Practitioner-depth analysis across federal and private compliance: FISMA and NIST RMF, FedRAMP, CMMC, federal AI governance, SOC 2, AI governance, cybersecurity, and GRC engineering. Written by a CPA, CISSP, CISA with Big 4 audit experience.
Organization A downloads the HHS Security Risk Assessment Tool, changes the organization name, and answers 40 yes/no questions in two hours. The spreadsheet goes into a shared drive with "FINAL" in the filename. When an...
Read the Guide
How many systems in your organization touch Protected Health Information? Not the ones your IT department provisioned. All of them. The 23 AWS S3 buckets your cloud billing statement reveals. The Salesforce instance storing patient...
Read the Guide
Every AI risk assessment I have reviewed in the last two years shares the same structural flaw. The organization catalogs the AI systems. Lists the vendors. Documents the use cases. Then applies the same risk...
Read the Guide
NIST released CSF 2.0 in February 2024, the first major framework revision in a decade. The update added a sixth function (Govern), expanded applicability beyond critical infrastructure to all organizations, and introduced implementation tiers replacing...
Read the Guide
Organization A resolved 47 security incidents last quarter. The incident log shows detailed timelines, containment actions, root cause analysis, and corrective action status for each one. The SOC 2 auditor reviewed the documentation, confirmed CC7.3...
Read the Guide
Every HIPAA risk assessment I review commits the same fundamental error. The document is titled "Risk Assessment." The content is a checklist. MFA: yes. Encryption: yes. Backup: yes. A series of binary answers telling OCR...
Read the Guide
In 2000, Latanya Sweeney at Carnegie Mellon demonstrated that 87% of the U.S. population becomes uniquely identifiable from three data points: five-digit ZIP code, gender, and date of birth [Sweeney 2000]. She proved it by...
Read the Guide
Three regulatory frameworks converge in 2026 to create the first global standard for governing artificial intelligence. The EU AI Act enters general application August 2, 2026, when GPAI model obligations and most operational provisions become...
Read the Guide
In April 2012, a small cardiology practice in Phoenix paid $100,000 to settle an Office for Civil Rights (OCR) enforcement action targeting network security infrastructure. Phoenix Cardiac Surgery, a five-physician group, was cited for lacking...
Read the Guide
When was the last time a human attacker tested whether your vulnerability scan findings are actually exploitable? Not a scanner running automated checks against a database. A certified ethical hacker chaining vulnerabilities together, testing business...
Read the Guide
Which ChatGPT plan does your organization use? Not the plan the IT department approved. The plan your clinical staff actually uses. The one a medical assistant discovered through a colleague. The one a billing specialist...
Read the Guide
Before the 2013 HIPAA Omnibus Rule, Business Associates operated in a regulatory gray zone. Covered entities signed agreements. Vendors accepted them. HHS had no direct enforcement authority over the vendors themselves. When Advocate Medical Group...
Read the GuideOne compliance analysis per week from Josef Kamara, CPA, CISSP, CISA. Federal and private compliance, written for practitioners.