A compliance lead lives between engineering facts and auditor questions. Safeguard's Compliance area is built to hold both, and it is careful about what it claims. This post follows the documented workflow.
What it is
Safeguard's framework library has 373 frameworks according to the live docs: national laws, industry standards such as SOC 2, ISO 27001 and PCI DSS, and Safeguard's own supply chain policies. For each, Safeguard checks requirements when it scans your products, lists the controls and offers policy templates. For SOC 2, ISO 27001, the HIPAA Security Rule, PCI DSS and NIST CSF 2.0, connected systems also run automated tests that map to controls.
Choosing a framework does not certify anything. The docs say so directly.
How to use it
Choose what applies
Open Compliance, then Manage, then the Frameworks tab. Find a framework by region, industry or search, switch it on and save. Your plan decides which frameworks you can choose from, and your administrator manages the list.
Read the score properly
A readiness score is the share of in scope requirements that pass. A requirement passes when a scan finds it met, or when a person attests it and names the evidence. A requirement waiting for evidence counts as not yet passing. A requirement you scope out, with a written justification, leaves the score. The score is Safeguard's assessment of what it can see, not an audit opinion.
Beside each score, Safeguard shows how many requirements a scan evaluated and how many need evidence. That is your to do list.
Connect evidence sources
Connectors for cloud accounts, identity providers and code hosts run automated tests. The docs list which connectors provide evidence for which framework, and whether each collects evidence automatically. Where no connector exists, you upload evidence or attach policies and attestations. You can also link tests to controls yourself for frameworks without direct mapping.
Policies
Every framework has policy templates to start from, such as an information security policy, an access control policy and an incident response policy. Edit them to describe what your company actually does, then link them to controls.
Approvals stay human
Changes that count only once a person decides them, such as a policy, evidence, an access review, a test exclusion or a risk acceptance, are decided by a compliance reviewer. Safeguard's assistant and MCP clients can prepare work but never approve it. That keeps the audit trail clean.
Publish a Trust Center
Under Compliance, then Trust Center, set a public slug and organization name, choose frameworks, controls, policies and subprocessors to show, then turn on Publish Trust Center. Each framework displays one status: Compliant, In progress, Not assessed or Signed. A framework that needs an independent auditor cannot be declared compliant by self assessment. Documents can be public or restricted, and restricted ones go out only through an approved access request, which leaves an audit trail.
Reports
The docs describe pre built reports, including an EO 14028 report, an SBOM completeness audit and a vulnerability summary, and custom reports: choose Reports, then Create Report, pick the framework, set scope and date range, generate and export.
Try it yourself
Pick one framework you answer to. Open its page, count how many requirements need evidence rather than a scan, and assign each to an owner. Do the same for one connector you have not connected yet.
Click through it at your own pace, or open it full screen.
Quick check
What does a requirement waiting for evidence do to the readiness score?
It counts as not yet passing until a person attests it with evidence.
Can a self assessment show a framework that needs an auditor as Compliant?
No. Show the certification or report instead.
Who approves a risk acceptance?
A person, such as a compliance reviewer. Assistants can prepare it but not approve it.
