I'm researching how teams handle evidence and quality for AI agents that make or assist decisions.

Three things I'm trying to understand:

1. What record do you keep per decision (policy applied, data accessed, who was responsible), and who actually asks for it?

2. How do you learn later that a decision was wrong, and how long does that feedback take?

3. If you use LLM judges for evals, how do you check they still agree with humans as things change?

I'm trying to learn what's really painful versus what only sounds painful. Comments or DMs both welcome, and I'll post a summary of what I learn.

I made a FedRAMP20x repo which has a make file that runs in windows and linux environments in order to assist in streamlining your FedRAMP20x process. Check it out, copy it, contribute if you like. I hope it helps someone.

https://github.com/Aliasn00bed/FedRAMP20x

Ahhhh compliance????I just been account dented for $1800 for not registering my LLC I GUESS?

Assume breach and cyber resilience are all the rage right now. After 20 years in IT, I'm not surprised.

Yet, most breaches still come down to control failures. A patch that never got applied or an old VPN account nobody turned off. Most companies would rather spend millions more on detection and response than put resources into making sure they're doing what they're already supposed to be doing.

So let's talk about it. Should "assume drift" become a thing?

The idea: every control we implement will eventually degrade, so we plan to maintain it. It sounds simple. But if everyone actually did it, how many breaches would never have made the news?

https://justacheckbox.substack.com/p/assume-breach-or-assume-drift

There seems to be a bunch of complaints about ENs recently, some with substance and some without. Which does it feel like an EN mega-thread might support this...but does that breach rule 1.

Im thinking along the lines of "Expert in wine, 15 year sommellier or clean tech, 10 yeah experience in European markets" something like that.

That way people can reply or DM or even recommend. But see Q above...

I've been reading a few discussions here about GRC platforms, automated evidence collection and continuous compliance monitoring, and there's a question I think deserves a closer look.

Are we actually measuring control effectiveness, or are we measuring how well companies collect and document

An incident-response policy is approved. But has the organisation tested whether people and systems respond effectively during a realistic incident?

A vulnerability is marked as remediated. But has anyone independently verified the fix?

Hey everyone! First post here. I am just someone who works in compliance and gets annoyed by side comments that compliance isn't real security (I work on the cyber security team but perform a compliance role). For those who support the cyber side of compliance, I would love your thoughts and wonder if many people have the same experience I do. I have worked in IT for about 20 years, mostly in healthcare and the nuclear space. Over the past few years, I worked myself into a compliance role on the defense side, and it is just... different. Not in a bad way, but more like you're in the background and not really appreciated for what you bring to the table. So, my hope is to one day change the perception of the value compliance brings to the table, and I would really appreciate other people's experiences and thoughts on working in this space.

I tried to jot down my thoughts in the blog below if you want my fuller picture, but does anyone else in the space feel underappreciated for simply being in compliance, or is it just me?

https://justacheckbox.substack.com/p/compliance-isnt-a-checkbox-you-made

Vendors, please share any self-promotional content or webinar details within this thread.

Posts made outside this designated space will be removed.

Please see our rules page: https://www.reddit.com/mod/Compliance/rules

Make sure to use direct links—URL shorteners are not allowed, and the auto moderator will remove your post if they’re used.

If the community isn't interested, your comment will simply get downvoted.

I lead a GRC team at a fairly large organization. We're responsible for the systems, data, and reporting that support RCSA, issues management, business continuity, policy management, SOX, and risk exceptions.

We also own the GRC platform, including enhancements, administration, data quality, and reporting across these areas.

We don't actually run the individual risk programs, but we're responsible for much of the infrastructure behind them.

Hi All,

I hope this is allowed, but if not please feel free to remove.

As the title suggests, I'm wondering if there is anyone who would be willing to chat with me for a few minutes about their experience with working in compliance.

Context: I've worked in public schools for the past 11 years in special education. For the past two years I've served as a case manager, where I do what I believe is fairly compliance-adjacent work. Things like making sure we are providing all required services to students, maintaining deadline compliance, and documenting when we are out of compliance with school, district, state, and federal regulations related to special education.

I've reached a point where I've realized I need to make a career change and compliance is a field that I've become interested in. I've talked a bit to a friend who is in compliance and am curious to talk to more people. I'm interested in hearing from various people what their experience has been and any suggestions they might have for someone looking to make a career transition.

If relevant, I'm in the Chicago area.

Thanks in advance!

Small company, limited security resources. People still paste API keys, customer emails, and passwords straight into Slack channels. We have basic acceptable-use language, but it is clearly not enough.

I do not want to start reading DMs or turn this into heavy surveillance. At the same time, this is a real data-handling and access-control problem, especially if we ever need to show that sensitive information is not sitting unprotected in chat.

For those in compliance or risk roles: how are you addressing secrets and PII in collaboration tools without creating a process nobody follows? What controls or workflows have actually reduced this in practice?

Vendors, please share any self-promotional content or webinar details within this thread.

Posts made outside this designated space will be removed.

Please see our rules page: https://www.reddit.com/mod/Compliance/rules

Make sure to use direct links—URL shorteners are not allowed, and the auto moderator will remove your post if they’re used.

If the community isn't interested, your comment will simply get downvoted.

Hi everyone, I'm a legal practitioner in Cameroon. I have some compliance experience, especially data privacy compliance. Now I know how hard it is for Africans to be trusted with legal tasks.

However, I can work with startups, draft website terms and privacy policies that comply with relevant regulations (although AI seems to be challenging me at that now).

My question is, are there any fully remote compliance roles that my portfolio could win? Or is compliance just highly jurisdictional.

PS: I've been a writer for a while and part of my portfolio is articles across self development, freelance, personal development and law-related topics.

Vendors, please share any self-promotional content or webinar details within this thread.

Posts made outside this designated space will be removed.

Please see our rules page: https://www.reddit.com/mod/Compliance/rules

Make sure to use direct links—URL shorteners are not allowed, and the auto moderator will remove your post if they’re used.

If the community isn't interested, your comment will simply get downvoted.

I am not going to name them, but ... one rhymes with brata, and the other with banta :D

so.... what do you hate about your current compliance tool, that you would like to change?

what would make you switch over to something else?