Compliance
How the CMMC Level 2 score out of 110 is calculated
CMMC Level 2 scoring starts at the maximum and subtracts 1, 3 or 5 points for each requirement not met. See the rules for MFA and FIPS encryption.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
How often should you update a risk assessment?
There is no single required interval. Update on a schedule and on triggers such as major changes. Here is a practical cadence by risk level.
Oct 18, 20263 min read
Compliance
How often should you review user access?
No standard sets one review interval. Choose by risk: shorter for privileged and production access, longer for low-risk tools, then document it.
Oct 18, 20263 min read
Compliance
How long should a connected device get security updates?
The EU Cyber Resilience Act recitals say a support period should be no less than five years unless the product's lifetime is shorter. What to plan for.
Oct 18, 20263 min read
Compliance
How fresh does compliance evidence have to be for an audit?
Evidence must cover the audit period and show the control ran on time. Dates matter more than file age. How to avoid stale or backdated proof.
Oct 18, 20263 min read
Compliance
How auditors sample evidence: population, sample, and what to prepare
Auditors rarely read every record. They ask for a full population, pick a sample, and test it. Here is how that works and how to prepare clean populations.
Oct 18, 20263 min read
Compliance
HIPAA unique user ID: why shared logins and service accounts fail
HIPAA requires a unique name or number to identify and track each user. See why shared clinical logins fail and how to handle service accounts.
Oct 18, 20263 min read
Compliance
HIPAA technical safeguards checklist: what 164.312 asks for
A plain checklist of the five HIPAA technical safeguard standards in 45 CFR 164.312, which parts are required, which are addressable, and what to show.
Oct 18, 20263 min read
Compliance
HIPAA's six year rule: does it mean keep security logs six years?
The six year period in the HIPAA Security Rule applies to required documentation. Whether it covers your logs is a judgment call to make with counsel.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.