Compliance
How to define your ISMS scope for ISO 27001
Define your ISO 27001 scope from issues, interested parties and interfaces, not from office locations. A five step method with cloud and laptop examples.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
CycloneDX license data: id, name or expression?
CycloneDX records licenses as SPDX ids, free text names or a single SPDX expression. When to use each and what the declared or concluded flag does.
Oct 18, 20263 min read
Compliance
Medical device cybersecurity labeling: what to tell users
FDA suggests labeling that covers ports, secure configuration, SBOM access, logging, end of support and decommissioning. A checklist for device teams.
Oct 18, 20263 min read
Compliance
Cyber Resilience Act dates for device and robot makers
The EU Cyber Resilience Act applies in stages: June 2026, September 2026 and December 2027. What the dates mean for connected device and robot makers.
Oct 18, 20263 min read
Compliance
Preparing for a cyber insurance application as a CISO
Cyber insurance applications ask detailed control questions. Here is how to prepare accurate answers, gather evidence and avoid misstatements.
Oct 18, 20263 min read
Compliance
What a CSMS is and what auditors look for under UN R155
A cybersecurity management system under UN R155 is a set of processes, not a product. See its core elements and the evidence a team should prepare.
Oct 18, 20263 min read
Compliance
Can you license software under Creative Commons?
Creative Commons recommends against using its licenses for software. Here is why, and where CC licenses do fit in a software project, such as docs and art.
Oct 18, 20263 min read
Compliance
Copyleft risk in an acquisition: what buyers check about GPL code
Why buyers scan for GPL and AGPL code in a target's product, what linking and distribution change, and how sellers can document where copyleft sits.
Oct 18, 20263 min read
Compliance
COPPA six steps for youth programs, school sites and apps
The FTC's six step COPPA plan in plain words for programs that collect data from children under 13: coverage, notice, consent, rights and data security.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.