SBOM Compliance and Secure CI/CD

IntermediateFree10 modules · 21 lessons · ~55 min

About this course

Learn how to generate and read SBOMs for compliance, manage license risk, work with Safeguard's GRC and VEX capabilities, and shift security left by scanning and gating releases directly inside CI/CD pipelines.

What you'll learn

SBOM Generation and Formats

Generating an SBOM
Reading and Analyzing an SBOM

License Compliance

License Categories and Policy
NOTICE and Attribution

Compliance and GRC

Frameworks, Controls, and Evidence
VEX and Continuous Evidence Mapping

Secure CI/CD (DevSecOps)

Shift Left: Scanning in the Pipeline
Policy Gates That Block Releases

SPDX and CycloneDX, Field by Field

Anatomy of a CycloneDX Document
SPDX, NTIA Minimum Elements, and Choosing a Format

CI/CD Integration Patterns

Wiring Scans into the Pipeline Without Slowing It Down
Gates, Guardrails, and Failing the Right Build

Compliance Automation in Depth

Frameworks, Controls, Evidence, and Continuous Mapping
Regulatory Drivers: EO 14028, CRA, NIS2, DORA

SBOM Operations: Versioning, Diffing, and Distribution

The SBOM Repository: Versions, Tags, Retention, and the Impact Query
Publish vs Share: Portal's Lifecycle and the Audit Trail
Receiving Supplier SBOMs: The TPRM Request Lifecycle

License Compliance in Depth

SPDX License Expressions and the Copyleft Spectrum
License Policy-as-Code, NOTICE Generation, and Remediation

Secrets in the Pipeline

Detecting Secrets: Patterns, Entropy, and Live Verification
Responding to a Detected Secret: Rotation, History Purge, and the Never-Suppress Rule

01SBOM Generation and Formats2 lessons

Generating an SBOM7 min
Reading and Analyzing an SBOM7 min

02License Compliance2 lessons

License Categories and Policy

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

NOTICE and Attribution6 min

03Compliance and GRC2 lessons

Frameworks, Controls, and Evidence7 min
VEX and Continuous Evidence Mapping7 min

04Secure CI/CD (DevSecOps)2 lessons

Shift Left: Scanning in the Pipeline7 min
Policy Gates That Block Releases7 min

05SPDX and CycloneDX, Field by Field2 lessons

Anatomy of a CycloneDX Document
SPDX, NTIA Minimum Elements, and Choosing a Format

06CI/CD Integration Patterns2 lessons

Wiring Scans into the Pipeline Without Slowing It Down
Gates, Guardrails, and Failing the Right Build

07Compliance Automation in Depth2 lessons

Frameworks, Controls, Evidence, and Continuous Mapping
Regulatory Drivers: EO 14028, CRA, NIS2, DORA

08SBOM Operations: Versioning, Diffing, and Distribution3 lessons

The SBOM Repository: Versions, Tags, Retention, and the Impact Query
Publish vs Share: Portal's Lifecycle and the Audit Trail
Receiving Supplier SBOMs: The TPRM Request Lifecycle

09License Compliance in Depth2 lessons

SPDX License Expressions and the Copyleft Spectrum
License Policy-as-Code, NOTICE Generation, and Remediation

10Secrets in the Pipeline2 lessons

Detecting Secrets: Patterns, Entropy, and Live Verification
Responding to a Detected Secret: Rotation, History Purge, and the Never-Suppress Rule

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.