FedRAMP 20x is no longer a pilot. It's live. In this video I break down why 20x exists, how it went from announcement to launch in about 18 months, what the new Certification Classes A, B, C and...
Your incident response plan is approved. Your tickets are closed. And you can still fail the assessment, because of one date most teams never check. In this RMF Hands-On episode, we switch to the assessor's seat. I'll show you...
Six weeks. That's how long an attacker had root access to a production database server before anyone noticed. And it was only found by accident, during routine maintenance on a Tuesday night. In this episode of Cyber/GRC Briefs, I...
Tabletop vs. Functional vs. Full-Scale Exercises — NIST SP 800-34 Explained Your contingency plan can look perfect on paper and still fall apart the first time you actually need it. NIST SP 800-34 solves that with three levels of...
When a system goes down, hoping for the best isn't a plan. NIST SP 800-34 is the playbook that tells you who acts, what gets restored first, and how you'll know recovery actually worked — this brief breaks...
FedRAMP Just Killed Low, Moderate & High. Here’s What Replaced Them (20x Explained)
Your IR Plan Is Approved. You Can Still Fail. (NIST 800-53 IR Controls)
Don’t Unplug the Server! How to Respond to a Compromised Database (NIST SP 800-61)
From Talk to Recovery (NIST SP 800-34: Contingency Testing)
NIST SP 800-34 Explained: Contingency Planning, BIA, MTD/RTO/RPO