Senior-practitioner writing on ISO certification, AI governance, privacy, and risk for growing companies.
The DoD suspended CMMC Phase 2 and paused all future milestones pending a 60-day task force review. A suspension is not a repeal. Here is what actually changed, what did not, and why defense contractors should keep their NIST 800-171 programs moving.
The 2025 revision of ISO 27701 modernizes privacy certification and, for the first time, lets you certify without ISO 27001 first. Here is what changed and what to do about it.
AI went from pilot to production in a year at most companies. Governance did not keep pace. Here is where growing companies should start, and how ISO 42001 and the NIST AI RMF fit.
Most companies pursue ISO 27001 because a customer, contract, or lost deal forced the issue. Here is what first-time certification actually involves, phase by phase, and where companies stall.