Compliance
OFAC and ransom payments: the sanctions risk explained
OFAC's advisory says ransom payments can break US sanctions rules even when the payer did not know. Liability, who is affected and the mitigating factors.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
NYDFS Part 500.17: 72 hour notice and extortion payment reports
New York's 23 NYCRR 500.17 requires 72 hour incident notice, a 24 hour notice of extortion payments, and an April 15 annual filing. What each one needs.
Oct 18, 20263 min read
Compliance
NOASSERTION vs NONE in SBOM license fields
NOASSERTION means no claim was made. NONE means a positive claim that no license applies. Why mixing them up creates false comfort in license reports.
Oct 18, 20263 min read
Compliance
NIST SP 800-66 Rev. 2: how to use it for the HIPAA Security Rule
NIST SP 800-66 Rev. 2 is practical HIPAA Security Rule guidance. Learn what it maps to, who it is for and a simple way to use it in a risk program.
Oct 18, 20262 min read
Compliance
NIST SP 800-61 Rev. 3: what changed from the 2012 version
NIST SP 800-61 Rev. 3 replaced the 2012 incident handling guide in April 2025 as a CSF 2.0 Community Profile. What that means for your own plan.
Oct 18, 20263 min read
Compliance
NIST SP 800-61 Rev. 3: what changed for incident response
NIST SP 800-61 Rev. 3, final in April 2025, reframes incident response as part of CSF 2.0 risk management and replaces the 2012 guide. What that means.
Oct 18, 20263 min read
Compliance
NIST SP 800-61 Rev. 3: what it is and where AI fits
NIST SP 800-61 Rev. 3 ties incident response to the CSF 2.0. A short guide to what changed from Rev. 2 and where AI assistants can safely help responders.
Oct 18, 20263 min read
Compliance
NIST SP 800-172 Rev. 3: who it applies to and who it does not
SP 800-172 Rev. 3 adds enhanced CUI protections against APTs. Learn its scope, how it relates to SP 800-171, and when a contract brings it in.
Oct 18, 20263 min read
Compliance
NIST password rules in plain language: length, rotation, blocklists
Myth versus fact on password policy: what NIST SP 800-63B-4 says about length, complexity rules, forced rotation and blocklists, with exact limits.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.