Compliance
In-depth guides and analysis on compliance from the Safeguard engineering team.
100 articles
What engineering evidence can a fintech share with a bank partner?
Bank partners review vendors across planning, due diligence, contracts, monitoring and exit. Prepare dated engineering evidence for each stage.
What does the NYDFS annual CISO report need from engineering?
NYDFS 500.4 requires the CISO to report in writing at least annually to the board on six topics. Facts engineering should supply.
What does 'presently makes consistent use' mean in the attestation?
Three phrases in the CISA form set how far a signer is committing: to the best of my knowledge, presently, and consistent use. A plain reading of each.
What does NIST PS-4 expect when a developer leaves the company?
NIST SP 800-53 PS-4 lists five termination actions: disable access, revoke credentials, exit interview, retrieve property, keep access to their data.
What does Google consent mode do, and what does it not do?
Consent mode tells Google tags how to behave after a visitor's choice. It does not save the choice, pick the values or block every tag. Here is the detail.
What does FERPA mean for the dependencies in a student data app?
FERPA does not mention open source packages, but it covers the student records they can touch. Here is how to connect the law to your dependency list.
What does 'aligned with NIST SSDF or SLSA' mean on a vendor page?
SSDF is guidance and SLSA is a set of build levels. Neither is a certificate. Here is what to ask when a vendor page says compliant, aligned or SLSA level.
What does an auditor mean by a complete and accurate export?
Auditors often ask you to show an exported list is complete and accurate. Here is what that means and how engineers can prove it with a repeatable method.
What does a student data privacy agreement say about subprocessors?
The National Data Privacy Agreement covers sub-processor limits. Here is how that connects to the cloud services and libraries an edtech vendor uses.
What personal data about your developers does a security platform hold?
Security platforms hold developer names, emails and activity. Here is what to inventory, how to minimise it, and what to tell your engineering team.
What dependency scan evidence should you give a SOC 2 auditor?
Give the auditor dated, complete, repeatable scan evidence: coverage list, run history, findings population and closure records. Avoid one-off screenshots.
What dependency changes should trigger a HIPAA security re-evaluation?
The Security Rule asks for evaluation after operational changes. These are the dependency events worth treating as triggers, and how to record the result.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.