Kenio Shirley
Kenio Shirley takes regulated cloud platforms through the audits that gate their revenue — FedRAMP authorization, SOC 2, HITRUST, PCI DSS and SOX IT general controls — without freezing the engineering roadmap. He works with companies that have just been told by a customer, an investor or a regulator that they need a certification, and have about six months to get there.
This is his professional reference page. Consulting engagements run through HireKen.io.
You have a deadline and a framework — SOC 2 Type II, HITRUST, PCI DSS. I scope the gap, build the control environment and the evidence pipeline, and get you to a clean report without a six-month engineering freeze.
Audit readiness approachFedRAMP is won or lost on the authorization boundary, then kept or lost on continuous monitoring. I've taken a system through Moderate authorization via an Agency ATO and can tell you which parts of the process actually consume the calendar.
FedRAMP boundary workMost ITGC programs pass once and then decay, because the evidence was assembled by hand. I build controls that produce their own evidence, so year two costs a fraction of year one.
ITGC evidence designAudit failures are rarely technology failures. They are change-record failures: approvals that live in someone’s inbox, deployments nobody can trace back to a ticket, an evidence population the auditor can’t confirm is complete.
The same change record — who authorized it, what was tested, who approved it, what shipped — satisfies four separate control frameworks at once.
One change record
SOC 2
CC8.1
SOX ITGC
Program changes
NIST 800-53
CM-3 · CM-4 · CM-5
ISO 27001:2022
Annex A 8.32
The Department of War paused CMMC Phase II for a 60-day review and half the defense industrial base exhaled. Meanwhile the FAR Council proposed a CUI rule that sweeps in nearly every federal contractor, and DFARS 7012 never went anywhere.
8 min read