Compliance
FedRAMP HIGH, IL7, EO 14028, and regulatory compliance
Compliance
Safeguard.sh is built for enterprise compliance requirements, with FedRAMP HIGH and IL7 certification and comprehensive regulatory support.
Coverage at a glance
Safeguard ships a Vanta/Drata-class GRC experience: 197 compliance frameworks worldwide and 394 integrations that collect evidence automatically.
| Coverage | |
|---|---|
| Compliance frameworks | 197 across 6 regions |
| Integrations / connectors | 394 across 28 categories |
| Ways to connect | 3 — OAuth consent, API token / PAT, or MCP server |
| Deep evidence collectors | 9 (GitHub, Okta, GitLab, Slack, Google Workspace, Datadog, AWS, Azure, GCP) |
| Policies | 22+ baseline templates per framework, plus custom |
Frameworks by region: Americas 70 · International 41 · Europe 28 · Asia-Pacific 28 · Middle East & Africa 19 · Internal/baseline 11.
Every framework is scored after each assessment, with per-control and per-requirement drill-down. After a run, the compliance pipeline generates — for real — the scored record, controls, control tests, requirement evidence, policy evaluations, and connector evidence (from connected integrations). The full regulatory framework list by region is below; connector coverage is detailed on the Connectors page.
Certifications
FedRAMP HIGH
Safeguard.sh holds FedRAMP HIGH authorization:
- Continuous monitoring
- Annual assessments
- Incident response procedures
- Security control implementation
IL7 (Impact Level 7)
Approved for Department of Defense use:
- Classified information handling
- Enhanced security controls
- DoD-specific requirements
- Continuous authorization
SOC 2 Type II
Third-party audited controls for:
- Security
- Availability
- Confidentiality
- Processing Integrity
EO 14028 Support
Executive Order 14028 compliance features:
SBOM Requirements
- NTIA minimum elements
- SPDX and CycloneDX formats
- Automated completeness checking
- Compliance scoring
Software Security
- Vulnerability disclosure
- Secure development practices
- Supply chain security
- Artifact signing
Regulatory Frameworks
Safeguard.sh supports compliance with frameworks across the Americas, EU / UK, APAC, and MEA. Lino (our compliance model) maps your environment's evidence to each framework's control catalog continuously.
Americas
| Framework | Jurisdiction | Support |
|---|---|---|
| NIST SP 800-53 Rev. 5 | US Federal | Control mapping, automated evidence collection |
| NIST Cybersecurity Framework 2.0 | US (broad) | Framework alignment dashboards |
| NIST SSDF (SP 800-218) | US Federal software | Practice-level attestation, SBOM tie-in |
| FedRAMP HIGH / Moderate / 20x | US Federal cloud | Authorized boundary; continuous monitoring; OSCAL export |
| DoD IL4 / IL5 / IL7 | US Department of Defense | IL7-approved deployment option |
| CISA Secure Software Development Attestation | US Federal software | Form generation and evidence bundling |
| CMMC 2.0 | US Defense industrial base | Level 1, 2, 3 mapping |
| EO 14028 SBOM minimum elements | US Federal | Validation and generation |
| SOX (ITGC) | US public companies | Software-change control evidence |
| PCI DSS 4.0 | Payment industry | Software supply chain controls (section 6) |
| HIPAA / HITECH | US healthcare | Business associate evidence |
| HITRUST CSF | US healthcare | Control mapping |
| LGPD | Brazil | Data protection control mapping |
| PIPEDA | Canada | Privacy control alignment |
European Union & United Kingdom
| Framework | Jurisdiction | Support |
|---|---|---|
| EU Cyber Resilience Act (CRA) | EU | Essential requirements mapping, SBOM, vulnerability handling, CE marking evidence |
| NIS2 Directive | EU | Supply chain risk management and incident reporting |
| Digital Operational Resilience Act (DORA) | EU financial services | ICT third-party risk evidence, register of information |
| GDPR | EU | Processing activity and sub-processor tracking |
| eIDAS 2.0 | EU | Qualified electronic signature integration for attestations |
| ENISA Common Criteria Scheme (EUCC) | EU | Evidence assembly for ICT product certification |
| UK Product Security and Telecommunications Infrastructure Act (PSTI) | UK | Vulnerability disclosure and SBOM support for consumer IoT |
