Compliance
Safeguard articles tagged "Compliance" — guides, analysis, and best practices for software supply chain and application security.
100 articles
What is a control narrative and how do engineers write one?
A control narrative describes who does what, how often, in which system and with what evidence. Here is a simple template engineers can fill in today.
What is a CAIQ and how do you fill one in honestly?
The CAIQ is a yes or no questionnaire for cloud services. What it is, how it relates to the Cloud Controls Matrix, and how to answer without overclaiming.
What happens to customer data when an enterprise contract ends?
Enterprise buyers ask how and when you delete or return their data at contract end. Here is how to answer, what to document, and what proof to offer.
What goes in an emergency change request for a security patch?
An emergency security change still needs a record. What to capture before, during and after the patch so change control and auditors stay satisfied.
What goes in a supply chain evidence pack for a customer review?
A practical layout for a supply chain evidence pack a startup can hand to a customer reviewer: what to include, how to date it, and what to leave out.
What evidence supports each vulnerability exception reason?
Each exception reason needs its own proof: reachability output, version checks, control tests or vendor statements. A reason by reason evidence table.
What evidence shows an auditor you control third party models?
A practical evidence list for model intake and use: inventory, approvals, pins, hashes, check results, change logs and retirement records for auditors.
What evidence should a dependency intake process keep for auditors?
Keep a few records per decision: who asked, what was checked, who approved, and when. Here is a lean evidence set that supports audits without extra work.
What evidence should an AI security tool produce for auditors?
Good evidence is dated, exportable and tied to a decision. Here are the six records an AI security tool should produce, and how to check each one.
What engineering evidence can a fintech share with a bank partner?
Bank partners review vendors across planning, due diligence, contracts, monitoring and exit. Prepare dated engineering evidence for each stage.
What does the NYDFS annual CISO report need from engineering?
NYDFS 500.4 requires the CISO to report in writing at least annually to the board on six topics. Facts engineering should supply.
What does 'presently makes consistent use' mean in the attestation?
Three phrases in the CISA form set how far a signer is committing: to the best of my knowledge, presently, and consistent use. A plain reading of each.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.