Drafting Compliance

FedRAMP compliance is one of the toughest challenges facing SaaS companies working with the federal government, and in this episode we explore the most common readiness gaps, misconceptions, and cultural shifts organizations must overcome to succeed. Drawing from extensive experience advising technology companies, we discuss why small SaaS firms often struggle with operational maturity, why FedRAM...

Join Kayne and Tom live from San Diego, CA, home of the CCPA, as they sit down with Rob Carson, Founder and CEO of Semper Sec, to unpack what the California Consumer Privacy Act (CCPA) really means for businesses, even outside the Golden State. From Article 9's evolving cybersecurity audit requirements to the tension between ISO standards and California’s growing preference for NIST CSF 2.0, t...

Kayne and Tom talk about an article on the future of auditing with consideration for AI and it’s uses. Along the way, they uncover where organizations should be considering strategic shifts around AI and where they need to exercise caution. Of course we all get to enjoy another face of disgust from an otherwise truly enjoyable beer. Reference documents: https://hyperproof.io/resource/the-future-of...

Kayne and Tom talk about AI and regulatory consequences with a Special guest, and Tom’s brother, Dustin Wilcox, a Fortune 20 CISO with a Global Healthcare company. They knock back a delicious Porter beer and uncover the secrets of AI and regulatory management. A blockbuster of a good time. ▬ Contents of this episode ▬▬▬▬▬▬▬▬▬▬ 0:00 - Intro 0:28 - Beer background 4:40 - The balance between AI usage...

Kayne and Tom talk with Adam Brennick, Director of Security, Risk, and Compliance at Cockroach Labs. Adam dives into the risk assessment process and some of the best practices for building and maturing the risk management lifecycle. Kayne has a surprising score for the beer today and it is marked for future celebrations. Beer: No-Li Squatch Pirate Juicy Haze IPAReference Documents:https://hyperpro...

Kayne and Tom talk about DORA and its applicability. Learn where DORA applies, how you may need to be concerned about DORA even if you think you don’t and why DORA is causing confusion in US companies. Kayne and Tom try an unusual option to drink and we come close on the scoring. Reference Documents:https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2554 https://hyperproof.io/res...

On this episode, we're expanding the show to talk about more than FedRAMP. But before we get to that, I want to mention: we're sitting in the same room in San Diego, in front of a live audience at HyperConnect 2024 , with our special guest Eric Hammersley of Nutanix, and we have some beers. ▬ Contents of this episode ▬▬▬▬▬▬▬▬▬▬ 0:00 - Intro 0:35 - Beer background 3:57 - Frameworks / controls 14:25...

Kayne and Tom talk with Lisa Hall, CISO at Safebase. Recorded from Austin, Texas, they try a flight of local beer! They also take time to discuss Lisa's FedRAMP journey, talking with auditors, and the implications of the CrowdStrike disaster. ▬ Contents of this episode ▬▬▬▬▬▬▬▬▬▬ 0:00 - Intro 0:55 - Beer background 7:00 - Implementing FedRAMP at a Company with an Agency Sponsor 13:07 - Comparing F...

Kayne and Tom talk with Alexander Neff, Lecturer at ASU and Senior Director of InfoSec at Faro Health. Great conversation was had on both Alexander’s FedRAMP experience and his beer choice. Come see Kayne’s highest rated beer! Beer: Lindemans Framboise Reference documents: https://www.fedramp.gov/documents-templates/ The Drafting Compliance series: To lighten the dark corners of compliance, hosts...

Kayne and Tom talk with Victoria Southall, the Director of Cybersecurity, Governance, Risk, and Compliance (GRC) at Everfox. Kayne learns the art of double fisting… or should I say triple fisting, as we try 3 beers in this episode. Results vary, but as always, the tasting brings out the best in Kayne’s facial expressions. Beer: Shock Top Brewing Co. Shock Top, Samuel Adams Summer Ale, Blue Moon Br...

Kayne and Tom talk with Eric Holtzclaw, Field CISO, with Blackcat Security. Eric shepherded the first company through FedRAMP Tailored Li-SaaS. We learn how the very first effort went, and what Eric learned along the way. Dare we say, Eric was a Guinea Pig for the FedRAMP. Of course, we subject Kayne to new beer, and fun was had! Reference documents:   https://www.fedramp.gov/documents-templates/...

