Compliance
PCI DSS SAQ A vs SAQ A-EP vs SAQ D: which one applies?
Your SAQ depends on how much of the payment page you control. Redirect or fully outsourced pages fit SAQ A, partial control A-EP, and the rest SAQ D.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
PCI DSS network segmentation: myths and facts
Segmentation can shrink PCI DSS scope, but it is optional, must be verified and does not make connected systems out of scope. Seven myths checked.
Oct 18, 20264 min read
Compliance
PCI DSS 4.0 future-dated requirements: how they were assessed
PCI DSS 4.0 marked new requirements as best practice until 31 March 2025. What the PCI SSC FAQ says about reporting them and what to check in your next assessment.
Oct 18, 20263 min read
Compliance
PCI DSS 6.2.2 developer training: what to teach and record
PCI DSS v4.0 requirement 6.2.2 asks for role-relevant developer training at least every 12 months. What to cover, what records assessors want, and gaps.
Oct 18, 20263 min read
Compliance
PBKDF2 iteration counts for FIPS-bound password storage
If a FIPS-140 requirement rules out Argon2id, PBKDF2 is the option. The OWASP iteration counts for HMAC-SHA-256 and SHA-512 and how to set them.
Oct 18, 20263 min read
Compliance
OSHA and robot safety: which standards apply in a US plant
OSHA has no robot specific standard. Here is which general rules apply to robot work in the US and how consensus standards such as ISO 10218 fit in.
Oct 18, 20263 min read
Compliance
From the Orange Book to Common Criteria: a short history
The Orange Book of 1983 set the first widely used evaluation classes for secure systems. A short history of its divisions and what replaced it.
Oct 18, 20263 min read
Compliance
Open source or source available? The ten criteria that decide
Visible source code is not the same as open source. The Open Source Definition lists ten criteria a license must meet; here is how to test a license.
Oct 18, 20263 min read
Compliance
Open-source AI and the EU AI Act: what is actually exempt
Open-source AI gets some relief under Articles 2 and 53, but not for prohibited practices, high-risk use, transparency duties or systemic risk models.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.