CISO Stuff

Understanding Key Security Indicators (KSIs)

FedRAMP 20X is sort of around the corner, switching from the old approach of framework reliance to the new evidence-based verification method. In plain English, instead of checking the Implemented box on the SSP, you now have to provide machine-readable evidence. There are 46 KSIs, and every one will require persistent evaluation. Start preparing now, because this process will become exponentially more expensive year over year. I have warned people about the inflation for over a decade; I have always been proven right.

What if you don’t care about FedRAMP? If you want/need to be NIST compliant and/or you are taking your security posture seriously, you should start to implement at least a limited set of indicators now, targeting a full implementation by the end of 2027. This method of compliance testing is going to be the norm going forward.

Do interrupt your enemy when they are making a mistake

Maybe I am the idiot. Maybe this is the perfect moment for OpenAI to take a victory lap around Anthropic and their epic Fable Face Palm. Maybe they read the room and decided the right move is to announce that their system escaped its sandbox and oh btw check out this cool chart showing how sad Fable is! /highfive

Or this is going to backfire…

Phase 2 of CMMC delayed. Again.

Is this how Vladimir Putin feels? Expected a 3-day operation, but 5 years later you keep getting bombed?

CMMC Stage 2 has been effectively canceled until further notice, and CMMC AB is on the verge of irrelevance, if not complete collapse.

Fireside chats and refinery bombings will continue until morale improves…

3:00AM SOC2 is useless so now what?

It’s 3:00 AM and a client CIO is absolutely raging mad. I can almost feel little bits of spit hitting me through the monitor as she screams into her laptop (they now require face-to-face communications). Vendors are submitting vibe-coded reports that are so uniformly bad that you can easily identify Claude vs. ChatGPT down to the model version.

I know why I am on this call. Why are there 8 other people here?