Procurement reviewers get a questionnaire back and have to decide whether the answers mean anything. Software vendors are a special case, because their risk is in components you cannot see. Safeguard gives a reviewer a few concrete ways to check.
What it is
Safeguard's Third Party Risk Manager, TPRM, handles vendor inventory, SBOM requests and vendor assessment. Around it sit Gold, a free public directory, and the Trust Center pages that vendors using Safeguard can publish.
How to use it
Tier your vendors
In TPRM you add vendors to a directory and categorize them by risk. The docs give four tiers: Critical for core operations, High for significant data access, Medium for limited system access and Low for minimal risk. They suggest SBOMs required with quarterly updates for Critical, required annually for High, recommended for Medium and optional for Low. Treat those as defaults to adapt, not rules.
Ask for an SBOM
TPRM supports SBOM requests with customizable templates, follow up workflows and response tracking. Received SBOMs can be analyzed for vulnerability mapping and risk scoring, and the docs describe ongoing monitoring that alerts on new vulnerabilities. Portal can store received SBOMs.
Check without an account
You do not need a Safeguard login to sanity check a vendor SBOM. The free scan at gold.safeguard.sh/scan accepts CycloneDX or SPDX files, runs in your browser, never uploads the file and covers up to 100 dependencies. Past that size, use a full scan.
For a named component, look it up on gold.safeguard.sh. Package pages show known vulnerabilities and fixed versions. CVE pages show whether the CVE is on the CISA Known Exploited Vulnerabilities list and include an Am I affected check for a version number. If the vendor says "we are on version 2.3", you can test that claim in a minute.
Read their Trust Center properly
If a vendor publishes a Trust Center on trust.safeguard.sh, learn the status words. Compliant means live readiness with every in scope control passing, a current audit report or certificate, or a self assessment where the framework allows one. In progress means controls still failing or a declared status. Not assessed means nothing backs a status. Signed is a pledge, never shown as Compliant. A framework that needs an independent auditor cannot be declared compliant by self assessment.
Ask what backs each status. Look for the monitoring line, which says controls are continuously monitored and when they were last checked. Restricted documents, such as a penetration test summary, are requested through an access request under NDA, and the vendor's team approves or denies each one.
Keep your own questions short
Questions that produce evidence beat questions that produce prose. Ask for the current SBOM, the date of the last independent test, the list of subprocessors, and who receives security notifications.
What this does not do
A readiness score is the vendor's assessment of what the platform can see, not an audit opinion. A Gold Certified label means only that no vulnerabilities are publicly known in the indexed version and the package is not deprecated. Neither replaces your own judgment.
Try it yourself
Take a vendor you already approved. Ask them for an SBOM, run the free scan on it, and look up the worst package on Gold. Record whether the vendor's answers matched.
Click through it at your own pace, or open it full screen.
Quick check
Can a vendor show a framework that needs an auditor as Compliant from a self assessment?
No. It should show the certification or report.
What does Gold Certified mean?
Gold knows of no vulnerabilities in the indexed version and the package is not deprecated.
Does the free scan upload the SBOM you give it?
No. It runs in the browser and the file never leaves your machine.
