Compliance
ISA/IEC 62443 explained: who is responsible for what
ISA/IEC 62443 is a series of industrial automation security standards that splits duties among asset owners, suppliers, integrators and service providers.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Is SWID still an acceptable SBOM format in 2026?
The 2026 CISA minimum elements no longer mention SWID and tell consumers to accept SPDX or CycloneDX. What that means if you still produce SWID tags.
Oct 18, 20263 min read
Compliance
Is my software company in scope for NIS2?
A step by step scope test for software companies: sector lists in Annexes I and II, the size rule, the size exceptions, and what national law adds.
Oct 18, 20264 min read
Compliance
Is my AI system high-risk? An Annex III checklist
A checklist for testing your AI use against the eight Annex III areas of the EU AI Act, plus the Article 6(1) product safety route and the exemption check.
Oct 18, 20263 min read
Compliance
Is your software company a HIPAA business associate?
A software vendor is a HIPAA business associate if it creates, receives, maintains or transmits PHI on behalf of a covered entity. Use this test to decide.
Oct 18, 20264 min read
Compliance
Is a penetration test required for SOC 2? What auditors expect
SOC 2 does not name a penetration test as mandatory, but auditors and buyers often expect one. Here is how scans and pen tests map to the criteria.
Oct 18, 20263 min read
Compliance
What an IoT vulnerability disclosure policy must say
A disclosure policy for connected products needs a contact, an acknowledgement timeline and a status update timeline. What to publish and common mistakes.
Oct 18, 20263 min read
Compliance
Internet-exposed management interfaces: what CISA BOD 23-02 asks
What CISA's BOD 23-02 asks federal agencies to do about internet-exposed management interfaces, and what private companies can borrow from it.
Oct 18, 20263 min read
Compliance
Internal use vs distribution: when copyleft actually applies
Copyleft obligations mostly start when you give copies to others. Where internal use ends, why contractors and browsers count, and where AGPL differs.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.