Compliance
How do you record a license that is not on the SPDX License List?
Use a LicenseRef identifier and keep the extracted license text with it. How the format works, uniqueness rules, and what to store in your SBOM.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
NIST SP 800-18 Rev. 2: one guide for three system plans
SP 800-18 Rev. 2 replaced the 2006 guide in June 2026 and covers security, privacy and supply chain plans. What a software team should check now.
Oct 18, 20264 min read
Compliance
SP 800-171A: the 2018 version is withdrawn, so which one do you use?
NIST withdrew the 2018 SP 800-171A on 14 May 2024 in favor of Rev. 3. Here is how that fits with CMMC rules that still point to Rev. 2 requirements.
Oct 18, 20263 min read
Compliance
What evidence do auditors want for SOC 2 vulnerability management?
Auditors want proof that your vulnerability process ran: the policy, dated scan output, tickets or pull requests, closure dates and approved exceptions.
Oct 18, 20263 min read
Compliance
SOC 1: who needs one and when a SOC 2 report is not the answer
A SOC 1 report covers controls at a service provider that matter to customers' financial reporting. How to tell if a buyer wants SOC 1 rather than SOC 2.
Oct 18, 20263 min read
Compliance
Slack message retention settings: what you can set on each plan
Slack retention options differ by plan. What owners can set, what deletion means, and how retention settings affect exports, direct messages and files.
Oct 18, 20263 min read
Compliance
SI-2 vs RA-5: flaw remediation and vulnerability scanning are two controls
NIST 800-53 splits finding vulnerabilities (RA-5) from fixing them (SI-2). Here is what each control asks for and how to keep evidence for both of them.
Oct 18, 20264 min read
Compliance
Should you migrate security tools during an audit window?
Usually wait until the observation period ends, or plan the change with your auditor and overlap evidence. Here is how to decide and what to document.
Oct 18, 20263 min read
Compliance
Custom questionnaire or the vendor's CAIQ: which should you use?
Buying an AppSec tool: send your own questionnaire or accept a standard CAIQ? A decision guide with a hybrid approach that saves review time.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.