Notes on modern GRC.
Published on LinkedIn, a few times a month. No introductions, no hashtags.
- 2025
The RMF, task by task
A free guide through all of NIST 800-37, Prepare to Monitor, for the engineers who have to build for it.
→ - cATO
Continuous authorization in practice
Replacing the point-in-time package with signal an Authorizing Official will trust.
- Policy-as-Code
Policy-as-Code for federal teams
Control IDs in metadata, evidence as a side effect, tests that fail on purpose.
- Careers
The analyst-to-engineer transition
How to become a GRC engineer without pretending to be a software engineer.
- Risk
Right-sizing controls
Checkbox compliance fails twice. Risk-based scoping is the conversation that earns the seat.
A dated archive of selected posts is on its way. Until then, the writing lives on LinkedIn.