Compliance
Do small teams need a change advisory board?
You need change oversight, not a heavy committee. Here is how a small team can meet the intent of a change advisory board with less ceremony.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Do you need a DPIA? A GDPR Article 35 checklist
A DPIA is required before processing likely to cause high risk to individuals. Use this checklist to decide, and to write one that holds up.
Oct 18, 20263 min read
Compliance
DMARC ruf failure reports: should you ask for them?
DMARC ruf failure reports can include message headers or full content. Learn what they contain, the privacy risks RFC 9991 flags, and when to skip them.
Oct 18, 20263 min read
Compliance
Annual review of your vulnerability disclosure program: a checklist
Once a year, test your disclosure policy, security contact, security.txt, response times and safe harbor wording. A twelve point review checklist.
Oct 18, 20263 min read
Compliance
DFARS 7012 flowdown and cloud rules for software vendors
What DFARS 252.204-7012 says about cloud providers and subcontract flowdown, and what a software vendor in the defense chain should check in contracts.
Oct 18, 20263 min read
Compliance
DFARS 7012 72 hour reporting: what engineering should prepare
DFARS 252.204-7012 defines rapid reporting as within 72 hours of discovery. What contractors should set up before an incident so the report is possible.
Oct 18, 20263 min read
Compliance
Developer Certificate of Origin: what a sign-off certifies
The Developer Certificate of Origin is four statements a contributor certifies with a sign-off. Here is what each one means and how it differs from a CLA.
Oct 18, 20263 min read
Compliance
A dependency changed its license: a response playbook
When a library you use changes its license, do not upgrade blindly. Check scope, read the new text, and decide whether to stay, pay, fork or replace.
Oct 18, 20263 min read
Compliance
Erasure requests and backups: what 'beyond use' means
Must you delete personal data from backups after an erasure request? The UK regulator says to put it beyond use and tell the person. Engineering steps here.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.