Compliance
OMB M-26-05: what changed for software suppliers selling to agencies
OMB memo M-26-05 of 23 January 2026 rescinded M-22-18 and M-23-16. What agencies may still ask for, and what software suppliers should do now.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Your old federal attestation after M-26-05: keep, revise or retire?
You signed the CISA attestation form for an agency. OMB M-26-05 has since rescinded the memos behind it. What to check before you leave it alone.
Oct 18, 20263 min read
Compliance
NRC 10 CFR 73.54: what a nuclear cyber security plan covers
10 CFR 73.54 asks nuclear power plant licensees to protect safety, security and emergency systems under an NRC-approved cyber security plan.
Oct 18, 20263 min read
Compliance
Do you have to tell customers if a bad package never ran in production?
Not automatically. Notification usually depends on whether personal data or customer systems were affected. How to decide, and what to document anyway.
Oct 18, 20263 min read
Compliance
NIST CSF 2.0 Tiers: why they are not a maturity score to chase
CSF 2.0 Tiers describe the rigor of risk governance, from Partial to Adaptive. They are optional, apply to profiles, and Tier 4 is not the goal for everyone.
Oct 18, 20263 min read
Compliance
How to build a NIST CSF 2.0 Organizational Profile in five steps
NIST CSF 2.0 describes five steps to scope, gather, create, analyse and act on an Organizational Profile. Here is how a small team can run them.
Oct 18, 20263 min read
Compliance
The NIST CSF 2.0 Govern function: what each category asks of you
Govern is the new CSF 2.0 function. It covers context, risk strategy, roles, policy, oversight and supply chain risk. Here is what to have ready for each.
Oct 18, 20263 min read
Compliance
Which trust center documents should be public and which NDA-gated?
Publish policies, the subprocessor list and attestations you hold. Gate audit reports, pen test detail and architecture. Decision table and access rule.
Oct 18, 20263 min read
Compliance
Morgan Stanley SEC order: decommissioned drives and customer data
The SEC fined Morgan Stanley Smith Barney 35 million dollars over disposal of devices holding customer data. A checklist for retiring hardware safely.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.