Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
If no partner names a TISAX objective, the ENX handbook suggests choosing ones that imply AL 3. Here is the reasoning, the trade offs and a way to decide.
TISAX has three assessment levels: AL 1 is a self-assessment check, AL 2 a plausibility check, AL 3 full verification. What each means and which to plan for.
Ten questions for third-party risk reviews of SBOMs: coverage, unknowns, versions, signatures, update frequency, sharing and how the supplier acts.
A baseline is a starting point. Tailoring and overlays change it for a mission or technology. Here is how it works and what to document for assessors.
How to move between compliance platforms without losing evidence or breaking your audit window: timing, exports, parallel runs, and auditor sign off.
The EDPB expects exporters to be able to suspend or end transfers promptly. Here is a practical runbook for pausing a data flow to a vendor or country.
Dependency inventories, scan history, review settings and release records can be gathered continuously. Policies and risk decisions still need a person.
General authorisation lets a vendor add subprocessors if it tells you first. What notice period to ask for, how to object, and what happens if you do.
NIST's SSDF gives buyers and suppliers a common vocabulary for secure development. How to use it to ask sharper supply chain questions and get evidence.
Weekly insights on software supply chain security, delivered to your inbox.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.
