Senior-practitioner writing on ISO certification, AI governance, privacy, and risk for growing companies.
The DoD suspended CMMC Phase 2 and paused all future milestones pending a 60-day task force review. A suspension is not a repeal. Here is what actually changed, what did not, and why defense contractors should keep their NIST 800-171 programs moving.
The 2025 revision of ISO 27701 modernizes privacy certification and, for the first time, lets you certify without ISO 27001 first. Here is what changed and what to do about it.
AI went from pilot to production in a year at most companies. Governance did not keep pace. Here is where growing companies should start, and how ISO 42001 and the NIST AI RMF fit.
Most companies pursue ISO 27001 because a customer, contract, or lost deal forced the issue. Here is what first-time certification actually involves, phase by phase, and where companies stall.
Not every company needs a full-time CISO, and most cannot hire one quickly. Here is when a virtual CISO is the right call and when you have outgrown it.
The Statement of Applicability ties your risk assessment to your controls. It is the first document an ISO 27001 auditor reads. Here is what it is and how to get it right.
The EU AI Act is not only Europe's problem. It reaches US companies whose AI touches the EU market. Here is who is in scope and how the risk tiers work.
Your team is already using AI. An acceptable use policy sets the guardrails. Here is what a policy that actually holds up includes, and what makes most of them useless.
Every privacy obligation depends on knowing what personal data you hold and where it goes. Data mapping is that foundation. Here is what it is and how to do it well.
Controller or processor is not a technicality. It determines which privacy obligations you carry, what your contracts must say, and what an auditor expects. Here is how to tell.
The System Security Plan and Plan of Action and Milestones are the backbone of NIST 800-171 compliance. Here is what each must contain and where they fall apart.
If you handle Controlled Unclassified Information, your SPRS score is your reported NIST 800-171 posture. Here is how it is calculated and why an honest one matters.
ISO 27001:2022 reorganized the controls and added new ones for cloud, threat intelligence, and more. Here is what changed from the 2013 version and what a transition involves.
Scope is the first real decision in an ISO 27001 project, and the one that most often sinks it. Here is how to set a scope that is defensible, certifiable, and not a burden.