Drafting Compliance

Kayne and Tom talk about the domain under FedRAMP moderate, providing both an overview of the domain as well as specific examples of controls, and real-world scenarios for the use of those controls.

They also come close to agreeing about “Color Cloud Pink”, a Berliner Weisse with “Pink Guava, Dragon Fruit, and Passion Fruit” by Equilibrium Brewery of Middletown, New York.

Kayne and Tom talk about the Contingency Planning domain under FedRAMP moderate, comparing it against the best practice of Business Continuity Planning, and providing specific guidance for key elements of a successful contingency plan. They also find what amounts to near common ground on this episodes beer tasting, Laughing Lab Scottish Ale.

Kayne and Tom talk about the Maintenance domain under FedRAMP moderate, including how it is related to the Configuration Management domain. They also nearly agree on Rogue’s Hazelnut Brown Nectar, although Kayne still likens it to old hotel coffee while Tom will drink a free one.

Kayne and Tom talk about the requirements of continuous compliance under the Security Assessment and Authorization family of controls, including key considerations for continuous monitoring and reauthorization. During the episode, they explore yet another fruit-forward beer, Deschutes’ Farmstand Fresh Mango IPA.

Kayne and Tom talk about recent challenges caused by two vendors in our software supply chain not achieving FedRAMP Moderate in 2023. While discussing their path forward, they sample the New Belgium Voodoo Ranger Juice Force IPA.

Kayne and Tom talk about the major pillars of Configuration Management. While digging into inventory management, baseline configurations, configuration drift, and risk, they tackle Bell’s Two Hearted American IPA.

Kayne and Tom uncover the different approach to the Physical and Environmental controls, with a discussion of all-cloud, on prem and hybrid scenarios. Of course, they tackle a new beer as well, maybe Kayne will like this one, and maybe Tom will not… I think you already know!

Kayne and Tom talk about the joys of security awareness training, managing training, and the different types of security and privacy training you should consider, and as always, beer. This episode’s beer is Sierra Nevada Hazy Little Thing IPA.

Kayne and Tom tackle the interesting nuances of both beer and FedRAMP. Does a beer consumed by CISOs need to also be FedRAMP compliant? Come find out.

In this episode, Kayne and Tom talk about the nuances of the Incident Response family of FedRAMP controls, some of the required documentation, testing, and beer. This episode’s beer is Woods Boss Brewing Company’s Pulaski Pecan Brown Ale.