Compliance
CIRCIA incident reporting: what is required now and what is not
CIRCIA's 72 hour incident and 24 hour ransom payment reports are not yet mandatory. What CISA says about the rule's status and how to prepare.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
CIRCIA incident reporting: 72 hours, 24 hours, and where the rule stands
CIRCIA will require covered entities to report cyber incidents in 72 hours and ransom payments in 24. The final rule is not out yet. What to do now.
Oct 18, 20263 min read
Compliance
How to check a vendor under the EU US Data Privacy Framework
Relying on the EU US Data Privacy Framework for a US vendor? What to verify, what to record, and why the pending Court of Justice appeal calls for a fallback.
Oct 18, 20263 min read
Compliance
How to check a supplier SBOM against the minimum elements
Received an SBOM from a supplier? Check the seven NTIA data fields, the depth, and the known unknowns before you trust it. A field by field review.
Oct 18, 20263 min read
Compliance
How to check a vendor's ISO 27001 certificate: scope and SoA
An ISO 27001 certificate only helps if it covers your service. Check the legal entity, scope, dates, certification body and Statement of Applicability.
Oct 18, 20263 min read
Compliance
What a change management policy should include
A change management policy defines which changes need control, who approves, how impact is checked, and what records you keep. Here is the outline.
Oct 18, 20263 min read
Compliance
Change management evidence from pull requests: what to show
Pull requests can serve as change management evidence if they show review, approval, tests and a link to deployment. How to set that up and sample it.
Oct 18, 20263 min read
Compliance
California's new privacy rules: audits, risk assessments, ADMT dates
California finalized CCPA rules on cybersecurity audits, risk assessments and ADMT. Effective 1 January 2026, with phased deadlines running to 2030.
Oct 18, 20263 min read
Compliance
CC0 for code: public domain dedication versus a license
CC0 is a public domain dedication, not a license. Creative Commons says it is acceptable for software. Here is what that means for authors and users.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.