The Audit Defense Library exists to close one gap: between the rigid wording of compliance frameworks and what practitioners actually need to ship Monday morning. Compliance professionals should not have to pay a consultant to understand FedRAMP, CMMC, NIST 800-53, SOC 2, or the EU AI Act at clause level. The library is the textbook, published in public, written from inside the practice, and cited at the specific subsection so a reader can verify every claim against primary source.
Active production, ordered by where the practice is investing today.
Every article in the Audit Defense Library is verified against primary source, cited at subsection level, and built for the engineer or analyst who has to act on it.
I have spent 10+ years in technology risk and IT audit. At BDO I led 30+ SOC 1, SOC 2 and SOC 3 engagements from planning to final report, and ran SOC readiness assessments. At Stryker I owned the U.S. SOX IT general controls program and worked directly with the external auditor. Today I focus on GRC engineering, meaning automated evidence collection and control testing for cloud environments. In 2024 I launched The Audit Defense Library to publish the practitioner-level analysis I wanted earlier in my own career.
One compliance analysis per week from Josef Kamara, CPA, CISSP, CISA. Federal and private compliance, written for practitioners.