Compliance
ETSI EN 303 645 explained: the 13 consumer IoT provisions
ETSI EN 303 645 sets baseline security requirements for consumer IoT in 13 areas, from passwords to data deletion. A plain tour of each and how to use it.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Preparing for an enterprise customer security review: a checklist
How a small vendor can prepare for a large customer's security review: evidence pack, honest answers, SBOM, access controls and a contact who can respond.
Oct 18, 20263 min read
Compliance
The 11 new ISO 27002:2022 controls in plain words
Threat intelligence, cloud services, configuration management, secure coding and seven more: what each new ISO 27002:2022 control asks of a software team.
Oct 18, 20263 min read
Compliance
QWAC and QSealC under PSD2: which certificate identifies a TPP
PSD2 providers identify themselves with eIDAS qualified certificates. What a QWAC and a QSealC are, who chooses, and what the EBA opinion says.
Oct 18, 20263 min read
Compliance
Dual licensed packages: which license do you take and how to record it
A dual licensed package offers a choice of licenses. How to read the OR in an expression, pick one, record the choice and avoid the AND trap.
Oct 18, 20263 min read
Compliance
DPA checklist for LLM API vendors under GDPR Article 28
What a data processing agreement with an LLM API provider must cover under GDPR Article 28, as a checklist you can hold a vendor's terms against.
Oct 18, 20264 min read
Compliance
DORA Article 16: the simplified ICT framework for small firms
DORA Article 16 gives small, non-interconnected entities a simplified ICT risk framework, and Article 4 applies proportionality. Who qualifies.
Oct 18, 20263 min read
Compliance
DORA major incident reporting: the 4, 24 and 72 hour deadlines
DORA's initial notice is due within four hours of classifying an incident as major and 24 hours of awareness, then a 72 hour update and a final report.
Oct 18, 20263 min read
Compliance
DORA exit strategies: planning to leave an ICT provider safely
DORA requires exit strategies for ICT services behind critical or important functions. What the plan must cover, how to test it, and what contracts allow.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.