Compliance
HIPAA security incident or breach: what must a vendor report?
A security incident is a broad term and a breach is narrower. See how each is defined and what a vendor contract should require it to report.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
HHS health sector cybersecurity goals: essential vs enhanced
HHS published ten essential and ten enhanced cybersecurity performance goals for health care in 2024. The lists, and what voluntary means here.
Oct 18, 20263 min read
Compliance
Healthtech AppSec tool evaluation: PHI exposure and vendor terms
Healthtech teams must check where scan data goes, whether PHI can leak into findings, and what contract terms apply before buying an AppSec tool.
Oct 18, 20263 min read
Compliance
AI recommendations in healthcare: Section 1557 decision support rule
US rule 45 CFR 92.210 asks health programs to identify and reduce discrimination risk in patient care decision support tools. What builders should do.
Oct 18, 20263 min read
Compliance
A green dashboard is not audit ready: how to read readiness scores
What a compliance platform readiness score measures, what it misses, and the checks to run yourself before you trust a green dashboard with an audit date.
Oct 18, 20263 min read
Compliance
GitLab security policies: what is the difference between the types?
GitLab has scan execution, merge request approval, pipeline execution and vulnerability management policies. Learn what each does and how they are stored.
Oct 18, 20263 min read
Compliance
Getting approval for chaos experiments in a regulated company
How to get change, risk and compliance teams to approve fault injection: scope, rollback, evidence, and a standing approval for low risk tests.
Oct 18, 20263 min read
Compliance
BSI TR-03183 explained: Germany's technical guidance for CRA era SBOMs
BSI TR-03183 is a German technical guideline on cyber resilience, with a part on SBOMs. What its parts cover and what status it has next to the CRA.
Oct 18, 20263 min read
Compliance
How do you generate a third-party notices file in CI?
Build the notices file from your dependency inventory on every release: collect license texts and NOTICE content, dedupe, review gaps, and ship it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.