Compliance

Safeguard.sh is built for enterprise compliance requirements, with FedRAMP HIGH and IL7 certification and comprehensive regulatory support.

Certifications

FedRAMP HIGH

Safeguard.sh holds FedRAMP HIGH authorization:

Continuous monitoring
Annual assessments
Incident response procedures
Security control implementation

IL7 (Impact Level 7)

Approved for Department of Defense use:

Classified information handling
Enhanced security controls
DoD-specific requirements
Continuous authorization

SOC 2 Type II

Third-party audited controls for:

Security
Availability
Confidentiality
Processing Integrity

EO 14028 Support

Executive Order 14028 compliance features:

SBOM Requirements

NTIA minimum elements
SPDX and CycloneDX formats
Automated completeness checking
Compliance scoring

Software Security

Vulnerability disclosure
Secure development practices
Supply chain security
Artifact signing

Safeguard.sh supports compliance with frameworks across the Americas, EU / UK, APAC, and MEA. Lino (our compliance model) maps your environment's evidence to each framework's control catalog continuously.

Americas

Framework	Jurisdiction	Support
NIST SP 800-53 Rev. 5	US Federal	Control mapping, automated evidence collection
NIST Cybersecurity Framework 2.0	US (broad)	Framework alignment dashboards
NIST SSDF (SP 800-218)	US Federal software	Practice-level attestation, SBOM tie-in
FedRAMP HIGH / Moderate / 20x	US Federal cloud	Authorized boundary; continuous monitoring; OSCAL export
DoD IL4 / IL5 / IL7	US Department of Defense	IL7-approved deployment option
CISA Secure Software Development Attestation	US Federal software	Form generation and evidence bundling
CMMC 2.0	US Defense industrial base	Level 1, 2, 3 mapping
EO 14028 SBOM minimum elements	US Federal	Validation and generation
SOX (ITGC)	US public companies	Software-change control evidence
PCI DSS 4.0	Payment industry	Software supply chain controls (section 6)
HIPAA / HITECH	US healthcare	Business associate evidence
HITRUST CSF	US healthcare	Control mapping
LGPD	Brazil	Data protection control mapping
PIPEDA	Canada	Privacy control alignment

European Union & United Kingdom

Framework	Jurisdiction	Support
EU Cyber Resilience Act (CRA)	EU	Essential requirements mapping, SBOM, vulnerability handling, CE marking evidence
NIS2 Directive	EU	Supply chain risk management and incident reporting
Digital Operational Resilience Act (DORA)	EU financial services	ICT third-party risk evidence, register of information
GDPR	EU	Processing activity and sub-processor tracking
eIDAS 2.0	EU	Qualified electronic signature integration for attestations
ENISA Common Criteria Scheme (EUCC)	EU	Evidence assembly for ICT product certification
UK Product Security and Telecommunications Infrastructure Act (PSTI)	UK	Vulnerability disclosure and SBOM support for consumer IoT
UK Cyber Assessment Framework (CAF)	UK critical services	Control mapping and evidence
ISO/IEC 27001:2022	Global / EU-common	Annex A control mapping
ISO/IEC 27036	Global	Supply chain security mapping
ISO/IEC 5230 (OpenChain)	Global	Open-source license compliance program

Asia-Pacific

Framework	Jurisdiction	Support
DPDP Act 2023	India	Data protection impact and processor tracking
CERT-In Directions (2022)	India	Incident reporting, six-hour window workflows
RBI IT Framework for Banks	India financial services	Software supply chain control mapping
Japan Cybersecurity Management Guidelines	Japan	Supply chain clause mapping
Japan Software Security Guidelines (METI)	Japan	SSDF-aligned practice evidence
APRA CPS 234 / CPS 230	Australia financial services	ICT control and supply chain evidence
Australia Essential Eight	Australia	Patch management and application control signals
Singapore MAS TRM Guidelines	Singapore financial services	Third-party risk and software security
Singapore Cybersecurity Act / CCoP 2.0	Singapore critical infrastructure	Control mapping
South Korea K-ISMS / K-ISMS-P	South Korea	ISMS control mapping
Hong Kong HKMA Cybersecurity Fortification Initiative	Hong Kong FS	Control evidence
Taiwan Cybersecurity Management Act	Taiwan	Supply chain risk clauses
China MLPS 2.0 (Multi-Level Protection Scheme)	China	Control mapping (for China-region tenancies only)
China Data Security Law / PIPL	China	Data residency and processor tracking

Middle East & Africa

Framework	Jurisdiction	Support
UAE NESA / SIA IAS	UAE	Control mapping
UAE PDPL	UAE	Data protection mapping
Saudi Arabia NCA ECC	Saudi Arabia	Essential Cybersecurity Controls mapping
Saudi Arabia PDPL	Saudi Arabia	Data protection mapping
POPIA	South Africa	Data protection control mapping
Israel Privacy Protection Regulations	Israel	Data processor evidence

Industry-Specific

Framework	Sector	Support
FDA Premarket Cybersecurity (Section 524B)	Medical devices	SBOM and vulnerability reporting
IEC 62443	Industrial control systems	Supply chain clauses
UNECE WP.29 / ISO 21434	Automotive	Supply chain cybersecurity management
DO-326A / ED-202A	Aviation	Supply chain security evidence
IEC 81001-5-1	Health software	SBOM and lifecycle security evidence
NERC CIP	North American energy	Software integrity and SBOM support
TIBER-EU	EU financial threat-led testing	Detection telemetry mapping

AI-Specific Frameworks

Framework	Jurisdiction	Support
EU AI Act	EU	Model provenance, training data lineage, conformity evidence
NIST AI Risk Management Framework (AI RMF 1.0)	US	Risk register and profile mapping
ISO/IEC 42001 (AI management system)	Global	Control mapping and evidence
Executive Order 14110	US Federal	Dual-use foundation model inventory and reporting