Compliance
CM-8 component inventory: what an SBOM covers and what it misses
NIST 800-53 control CM-8 asks for an accurate system component inventory. Here is how an SBOM helps, and which parts of CM-8 it cannot satisfy alone.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Claude for Teachers: what the data terms say about student info
Anthropic's Claude for Teachers terms: no training on your inputs, how student data is treated, deletion, and advice on identifiable student info.
Oct 18, 20263 min read
Compliance
Which software did the CISA attestation cover: SaaS, old, open source?
The CISA secure software attestation covered software built after 14 Sept 2022, major new versions and continuously updated SaaS, with four exclusions.
Oct 18, 20263 min read
Compliance
The CISA attestation form: its four practice areas in plain language
What the CISA Secure Software Development Attestation Form asked a supplier to attest to, who signed it, and how each area maps to daily engineering work.
Oct 18, 20264 min read
Compliance
The 18 CIS Controls in plain English, with a sensible order of work
A plain language tour of the 18 CIS Controls in v8 and v8.1, grouped by the question each answers, with a practical order for a small team to start.
Oct 18, 20263 min read
Compliance
CIS Controls v8.1: what changed from v8 and what to do about it
CIS Controls v8.1 is an iterative update to v8. It adds a Govern function, a glossary and revised asset classes. Here is what to change in your mapping.
Oct 18, 20263 min read
Compliance
Can the 18 CIS Controls structure your security questionnaire answers?
The 18 CIS Controls give a startup a plain checklist for organizing evidence. How to map questionnaire sections to them and where the mapping stops.
Oct 18, 20264 min read
Compliance
NERC CIP-015 explained: internal network security monitoring
FERC approved NERC CIP-015-1 in June 2025. What internal network security monitoring covers, who complies first, and how the phased dates work.
Oct 18, 20263 min read
Compliance
CERT-In vulnerability reporting: myth vs fact for engineering teams
Is reporting a vulnerability to CERT-In mandatory? What the FAQ says, what does need reporting in 6 hours, and common misreadings of the directions.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.