Compliance
SSDF version history: white paper 1.0 to SP 800-218 version 1.1
NIST's SSDF began as a white paper (v1.0) and became SP 800-218 v1.1. Here are the four practice groups and the link to Executive Order 14028.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
The four SSDF practice groups, explained for AppSec program leads
NIST SSDF groups practices into Prepare the Organization, Protect the Software, Produce Well-Secured Software and Respond to Vulnerabilities. See how.
Oct 18, 20263 min read
Compliance
SPDX OR versus AND: reading dual license expressions
OR means you pick one license, AND means you must meet both. Here is how to read SPDX expressions such as MIT OR Apache-2.0 on a package you depend on.
Oct 18, 20263 min read
Compliance
Declared license vs concluded license in an SPDX SBOM
SPDX keeps three license fields per package. What declared, concluded and files-detected licenses each mean, and which one to trust in a review.
Oct 18, 20263 min read
Compliance
SPDX declared license versus concluded license: what is the difference?
Declared license is what the package authors state. Concluded license is what the SBOM creator decides applies. Why they can differ and how to explain it.
Oct 18, 20263 min read
Compliance
SOC 2 vendor management evidence: what auditors ask to see
What evidence shows you manage your own vendors for SOC 2: an inventory, risk tiers, reviewed reports, contracts and a yearly review with decisions.
Oct 18, 20263 min read
Compliance
How to write your SOC 2 system description yourself
The system description is the section your company writes, not the auditor. Here is what it should cover and how to draft it from facts you already have.
Oct 18, 20263 min read
Compliance
Presenting SOC 2 status to a buyer or investor without overclaiming
How to describe your SOC 2 status in diligence: complete, in progress or not started, with wording that stays accurate and evidence that supports it.
Oct 18, 20263 min read
Compliance
SOC 2 security awareness training: what to run and what to keep
A short annual training plus onboarding training, with completion records and a phishing check, covers most SOC 2 expectations. Here is a lean setup.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.