, and how to answer without overclaiming.
What happens to customer data when an enterprise contract ends?
Enterprise buyers ask how and when you delete or return their data at contract end. Here is how to answer, what to document, and what proof to offer.
What goes in an emergency change request for a security patch?
An emergency security change still needs a record. What to capture before, during and after the patch so change control and auditors stay satisfied.
What goes in a supply chain evidence pack for a customer review?
A practical layout for a supply chain evidence pack a startup can hand to a customer reviewer: what to include, how to date it, and what to leave out.
What evidence supports each vulnerability exception reason?
Each exception reason needs its own proof: reachability output, version checks, control tests or vendor statements. A reason by reason evidence table.
What evidence shows an auditor you control third party models?
A practical evidence list for model intake and use: inventory, approvals, pins, hashes, check results, change logs and retirement records for auditors.
What evidence should a dependency intake process keep for auditors?
Keep a few records per decision: who asked, what was checked, who approved, and when. Here is a lean evidence set that supports audits without extra work.
What evidence should an AI security tool produce for auditors?
Good evidence is dated, exportable and tied to a decision. Here are the six records an AI security tool should produce, and how to check each one.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.