Compliance
FCI or CUI: which safeguards apply to a software vendor?
FCI triggers 15 basic safeguards. CUI triggers the larger NIST 800-171 set. Here is how to tell which one your federal contract names and what to do.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Compliance platform lock in: what to export and test before you buy
How to judge lock in with a compliance platform: which data to be able to export, which formats matter, and how to test the exit before you sign.
Oct 18, 20263 min read
Compliance
How should you handle exceptions to an AI coding assistant policy?
A good exception process is short, written, time-limited and visible. Use this request template, approval rules and review cadence for AI tool exceptions.
Oct 18, 20263 min read
Compliance
Exception register or risk register: what is the difference?
A risk register tracks threats you are managing. An exception register tracks approved deviations from a rule. They link, but each needs different fields.
Oct 18, 20263 min read
Compliance
What should the audit trail of a vulnerability exception show?
A good exception audit trail lets someone replay the decision: who asked, who approved, what changed and when. Fields, rules and tamper checks.
Oct 18, 20263 min read
Compliance
What evidence should you request from a healthcare software vendor?
A practical list of documents to ask a health software vendor for, what each one proves, and what it leaves out. Use it to build a vendor evidence pack.
Oct 18, 20263 min read
Compliance
Evidence to keep for AI agent decisions and actions
Auditors, customers and regulators ask what an agent did and who approved it. A short list of records to keep, with retention and privacy notes.
Oct 18, 20263 min read
Compliance
What evidence will an auditor ask for about an AI code review tool?
Auditors want to see the control, who owns it, that it ran on real changes, and what happened to findings. Here is the evidence pack to keep ready.
Oct 18, 20264 min read
Compliance
What the EU Cyber Resilience Act says about SBOMs, clause by clause
The CRA does require manufacturers to draw up an SBOM, but only top-level dependencies at minimum, and not to publish it. The exact clauses and dates.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.