https://waypointca.com/blog/tags/compliance/Recent content in Compliance onHugoen-usTue, 11 Aug 2026 00:00:00 +0000https://waypointca.com/blog/posts/cmmc-phase-2-suspended-self-reporting-risk/Tue, 11 Aug 2026 00:00:00 +0000https://waypointca.com/blog/posts/cmmc-phase-2-suspended-self-reporting-risk/The certification deadline is gone. The obligations are not, and the one government mechanism that used to catch a bad SPRS score before a lawyer did is paused. Here is what defense contractors should actually be working on.https://waypointca.com/blog/posts/fedramp-20x-compliance-becomes-code/Tue, 11 Aug 2026 00:00:00 +0000https://waypointca.com/blog/posts/fedramp-20x-compliance-becomes-code/20x is not a version bump. It replaces narrative control descriptions with automated Key Security Indicators, replaces the annual audit with continuous validation, and replaces documents with machine-readable data. Here is what that actually demands of a cloud service provider.https://waypointca.com/blog/posts/florida-cybersecurity-mandates-no-safe-harbor/Tue, 11 Aug 2026 00:00:00 +0000https://waypointca.com/blog/posts/florida-cybersecurity-mandates-no-safe-harbor/Florida is one of the few states that mandates a cybersecurity framework by statute. The alignment deadlines have already passed, the liability safe harbor was vetoed, and as of July 1 there is finally state money on the table. Here is what actually applies to Florida agencies, counties, and cities.https://waypointca.com/blog/posts/fedramp-machine-readable-september-30-deadline/Tue, 11 Aug 2026 00:00:00 +0000https://waypointca.com/blog/posts/fedramp-machine-readable-september-30-deadline/RFC-0024’s machine-readable package requirements were confirmed in NTC-0009 and finalized in the Consolidated Rules for 2026, with initial compliance due September 30, 2026. They apply to existing Rev 5 certifications, not just new applicants, and most providers have not started.https://waypointca.com/blog/posts/hipaa-sra-mistakes/Tue, 14 Apr 2026 00:00:00 +0000https://waypointca.com/blog/posts/hipaa-sra-mistakes/Most security risk assessments fail on the same handful of gaps. We walk through the findings HHS OCR flags most often and how to close them before an audit.https://waypointca.com/blog/posts/cmmc-level-2-small-business/Sat, 14 Mar 2026 00:00:00 +0000https://waypointca.com/blog/posts/cmmc-level-2-small-business/The final rule is live. Here is what small defense contractors need to know about scoping, POA&M timelines, and what assessors are actually looking for.