Compliance
CERT-In 6 hour incident reporting: what to send and when
The CERT-In directions set a 6 hour window to report listed cyber incidents. What starts the clock, what counts, and what to send if details are missing.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
CERT-In clock sync rule: NTP settings for cloud teams
The CERT-In directions ask you to sync ICT clocks to NIC or NPL time. The FAQ explains what cloud teams can keep using and which servers to point at.
Oct 18, 20263 min read
Compliance
Do the CERT-In directions apply to a foreign SaaS company?
Who the 2022 CERT-In directions cover, what the FAQ says about overseas firms serving Indian users, and what a foreign SaaS team should plan for.
Oct 18, 20263 min read
Compliance
CERT-In 180 day log retention: what to log and where to keep it
CERT-In says to enable logs on all ICT systems and keep them 180 days in India. What the FAQ says about location, scope and which logs to keep.
Oct 18, 20263 min read
Compliance
CER Directive vs NIS2: physical resilience and cyber resilience
NIS2 covers cybersecurity, the CER Directive covers non-cyber threats to critical entities. How they differ, overlap and what the dates are.
Oct 18, 20263 min read
Compliance
How do I write a license allow list for Rust crates?
Build a cargo deny license policy: an SPDX allow list, per-crate exceptions, clarify entries for unclear files, and how private crates are treated.
Oct 18, 20263 min read
Compliance
Can you ship an open font in a commercial app (SIL OFL)?
Under the SIL Open Font License 1.1 you can bundle and embed a font with software, but not sell it alone, and each copy must carry the license.
Oct 18, 20263 min read
Compliance
Can you train on a dataset that has no license?
A missing license does not mean free to use. What a no license default means, why it is a risk for training data, and how to record and resolve it.
Oct 18, 20263 min read
Compliance
Can the person who triggered a fix PR also approve it?
Separation of duties says the one who makes a change should not be the sole approver. How to apply it to bot opened fix PRs with branch protection rules.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.