Welcome to Part 1 of our Compliance Engineering Mini-Series, a focused look at what it means to build secure, auditable systems by design.

In this kickoff episode, 38North Director of Engineering Larry Spector joins Chris Davis to talk about a familiar tension: engineers want to move fast, and compliance gets in the way. But what if the engineers are right? Or at least, right to feel the way they do?

Together, they explore:

• Why compliance often fails when it’s treated as a bolt-on
• How audit fatigue and rework are symptoms of deeper engineering gaps
• The difference between “checking boxes” and proving operational excellence
• What it actually means to build systems that generate their own evidence

Larry and Chris reframe the problem and set the stage for a new way of thinking about compliance, engineering, and trust.

Welcome to Part 3, the final episode of our GovRAMP Mini-Series. Over the last two episodes, we’ve covered what GovRAMP is and why companies are pursuing it.

Today, we’re closing things out by getting tactical—what does the GovRAMP process actually look like from start to finish?

To walk us through it, we’re joined by Matt Strasburg, manager of our Cloud Security Advisory practice. Matt has guided dozens of companies through complex public sector frameworks, and he’s here to break down the steps, timelines, and fast-track options that cloud providers should know about.

This is Part 2 of the GovRAMP Mini-Series. In this episode, we’re digging into the big question: Why would a cloud provider pursue GovRAMP in the first place? 

We’re joined by Jeremiah Thompson, 38North Security's VP of IT and Cloud Solutions. We also have Matt Strasburg, Manager of our Cloud Security Advisory practice. Jeremiah’s been in the compliance world for years and brings a pragmatic, strategic lens to why GovRAMP is gaining traction—not just for security reasons, but for smart market growth. Matt, on the other hand, has been pivotal in standing up similar federal programs in past years.

Welcome to Part 1 of our GovRAMP Mini-Series—a quick, focused look at what GovRAMP is, why it matters, and how cloud service providers can use it to unlock the public sector. 

In this episode, we tackle the basics: What exactly is GovRAMP? Why the rebrand from StateRAMP? And is this more than just a name change? 

Elizabeth Lopez helps us break it down. Liz, one of our cloud security technical writers here at 38North Security, has been deep in the weeds of policy, frameworks, and language—so she’s the perfect person to walk us through what GovRAMP is really all about. 

FedRAMP just came out with *three* new bodies governing the program going forward: the TAG, the Board, and the FSCAC. There's a lot of uncertainty right now, not to mention confusion and misinformation. Why are these changes happening? What does it mean for CSPs, 3PAOs, and agencies? Is the JAB gone?!! Matt Strasburg and Jeremiah Thompson shed light on these massive changes and discuss their wide-reaching impact.

We're about to see significant changes in the way FedRAMP is managed: automation, more pathways to authorization, and no more JAB. It's all in the name of modernization, baby! Well, that and the undeniable fact that the process to get more offerings in the FedRAMP marketplace needs to be much, much faster. But what does it all mean? How will it affect CSPs' efforts to get ATO? Matt Strasburg answers.