compliance
Safeguard articles tagged "compliance" — guides, analysis, and best practices for software supply chain and application security.
478 articles
ISO 27001 and NIST Framework Alignment for Supply Chain V...
How ISO 27001:2022 and NIST's SSDF, SP 800-161, and CSF 2.0 converge on software supply chain vendors—and where CVE-only scanning tools leave compliance gaps.
NIST SSDF PW.4: Reusing Well-Secured Software, Explained
PW.4 is the SSDF practice that governs how you consume third-party and open-source components. Here is what its tasks actually ask for and how to satisfy them with evidence, not policy documents.
Sonatype SBOM Manager Overview
A concrete look at Sonatype SBOM Manager — its origins, pricing model, VEX support, and common adoption gaps — for teams evaluating an SBOM manager tool.
EU NIS2 Directive: Enforcement at One Year
Twelve months after the NIS2 transposition deadline, enforcement is uneven, fines are real, and software supply chain obligations are starting to bite.
AI & LLM Governance for Software Development
Sonatype flags bad packages after the fact. Here's what AI governance for software development requires, and how Safeguard tracks models and output together.
VAPT Services: What They Are and How to Choose One
VAPT services combine vulnerability assessment with penetration testing to both find weaknesses and prove which ones are actually exploitable. Here is what to expect and what to ask for.
OWASP Top 10 Certification: What It Actually Means
There is no official OWASP Top 10 certification, but here is how to prove OWASP Top 10 competence, which credentials cover it, and how teams demonstrate coverage.
License Compliance Debt: The Quiet Risk Growing Alongside...
Open source license debt is compounding as fast as CVE backlogs, but has no CVSS score, no patch, and no dashboard — until an audit, M&A deal, or lawsuit forces the issue.
SOC 2 Type II vs ISO 27001: what each certification actua...
SOC 2 Type II and ISO 27001 certify different things to different audiences. Here's what each actually covers, and how to evaluate supply chain vendors like JFrog and Safeguard on it.
Define HIPAA: What the Law Actually Requires of Software Teams
HIPAA gets invoked constantly and understood rarely. Here is a plain-English definition, the rules that matter for engineers, and where software supply chain fits in.
AI governance frameworks: managing risk in AI-built software
AI governance frameworks like NIST AI RMF and the EU AI Act now govern AI-built software. Here's what they require, and where JFrog's artifact-first approach falls short.
Misconfiguration Fatigue: Why the Same Cloud Mistakes Kee...
The same cloud misconfigurations — public buckets, stale IAM roles, unwatched drift — keep causing breaches years apart. Here's why, with real cases and how to break the cycle.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.