Engineering compliance into federal infrastructure. OSCAL, SCAP, STIGs, eMASS, and automated control assessment.
Federal DevSecOps investment has grown to multi-billion-dollar annual outlays over the past decade. Behind those figures sits a compliance gap that program offices have not closed: most agencies treat Development, Security, and Operations (DevSecOps) as...
Read the Guide
Two federal agencies received Authorization to Operate (ATO) packages for similar cloud-hosted applications in the same fiscal year. The first agency ran the standard process: System Security Plan (SSP) drafted over eight months, Information System...
Read the Guide
Federal compliance documentation practice has not changed materially in twenty years: security professionals write System Security Plans (SSPs) by hand, auditors read them by eye, and agencies process authorization packages the same way they processed...
Read the GuideOne compliance analysis per week from Josef Kamara, CPA, CISSP, CISA. Federal and private compliance, written for practitioners.