2 posts
CISA BOD 26-04 isn't binding on the private sector, and even where it is binding, it's the minimum. Here's how to tailor the floor CISA, NIST, DISA, and FedRAMP set into a program that matches your actual risk.
On June 16, 2026, FedRAMP's NTC-0014 pulled mandatory adoption of its VDR and VER rules forward to December 7, 2026, retiring the monthly authenticated scan for an exposure-and-threat-based loop. Co-authored with Chris Hughes, here's what the new rules require, how CISA's BOD 26-04 forced the timeline, and what cloud providers have to build now.