compliance
Safeguard articles tagged "compliance" — guides, analysis, and best practices for software supply chain and application security.
478 articles
ISO 27001 compliance for software development teams
ISO/IEC 27001:2022 audits now check 8 SDLC controls directly — SBOMs, vulnerability SLAs, and CI/CD evidence dev teams commonly get flagged on.
CISA's Secure-by-Design pledge two years in: vendor commitments and procurement effects
CISA's Secure-by-Design pledge launched in April 2024 with seven voluntary goals. Two years later, signatories are publishing progress reports and procurement teams are starting to ask hard questions.
Law firm software supply chain risk in 2026
Why the legal sector's reliance on Relativity, iManage, NetDocuments, and a long tail of practice-management vendors creates a supply chain attack surface that ABA Formal Opinion 483 makes a duty to address.
SEC cyber-incident 8-K disclosure and the software supply chain in 2026
The SEC's Item 1.05 8-K rule has been live since December 2023, and supply-chain incidents are now the most common trigger for a four-day materiality clock. Here is what programs need to know.
SSO, SCIM, and Vanta integrations for compliance-driven t...
How SSO, SCIM, and native Vanta integration shape audit readiness for supply chain security tools, and where Safeguard's approach differs from Socket.dev's.
NIS2 in Italy: Legislative Decree 138/2024 and the Tiered Sanctions Regime
Italy's NIS2 transposition entered into force on 16 October 2024 via Decree 138/2024, with fines reaching 10 million EUR or 2% of global turnover for essential entities.
Vendor trust center: how Socket protects customer data
How Socket.dev discloses SOC 2 and security data, and what a self-service SCA vendor security trust center should show before you grant repo access.
HIPAA compliance in software development
HIPAA compliance in software development means encryption, access logging, and vulnerability management baked into the SDLC — not paperwork. Here's what engineers must build.
Responsible vulnerability disclosure policy comparison
Safeguard and Socket.dev both publish vulnerability disclosure policies—but their SLAs, bounty terms, and scope differ. A sourced, line-by-line comparison for vendor due diligence.
PCI DSS requirements for application security programs
PCI DSS v4.0.1 Requirement 6 sets hard deadlines and evidence rules for AppSec — here's what 6.2.3, 6.3.1–6.3.3 actually demand.
Does Socket.dev store or upload your source code?
Does Socket.dev see your proprietary source code? Here's how dependency scanners access repos, and where Safeguard draws the compliance line.
FedRAMP authorization for cloud service providers explained
A concrete walkthrough of FedRAMP authorization for CSPs: impact levels, control counts, timelines, costs, FedRAMP 20x, and continuous monitoring deadlines.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.