Compliance
BSI C5: continuous monitoring after you pass
BSI C5 is an attestation, not a certificate. Monitor between reports with control checks, change records, incident logs and supplier tracking.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
BSI C5 audit prep: the evidence an auditor will ask for
A C5 attestation tests your cloud service controls under ISAE 3000. Map each criterion to a control and to dated evidence, then rehearse the audit.
Oct 18, 20265 min read
Compliance
BSI C5 in 12 weeks: an implementation calendar for cloud providers
A 12 week plan to prepare a cloud service for a BSI C5 examination: pick the version, scope, close gaps, write the system description, brief the auditor.
Oct 18, 20265 min read
Compliance
Answering security questionnaires before your SOC 2 Type 1 arrives
How to answer buyer security questionnaires truthfully while your SOC 2 Type 1 is in progress: wording, evidence to offer, and claims to avoid.
Oct 18, 20265 min read
Compliance
TISAX: what it is and who needs it in the car supply chain
TISAX is the automotive industry's shared information security assessment. Learn who is asked for a label, how the audit runs and what ISA2027 changes.
Oct 18, 20264 min read
Compliance
How do software supply chain controls map to TISAX?
TISAX assesses security against the VDA ISA catalogue. Here is how inventory, build control, supplier checks and patching evidence line up with its topics.
Oct 18, 20264 min read
Compliance
TISAX glossary: assessment levels, labels and ISA explained
A plain glossary of TISAX terms for automotive suppliers: ENX, VDA ISA, labels, assessment levels, scope and participants, and what the results mean.
Oct 18, 20264 min read
Compliance
What should a startup do in its first 90 days for TISAX?
A practical 90 day plan for a first TISAX assessment: register, set scope, self-assess against the ISA catalogue, pick an auditor. Based on ENX guidance.
Oct 18, 20264 min read
Compliance
TISAX: what evidence will an auditor ask for?
TISAX audits start from the ISA catalogue and your defined scope. What the process asks for, how evidence depth varies and how to build an evidence index.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.