Compliance
What is OSCAL and why do compliance teams keep hearing about it?
OSCAL is NIST's machine-readable format for controls and assessments. Here is what it is, what it replaces and when a small team should care.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
What is NIST SSDF? A plain-words guide for new AppSec engineers
NIST SSDF is a set of secure development practices in four groups. What SP 800-218 is, how the groups map to daily AppSec work, and where to start reading.
Oct 18, 20263 min read
Compliance
What is GovRAMP and when might a state or local buyer ask for it?
GovRAMP is a nonprofit program verifying cloud security against NIST-based levels. Its levels and how a supplier should read a state or local request.
Oct 18, 20263 min read
Compliance
What is a software composition audit in an acquisition?
A software composition audit lists the open source in a target's code and checks licenses, vulnerabilities and upkeep. Here is what it covers and delivers.
Oct 18, 20264 min read
Compliance
What is a FASCSA order and how do federal suppliers check for one?
A FASCSA order can exclude named sources or covered articles from federal procurement. What FAR subpart 4.23 says and where suppliers look up orders.
Oct 18, 20263 min read
Compliance
What happens to PHI when a vendor contract ends?
At termination a business associate must return or destroy PHI if feasible, or extend contract protections. Here is a vendor offboarding checklist.
Oct 18, 20263 min read
Compliance
What evidence should you keep for each release's vulnerability scan?
Keep five items per release: scan result, scanned artifact digest, SBOM, gate decision with approver, and any waivers, all tied to one release ID.
Oct 18, 20264 min read
Compliance
What evidence proves ISO 27001 control 8.25 secure development?
What an auditor accepts as evidence for ISO 27001 Annex A 8.25, the secure development life cycle: written rules, stage by stage proof, a sample list.
Oct 18, 20263 min read
Compliance
What evidence should engineering show for supply chain controls?
Ask for evidence you can read, not reassurance: seven items engineering can show a leader, an auditor or a customer to back up supply chain claims.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.