Notes from the field.
Short, practical analysis on security, AI and technology strategy — written for the people who have to make the decision.
CMMC Level 2 in 2026: What NIST SP 800-171 Actually Asks of a Mid-Sized Contractor
The 110 controls of NIST SP 800-171, grouped by effort, the evidence assessors expect, and what the 2026 Phase 2 pause changes.
Read articleAI Governance in 90 Days: A NIST AI RMF Starting Point That Doesn't Stall Adoption
Using the NIST AI RMF to set up an inventory, risk tiers and a review process without stalling adoption.
Read articleCloud Cost Is an Architecture Problem: Three Design Decisions That Actually Cut Spend
Why FinOps dashboards rarely cut spend on their own, and the three design decisions that do.
Read articleWhen a Fractional CTO Makes Sense — and When It Doesn't
A practical test based on decision volume, team shape and the cost of getting architecture wrong.
Read articleBoard Cybersecurity Metrics That Mean Something
Replacing vulnerability counts with measures directors can use to make funding and risk decisions.
Read articleIs Your Data Ready for AI? A One-Page AI Data Readiness Checklist
Quality, access, lineage and ownership questions to answer before funding a pilot.
Read articleStart with a scoped assessment.
Tell us what decision you need to make. We'll reply with a short scope and a timeline — or tell you plainly if we're not the right fit.