Practitioner-depth analysis across federal and private compliance: FISMA and NIST RMF, FedRAMP, CMMC, federal AI governance, SOC 2, AI governance, cybersecurity, and GRC engineering. Written by a CPA, CISSP, CISA with Big 4 audit experience.
Editor's Note (Updated August 30, 2026): Both of the deadlines in this article have passed. OMB M-25-21 was issued April 3, 2025, so the 180-day AI Strategy and compliance-plan deadline fell on September 30, 2025...
Read the Guide
Updated July 30, 2026: On July 13, 2026 the Department of War suspended CMMC Phase II, which had been scheduled for November 10, 2026. Phase I self-assessment requirements, DFARS 252.204-7012, NIST SP 800-171 Rev 2,...
Read the Guide
The notification arrived on a Tuesday. A Defense Contract Audit Agency (DCAA) auditor was on-site, reviewing overhead pool charges for the prior fiscal year. By Wednesday afternoon, the auditor had flagged $47,000 in entertainment expenses...
Read the Guide
Federal compliance documentation practice has not changed materially in twenty years: security professionals write System Security Plans (SSPs) by hand, auditors read them by eye, and agencies process authorization packages the same way they processed...
Read the Guide
What is your Supplier Performance Risk System (SPRS) score right now? Not the score you submitted. The score that reflects your actual implementation status today, measured against the 110 controls in NIST SP 800-171 Rev...
Read the Guide
The following is an illustrative composite drawn from current CMMC assessment market conditions. Contractor A had 340 workstations, four office locations, a shared IT environment spanning HR, finance, and engineering, and a standard enterprise network...
Read the Guide
FedRAMP has been running essentially the same authorization process for fifteen years. Cloud service providers submit narrative security packages, assessors review documentation, the Program Management Office (PMO) validates controls, and an agency issues an Authorization...
Read the Guide
In 2025, FedRAMP processed more than 100 Rev5 authorizations without a single Open Security Controls Assessment Language (OSCAL) submission, a figure RFC-0024 itself cites in its background section to justify its proposed machine-readable requirements (FedRAMP...
Read the Guide
Every federal agency that failed an authorization review in the past three years has something in common. The finding is rarely about a missing firewall rule or an unpatched server. The finding is about a...
Read the Guide
Two defense contractors received the same Cybersecurity Maturity Model Certification (CMMC) Level 2 notice in Q1 2026. The first pulled up NIST SP 800-171 Rev 2, confirmed their 110-control gap analysis, and started booking Certified...
Read the Guide
The EU AI Act covers 450 million people and governs every organization that deploys AI systems touching EU residents. Most compliance teams know about the high-risk system obligations, the conformity assessments, the technical documentation requirements....
Read the Guide
The QSA flagged it on day two of the on-site assessment. A payment page was loading three JavaScript files from external CDNs that had no inventory entry, no integrity hash, and no authorization record. The...
Read the GuideOne compliance analysis per week from Josef Kamara, CPA, CISSP, CISA. Federal and private compliance, written for practitioners.