Kayne and Tom talk with James Leach, A Principal with Fortreum, a 3PAO. James pulls the covers back on the role 3PAOs plays in the FedRAMP journey. From advice, then assessment and working with the larger FedRAMP ecosystem, James helps us understand where 3PAOs provide value. We try New Belgium, Fat Tire and stand back and watch Kayne react. Good Times!

Special Guest Matthew Feldman joins Kayne and Tom to pull the curtain back on his FedRAMP experiences. Matthew has a wealth of experience and understands the nuances of FedRAMP. Mathew helps understand the importance of best practice when looking through the lens of compliance. Of course, as always, we have beer to review and Kayne has a reaction. Come see the fun!

Tom provides an update on the status of the Hyperproof FedRAMP project. Along the way, Kayne uncovers some of the challenges associated with the project and suggests solutions for others going through the same process. And straight out of left field, Kayne actually likes a beer more than Tom. Come find out what caused this seismic disturbance in the force.

Tom and Kayne uncover the intricacies of the Planning family of requirements in FedRAMP Moderate. Learn about the SSP, Rules of Behavior and Architecture in the planning process. Also, of course, learn about Cigar City Brewing’s Jai Alai IPA, one of Tom’s favorites and Kayne’s… well Kayne is Kayne.

Come and see how Boulevard Brewing rebounds after a poor showing and shines with its Tank 7 American Saison beer. Kayne and Tom talk about the Audit and Accountability family of controls in FedRAMP Moderate. Learn the challenges and technologies leveraged to cope with the many requirements. Maybe you will also learn a little about Saison beer!

Kayne and Tom choke down the very sweet and sticky Boulevard Brewing Co.’s Cinnamon Bun Ale. Along the way they discuss the intricacies of the Risk Assessment family of FedRAMP controls and what challenges it might present. The episode ends with a surprising agreement on the beer and equally surprising desire to cleanse the palate.

Kayne and Tom uncover the nuance of the System and Services Acquisition family of FedRAMP controls. Tune in to hear how FedRAMP has matured how organizations should think about supply chain providers. Tom has a definitive belief on how this family of controls will evolve over time. Of course, a tasty beer is enjoyed by Tom, but you will need to watch to the end to see Kayne’s take on Fresh Squeeze...

Kayne and Tom dive into the System and Information Integrity family of FedRAMP Moderate controls. Find out what challenges Hyperproof has faced with this family of controls and learn some tips to help you in your own FedRAMP journey. A clear outlier shows up in this show’s beer reviews, tune in and hear for yourself.

Kayne and Tom are joined by special guest Michael Chaoui, the Founder of Atlas One Security. Michael pulls the covers back on some of the challenges of companies going through the ATO process. We also discuss recent legislation and draft memos intended to modernize the FedRAMP process, all while enjoying one of Michael’s favorite stout beers.

Kayne and Tom talk about the System and Communications Protection family of FedRAMP Rev5 controls. Learn about the “catch all” approach to this control family and some challenges faced to implementation. Tom and Kayne try a stout for the first time on the show, and Kayne seems to group it with all the other beers. As always, the faces he makes are impressive.

Kayne and Tom talk with Steve Gentry about his FedRAMP experience and the lessons learned. Costs to consider, how to build controls thoughtfully and where you should consider FedRAMP control initiatives in the context of a business discussion. Of course we threw another drink in Kayne’s hands for review. This time it's a fermented drink, not a brewed drink. Welcome to the world of ciders Kayne, a...

Live from Austin, Texas, Kayne and Tom discuss supply chain risk under FedRAMP. They also try a local beer, live on stage, from HyperConnect 2023.

Kayne and Tom talk with Matt Fryer about the cost structures and strategies associated with a Cloud Service Provider (CSP) FedRAMP project. Matt brings a well established perspective and helps understand the challenges of the increased controls focus apparent with FedRAMP. Plus, they try Modelo Especial, a Mexican lager.

Kayne and Tom talk about the FedRAMP Rev4 to Rev5 transition. Learn about key control changes, the shell game that is Rev5 and obviously, the unique flavor profile of a new beer.