Articles on audit readiness, compliance architecture and cloud cost governance, by Kenio Shirley.
· 7 min read
The certificate transfers on day one. The control environment does not. Most post-acquisition compliance failures are not discovered in diligence — they are created in the first quarter of integration.
· 7 min read
Teams prepare for the sample. They almost never prepare for the question that comes first: how do you know this list of changes is all of them? That question is where SOX ITGC and SOC 2 audits actually go wrong.
· 8 min read
The authorization boundary is usually treated as a diagram you produce for the SSP. It is actually the single decision that sets your control count, your continuous monitoring bill and your agency ATO timeline.
· 9 min read
DORA says formal external approval doesn't reduce change failure rates. NIST CM-3 names the change advisory board directly. Both are right, because the frameworks never asked for a meeting — they asked for a record.
Subscribe by RSS.
One email a month on audit readiness, FedRAMP and SOC 2 programs, and IT general controls that survive an auditor. No pitches, unsubscribe any time.