Dependency Age

Flags components older than 2 years (stale) or 4 years (very old).


Short name	Age
Region	Internal
Country or scope	Internal
Sector	Supply Chain
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers Age

Scan requirements: 1, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for Age.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for Age and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these requirement against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`AGE-1` Dependency Freshness	All components should have recent release dates	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`AGE-01`	Stale Component Threshold: 2 Years
`AGE-02`	Critical Age Threshold: 4 Years
`AGE-03`	Abandoned Project Detection
`AGE-04`	End-of-Life (EOL) Tracking
`AGE-05`	Major Version Lag
`AGE-06`	Release Cadence Monitoring
`AGE-07`	Dependency Age Reporting

Policy templates

Written for Age:

Dependency Lifecycle and Stale Component Remediation Policy
Dependency Age Governance and Upgrade Planning Policy
End-of-Life Software Tracking and Decommissioning Policy

And 22 from the standard set, adapted to Age.