Compliance
Does a zero-day trigger breach notification duties?
A zero-day alone is not a breach. Notification clocks in GDPR, NIS2 and SEC rules start with a breach or incident. Here is what each says, in plain words.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Does a vendor's SOC 2 report cover its AI features? What to ask
A SOC 2 report covers only the system and period it describes. Ask whether the AI features and model providers are in scope before you rely on it.
Oct 18, 20264 min read
Compliance
Does a change advisory board need to review vulnerability scan results?
A change board should see exceptions, not every result. Let the automated gate pass routine releases and bring waivers and high risk changes to people.
Oct 18, 20263 min read
Compliance
Does the 2023 interagency third-party guidance apply to fintechs?
The June 2023 interagency guidance binds banks, not fintechs directly, but its lifecycle shows what a bank partner will ask you. Here is how to read it.
Oct 18, 20263 min read
Compliance
Do you need an SBOM for SOC 2?
SOC 2 is outcome based and does not name an SBOM as required. An SBOM still helps you show you know what you run. Here is when it earns its place.
Oct 18, 20263 min read
Compliance
Do you need a vulnerability disclosure program to sell to agencies?
I found no rule making a disclosure program a legal condition of every federal sale, but CISA's form, SSDF and guidance all expect one. What to publish.
Oct 18, 20263 min read
Compliance
Do you need a DPA for a code scanner or SCA tool?
A code scanner often handles personal data without anyone planning it: commit emails, test fixtures, logs. Here is how to decide whether a DPA is needed.
Oct 18, 20264 min read
Compliance
Do licenses of transitive dependencies matter for your product?
Yes. Licenses attach to every package you ship, direct or transitive. Learn how to list them, why top level lists mislead, and what to review first.
Oct 18, 20263 min read
Compliance
Do I need a BAA with my vendor's vendors?
A covered entity does not sign agreements with its vendor's subcontractors. The vendor must. See how the chain works and what to ask the vendor to show.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.