Archive
Every published essay, newest first.
GRC Contracts Enterprise security Negotiation
Last quarter at Decagon, redline volume on enterprise deals dropped. Legal didn't get easier to work with. My team had finally shipped controls that had been showing up in negotiation for months.
GRC Vendor management Contracts Compliance
Before your security team can credibly answer an enterprise customer’s questionnaire, someone else has probably already asked you the same questions — in a different format, on a vendor’s paper. Fo...
Enterprise buyers do not only ask what your policies say. They ask what your systems do — and whether you can show the connection. For most GRC programs, that question surfaces a gap: policies desc...
Auditor interviews reward a deceptively simple outcome: a coherent story about how controls work, backed by evidence an auditor can follow. The hard part is not the interview itself. It is assembli...
GRC Policies Controls Governance
Most governance writing describes a single direction: policy defines what should be true, standards narrow it, procedures operationalize it, and controls prove it. That model is clean. It is also o...
We can't find the internet
Attempting to reconnect
Something went wrong!
Attempting to reconnect
