From the Field
Practical guidance on compliance, security, and the tools we build to make both sustainable. Written for the people who have to implement it.
The Free AI Security Lab, and Where It Sits Now
The 36-week AI security lab is still free and still open. What changed is that there is now a published curriculum behind it and a practice in front of it. Here is how the three fit together.
More postsAerospace Suppliers Are Governed by Two Rule Sets That Do Not Agree
A NIST 800-171 environment can be fully compliant and still be an ITAR violation, because the two regimes ask different questions about the same data. Add national security space requirements and you have three overlapping rule sets on one server room.
CMMC Phase 2 Is Suspended. Your Legal Exposure Went Up.
The certification deadline is gone. The obligations are not, and the one government mechanism that used to catch a bad SPRS score before a lawyer did is paused. Here is what defense contractors should actually be working on.
FedRAMP 20x Turns Compliance Into Code
20x is not a version bump. It replaces narrative control descriptions with automated Key Security Indicators, replaces the annual audit with continuous validation, and replaces documents with machine-readable data. Here is what that actually demands of a cloud service provider.
Florida Gave You the Mandate, Vetoed the Safe Harbor, and Just Funded the Fix
Florida is one of the few states that mandates a cybersecurity framework by statute. The alignment deadlines have already passed, the liability safe harbor was vetoed, and as of July 1 there is finally state money on the table. Here is what actually applies to Florida agencies, counties, and cities.
Your FedRAMP Package Has to Be Machine-Readable by September 30
RFC-0024's machine-readable package requirements were confirmed in NTC-0009 and finalized in the Consolidated Rules for 2026, with initial compliance due September 30, 2026. They apply to existing Rev 5 certifications, not just new applicants, and most providers have not started.
Five HIPAA SRA Mistakes That Get Practices Fined
Most security risk assessments fail on the same handful of gaps. We walk through the findings HHS OCR flags most often and how to close them before an audit.
Florida Makers and CMMC: The OT Blind Spot on Your Shop Floor
Your CNC machines, PLCs, and IoT sensors are in scope. The question of whether g-code from a CUI drawing is itself CUI is one of the most contested questions in the CMMC manufacturing world. Here is the defense plan that holds regardless of which reading your assessor brought with them.
CMMC Level 2 for Small Businesses: What Actually Changed
The final rule is live. Here is what small defense contractors need to know about scoping, POA&M timelines, and what assessors are actually looking for.