Governance on The Final Hour

Understanding Key Security Indicators (KSIs)

Thu, 23 Jul 2026 06:24:09 +0000

FedRAMP 20X is sort of around the corner, switching from the old approach of framework reliance to the new evidence-based verification method. In plain English, instead of checking the Implemented box on the SSP, you now have to provide machine-readable evidence. There are 46 KSIs, and every one will require persistent evaluation. Start preparing now, because this process will become exponentially more expensive year over year. I have warned people about the inflation for over a decade; I have always been proven right.

What if you don’t care about FedRAMP? If you want/need to be NIST compliant and/or you are taking your security posture seriously, you should start to implement at least a limited set of indicators now, targeting a full implementation by the end of 2027. This method of compliance testing is going to be the norm going forward.

Phase 2 of CMMC delayed. Again.

Thu, 11 Jun 2026 12:24:09 +0000

Is this how Vladimir Putin feels? Expected a 3-day operation, but 5 years later you keep getting bombed?

CMMC Stage 2 has been effectively canceled until further notice, and CMMC AB is on the verge of irrelevance, if not complete collapse.

Fireside chats and refinery bombings will continue until morale improves…

AI is not your friend

Mon, 04 May 2026 16:24:09 +0000

Jer Crane is the founder of PocketOS.

He is also someone who has no idea how LLMs work and should not be allowed near a production environment until he learns.

Instead of focusing on the (many) errors in judgment, I instead look at how basic AI governance would have prevented this comedy of errors.

HOWTO: Teach users to correctly pick a Sensitivity Label

Sat, 11 Apr 2026 20:17:03 +0000

Teaching users how to correctly choose a sensitivity label is one of the most critical parts of any Microsoft Purview implementation.

The labels themselves may be technically configured correctly, but the deployment will still fail if users do not understand how to apply them. First impressions matter. The process needs to feel simple, predictable, and easy to explain, even when the underlying classification model is not always intuitive.

I have always used what I call the Sensitivity/Audience Rule.

3:00AM SOC2 is useless so now what?

Sat, 11 Apr 2026 12:24:09 +0000

It’s 3:00 AM and a client CIO is absolutely raging mad. I can almost feel little bits of spit hitting me through the monitor as she screams into her laptop (they now require face-to-face communications). Vendors are submitting vibe-coded reports that are so uniformly bad that you can easily identify Claude vs. ChatGPT down to the model version.

I know why I am on this call. Why are there 8 other people here?