Compliance
How do you manage outsourced developers under ISO 27001 8.30?
How to manage contractors and agencies that write your code under ISO 27001 control 8.30: contract terms, monitoring, review, and the evidence to keep.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
What security testing evidence does ISO 27001 8.29 expect?
What ISO 27001 control 8.29 expects for security testing in development and acceptance: methods, acceptance criteria, and the records auditors ask to see.
Oct 18, 20263 min read
Compliance
What are secure engineering principles under ISO 27001 8.27?
What ISO 27001 control 8.27 means by secure system architecture and engineering principles, what to write down, and how auditors check you apply them.
Oct 18, 20263 min read
Compliance
How do you document application security requirements for ISO 27001?
How to record application security requirements for ISO 27001 Annex A 8.26, for software you build or buy, and what auditors check for each project.
Oct 18, 20263 min read
Compliance
Is there a HIPAA certification for software vendors?
No. The HIPAA Security Rule text sets standards, not a vendor certificate. Here is what a buyer can ask for instead and how to read each answer.
Oct 18, 20264 min read
Compliance
Is SSDF compliance a certification? Myth vs fact for suppliers
The SSDF is a framework of practices, not a certificate. Five myths about it, checked against NIST, CISA and OMB text, so suppliers describe it accurately.
Oct 18, 20263 min read
Compliance
Is bank supervisory guidance legally binding on software vendors?
Supervisory guidance does not have the force of law, yet it shapes bank contracts and exams. How guidance, rules and contract terms differ for vendors.
Oct 18, 20263 min read
Compliance
Is an open source library a subprocessor?
A library running inside your code is not a subprocessor, but a hosted service that processes customer data for you is. How to tell and how to answer.
Oct 18, 20263 min read
Compliance
Is an IP address in your logs personal data under GDPR?
Often yes. GDPR Recital 30 names IP addresses as online identifiers, so treat them as personal data in logs: minimise, restrict access and set expiry.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.