Compliance
Safeguard articles tagged "Compliance" — guides, analysis, and best practices for software supply chain and application security.
100 articles
What does NIST PS-4 expect when a developer leaves the company?
NIST SP 800-53 PS-4 lists five termination actions: disable access, revoke credentials, exit interview, retrieve property, keep access to their data.
What does Google consent mode do, and what does it not do?
Consent mode tells Google tags how to behave after a visitor's choice. It does not save the choice, pick the values or block every tag. Here is the detail.
What does FERPA mean for the dependencies in a student data app?
FERPA does not mention open source packages, but it covers the student records they can touch. Here is how to connect the law to your dependency list.
What does 'aligned with NIST SSDF or SLSA' mean on a vendor page?
SSDF is guidance and SLSA is a set of build levels. Neither is a certificate. Here is what to ask when a vendor page says compliant, aligned or SLSA level.
What does an auditor mean by a complete and accurate export?
Auditors often ask you to show an exported list is complete and accurate. Here is what that means and how engineers can prove it with a repeatable method.
What does a student data privacy agreement say about subprocessors?
The National Data Privacy Agreement covers sub-processor limits. Here is how that connects to the cloud services and libraries an edtech vendor uses.
What personal data about your developers does a security platform hold?
Security platforms hold developer names, emails and activity. Here is what to inventory, how to minimise it, and what to tell your engineering team.
What dependency scan evidence should you give a SOC 2 auditor?
Give the auditor dated, complete, repeatable scan evidence: coverage list, run history, findings population and closure records. Avoid one-off screenshots.
What dependency changes should trigger a HIPAA security re-evaluation?
The Security Rule asks for evaluation after operational changes. These are the dependency events worth treating as triggers, and how to record the result.
What is sensitive customer information under Regulation S-P?
Regulation S-P defines sensitive customer information as data whose compromise could cause substantial harm or inconvenience. Examples, and how to tag fields.
What counts as a material change that should trigger a new scan?
Two US financial rules tie testing to material changes. A practical list of events that should trigger a new vulnerability scan or assessment.
What can built-in click and form variables capture in Tag Manager?
Built-in variables such as Click Text, Form Text, Page URL and Referrer can pass sensitive values to tags. Know which ones to enable and how to check them.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.