| UK Cyber Assessment Framework (CAF) | UK critical services | Control mapping and evidence |
| ISO/IEC 27001:2022 | Global / EU-common | Annex A control mapping |
| ISO/IEC 27036 | Global | Supply chain security mapping |
| ISO/IEC 5230 (OpenChain) | Global | Open-source license compliance program |
Asia-Pacific
| Framework | Jurisdiction | Support |
|---|---|---|
| DPDP Act 2023 | India | Data protection impact and processor tracking |
| CERT-In Directions (2022) | India | Incident reporting, six-hour window workflows |
| RBI IT Framework for Banks | India financial services | Software supply chain control mapping |
| Japan Cybersecurity Management Guidelines | Japan | Supply chain clause mapping |
| Japan Software Security Guidelines (METI) | Japan | SSDF-aligned practice evidence |
| APRA CPS 234 / CPS 230 | Australia financial services | ICT control and supply chain evidence |
| Australia Essential Eight | Australia | Patch management and application control signals |
| Singapore MAS TRM Guidelines | Singapore financial services | Third-party risk and software security |
| Singapore Cybersecurity Act / CCoP 2.0 | Singapore critical infrastructure | Control mapping |
| South Korea K-ISMS / K-ISMS-P | South Korea | ISMS control mapping |
| Hong Kong HKMA Cybersecurity Fortification Initiative | Hong Kong FS | Control evidence |
| Taiwan Cybersecurity Management Act | Taiwan | Supply chain risk clauses |
| China MLPS 2.0 (Multi-Level Protection Scheme) | China | Control mapping (for China-region tenancies only) |
| China Data Security Law / PIPL | China | Data residency and processor tracking |
Middle East & Africa
| Framework | Jurisdiction | Support |
|---|---|---|
| UAE NESA / SIA IAS | UAE | Control mapping |
| UAE PDPL | UAE | Data protection mapping |
| Saudi Arabia NCA ECC | Saudi Arabia | Essential Cybersecurity Controls mapping |
| Saudi Arabia PDPL | Saudi Arabia | Data protection mapping |
| POPIA | South Africa | Data protection control mapping |
| Israel Privacy Protection Regulations | Israel | Data processor evidence |
Industry-Specific
| Framework | Sector | Support |
|---|---|---|
| FDA Premarket Cybersecurity (Section 524B) | Medical devices | SBOM and vulnerability reporting |
| IEC 62443 | Industrial control systems | Supply chain clauses |
| UNECE WP.29 / ISO 21434 | Automotive | Supply chain cybersecurity management |
| DO-326A / ED-202A | Aviation | Supply chain security evidence |
| IEC 81001-5-1 | Health software | SBOM and lifecycle security evidence |
| NERC CIP | North American energy | Software integrity and SBOM support |
| TIBER-EU | EU financial threat-led testing | Detection telemetry mapping |
AI-Specific Frameworks
| Framework | Jurisdiction | Support |
|---|---|---|
| EU AI Act | EU | Model provenance, training data lineage, conformity evidence |
| NIST AI Risk Management Framework (AI RMF 1.0) | US | Risk register and profile mapping |
| ISO/IEC 42001 (AI management system) | Global | Control mapping and evidence |
| Executive Order 14110 | US Federal | Dual-use foundation model inventory and reporting |
Compliance Reports
Generate compliance documentation:
Pre-Built Reports
- FedRAMP POA&M support
- EO 14028 compliance report
- SBOM completeness audit
- Vulnerability summary
Custom Reports
Create reports for specific requirements:
- Navigate to Reports
- Click Create Report
- Select compliance framework
- Configure scope and date range
- Generate and export
Data Residency
Deployment options for data residency:
- US Cloud - US data centers only
- EU Cloud - EU data centers only
- On-Premises - Your infrastructure
- Air-Gapped - Disconnected environments
Security Architecture
Multi-Tenant Isolation
- Complete tenant separation
- Dedicated encryption keys
- Isolated compute resources
- Network segmentation
Encryption
- TLS 1.3 in transit
- AES-256 at rest
- Customer-managed keys option
- Hardware security modules
Access Control
- Role-based access (RBAC)
- Single Sign-On (SSO)
- Multi-factor authentication
- API key management
Audit Support
Supporting your audits:
- Complete audit trails
- Evidence collection
- Assessor access (read-only)
- Documentation packages