Kenio Shirley
Kenio Shirley takes regulated cloud platforms through the audits that gate their revenue — FedRAMP authorization, SOC 2, HITRUST, PCI DSS and SOX IT general controls — without freezing the engineering roadmap. He works with companies that have just been told by a customer, an investor or a regulator that they need a certification, and have about six months to get there.
This is his professional reference page. Consulting engagements run through HireKen.io.
You have a deadline and a framework — SOC 2 Type II, HITRUST, PCI DSS. I scope the gap, build the control environment and the evidence pipeline, and get you to a clean report without a six-month engineering freeze.
Audit readiness approachFedRAMP is won or lost on the authorization boundary, then kept or lost on continuous monitoring. I've taken a system through Moderate authorization via an Agency ATO and can tell you which parts of the process actually consume the calendar.
FedRAMP boundary workMost ITGC programs pass once and then decay, because the evidence was assembled by hand. I build controls that produce their own evidence, so year two costs a fraction of year one.
ITGC evidence designAudit failures are rarely technology failures. They are change-record failures: approvals that live in someone’s inbox, deployments nobody can trace back to a ticket, an evidence population the auditor can’t confirm is complete.
The same change record — who authorized it, what was tested, who approved it, what shipped — satisfies four separate control frameworks at once.
One change record
SOC 2
CC8.1
SOX ITGC
Program changes
NIST 800-53
CM-3 · CM-4 · CM-5
ISO 27001:2022
Annex A 8.32
Schleswig-Holstein, Denmark, Austria's armed forces and the French Gendarmerie are all moving public-sector desktops to open platforms. The licence savings are real and mostly beside the point. What changes is the quality of the evidence you can put in front of an auditor.
8 min read