How Sworn Enemies Found a Truce (Sort of) to Achieve NIST Compliance
summary
Startup maps NIST 800‑53 to CMMC, loses two key engineers, and learns 50% of engineering time is non‑coding while chasing compliance; initially buys vendor tools (Trend Micro, Burp Suite) then switches tools after FedRAMP government editions lack needed features, builds collaborative authoring, DevSecOps pipelines, POA&M and continuous monitoring, and earns 3rd‑party attestation for FedRAMP moderate equivalency; alignment improves but work is ongoing and celebrating wins was missed.
AI-written summary · about
chapters (19)
- 0:00Cautionary hiking story
- 2:31Compliance journeys feel perilous
- 3:16Chaotic start of NIST journey
- 5:01Choosing NIST frameworks
- 8:12Mistakes in tool purchasing
- 10:39Understanding roles critical
- 13:09Failure of vague planning
- 16:19Security and engineering alignment
- 18:47Executive team clarity
- 21:12Talking past each other
- 24:04Collaborative compliance docs
- 25:49Celebrating small wins
- 28:15Compliance feels endless
- 31:49Monitoring illusion of completion
- 33:53Company-wide compliance objectives
- 35:57Moving to DevSecOps
- 38:51Security-engineering relationship
- 41:22Key compliance takeaways
- 42:26Q&A
related talks
36mSecurity compliance: A global perspective
49mLessons from DevSecOps Trenches
31mAlleviating the Fear in Preparing for Information Security Compliance
50mRunning in the Shadow: Perspectives on Securing the Software Supply Chain
35mRevolutionizing Cyber Defense: The NIST CSF 2.0 Advantage
05mHow To Automate Compliance If You Aren't Chuck Norris
29mFrom NIST to FIRST: How GitHub’s Product Security Response Organization Transitioned
48mUnderstanding CMMC and NIST 800-171 for CUI