Compliance
What should a release gate override log record?
An override log should capture who, when, what finding, why, which artifact and when it expires, in an append-only record linked to the release.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedCompliance
Questions to ask about exceptions and risk acceptance in a tool
Every program accepts some risk. Check how a tool records exceptions: owner, reason, expiry, review and audit trail, and what happens when they lapse.
Oct 18, 20263 min read
Compliance
How old can vendor security evidence be before it stops counting?
Vendor evidence goes stale. Here is how to treat audit reports, test summaries, certificates and questionnaires by age, and what to ask when one is old.
Oct 18, 20263 min read
Compliance
UK Cyber Security and Resilience Bill: what it is and what it changes
A short guide to the UK Cyber Security and Resilience Bill: the law it updates, the services it aims to protect, and what to check on its current status.
Oct 18, 20263 min read
Compliance
UAE data protection and sector localisation rules: what to check
The UAE has a federal PDPL plus free zone regimes and sector rules that can require local storage. What software teams should verify before launching.
Oct 18, 20263 min read
Compliance
Outsourcing due diligence and fourth parties: the TSB final notice
The FCA said TSB did not formally assess its main IT supplier and lacked sight of 85 fourth parties. What a supplier readiness review should cover.
Oct 18, 20263 min read
Compliance
TSA freight rail directive 1580-21-01: the four requirements
The first TSA cybersecurity directive for higher-risk freight railroads asked for four things. What they were and why the directive matters for rail IT.
Oct 18, 20263 min read
Compliance
Transportation sector: seven modes and their cyber rules
CISA splits transportation into seven modes. Which two have sourced cyber rules, how reporting differs by mode and how to plan across several.
Oct 18, 20263 min read
Compliance
TISAX labels: validity, scope and how results are shared with partners
TISAX results come as labels valid for three years, shared through the ENX Portal rather than published. How scope, objectives and sharing work.
Oct 18, 20262 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.