Compliance
Microsoft 365 audit log retention: 180 days and what to export
Microsoft Purview Audit Standard keeps records 180 days; Premium keeps some for a year. What that means for investigations and what to export.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Pseudonymisation vs anonymisation: what analytics teams should assume
Hashing an email is not the same as anonymising it. What GDPR says pseudonymisation is, and how analytics teams should treat hashed data.
Oct 18, 20263 min read
Compliance
Procurement security questionnaire for AI vendors: what to include
What belongs in a security questionnaire for AI and agent vendors: data use, model providers, agent permissions, testing, incident handling and exit terms.
Oct 18, 20263 min read
Compliance
How do you prepare your open source licenses before a sale?
Inventory every component, resolve unknown licenses, sort findings against a policy, fix the high impact ones and assemble notices and evidence.
Oct 18, 20263 min read
Compliance
pgAudit session vs object logging: what to log in PostgreSQL
pgAudit adds detailed audit logs to PostgreSQL. Compare session and object logging, pick log classes and avoid writing secrets into your audit trail.
Oct 18, 20263 min read
Compliance
POA&M instead of attestation: how OMB M-23-16 handled gaps
When a supplier could not attest to every practice, M-22-18 and M-23-16 allowed a plan of action and milestones. How it worked and why OMB tightened it.
Oct 18, 20263 min read
Compliance
Pen testing vs vulnerability scanning in NIST 800-53: CA-8 and RA-5
NIST SP 800-53 treats penetration testing (CA-8) and vulnerability scanning (RA-5) as separate controls. Here is what each asks for and how they connect.
Oct 18, 20263 min read
Compliance
PCI DSS scans, pen tests and app assessments: how do they differ?
PCI DSS asks for vulnerability scans (11.3), penetration tests (11.4) and application assessments (6.4.1) as separate activities. A comparison table.
Oct 18, 20263 min read
Compliance
Can you hard code passwords in source or scripts under PCI DSS?
PCI DSS 8.6.2 bars hard coded passwords for application and system accounts used for interactive login. Scope, what to use instead, and a short checklist.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.