Regulatory Compliance
In-depth guides and analysis on regulatory compliance from the Safeguard engineering team.
138 articles
Japan AMED Software Supply Chain Guidance Overview
Japan's AMED, METI, and PMDA guidance now converges on SBOMs and supply chain controls, reshaping how medical and industrial software is built, shipped, and maintained.
Medical Device Cybersecurity Under FDA 524B in 2026
Three years into Section 524B, medical device manufacturers are operating under genuine premarket cybersecurity expectations. Here is what the 2026 submission and postmarket landscape actually requires.
CISA's CI Fortify (May 2026): Planning Critical Infrastructure for Cyber Isolation and Recovery
On May 5, 2026, CISA launched CI Fortify, pushing critical infrastructure operators to plan for cyberattacks that sever their connections to the internet and telecom during a geopolitical crisis. We unpack the isolation and recovery objectives and what they demand of software supply chains.
CISA's Agentic AI Secure Adoption Guide (May 2026): What It Means for Software Supply Chains
On May 4, 2026, CISA and international partners published guidance on the secure adoption of agentic AI. We break down the named risks, the recommended controls, and how to operationalize them for AppSec and platform teams.
OWASP ASVS 5.0 Adoption Guide
OWASP ASVS 5.0 restructured the verification levels and added new requirements for modern stacks. A practical adoption guide for teams using ASVS as their security baseline.
Utility Grid Software Supply Chain in 2026
NERC CIP-013, expanded CIP-010 expectations, and the post-Colonial Pipeline regulatory tightening have changed what utilities must demand from their software vendors. Here is the 2026 baseline.
EU Cyber Resilience Act Vendor Obligations in 2026
The Cyber Resilience Act entered into force in December 2024 with a phased application schedule. The vendor obligations begin to bite in 2026 and accelerate through 2027.
DORA Financial Services Supply Chain Obligations in 2026
The Digital Operational Resilience Act has been in application since January 2025. The ICT third-party risk management obligations are the operational center of gravity in 2026.
Defense Prime Supply Chain Flowdown 2026
Defense primes are pushing supply chain security obligations down to subcontractors at every tier. Here is how to absorb the flowdown without breaking delivery.
Audit Prep: Month To Week With Continuous Evidence
Replace last-minute audit scrambles with continuously generated supply chain evidence. Learn how compliance teams compress preparation timelines from weeks to days.
EU CRA Enforcement First Year: What Changed
A senior engineer's review of the first year of EU Cyber Resilience Act enforcement, what regulators actually asked for, what vendors got wrong, and where the bar moves next.
Oracle Critical Control Baseline: Regulatory Impact
Oracle's February 2025 Critical Control Baseline for critical infrastructure customers reshapes SCRM obligations. Here's what legal and security teams must know.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.