What changed
A new guide lays out a 90-day software supply-chain security program for B2B SaaS companies. It focuses on tracking open-source packages, base images, CI actions, infrastructure code, shipped SDKs and agents, AI components, and customer-connected OAuth integrations.
The guide says reporting duties under Article 14 of the EU Cyber Resilience Act began on 11 September 2026. Most of the Act’s remaining requirements are due to apply on 11 December 2027.
Why it matters
For SaaS companies, supply-chain security is becoming a sales requirement before it becomes a regulatory headache. Enterprise customers may want an SBOM, vulnerability-tracking evidence and a SOC 2 Type II report before signing. When a widely used package or CI action is compromised, the same inventory must answer a blunt question quickly: are we affected?
That changes the job from running scanners to maintaining a dependable map of what reaches customers and production. The pressure comes from three directions:
- customer contracts and security questionnaires;
- SOC 2 evidence requests covering changes, scans and vendor assessments;
- EU rules affecting digital products and their remote data-processing components.
The practical challenge is breadth. A package manifest alone will miss build actions, runners, images, integrations and software a company ships for customers to run themselves. A credible 90-day effort therefore has to connect inventory, build controls, vulnerability response and evidence that an auditor or customer can actually read.
The guide also describes Safeguard’s own capabilities, including SBOM generation, dependency analysis, policy gates, compliance tools and a portal for sharing evidence. Its autonomous remediation is disabled by default, with categories set to manual. That makes the document useful as a checklist, but its claims about the program’s security outcomes remain untested here.
Comments
No comments yet.