Blog

Determining Your ISO 42001 Role: A Guide for Organizations

philip.brudney@risk3sixty.com (Philip Brudney) — Thu, 04 Jun 2026 04:00:00 GMT

As organizations strive to manage risk and innovation in a rapidly changing AI landscape, the adoption of ISO 42001 becomes increasingly relevant.

A Practical Guide to CMMC Compliance, Implementation, and Certification

andrew.parks@risk3sixty.com (Andrew Parks) — Thu, 21 May 2026 04:00:00 GMT

This is a joint effort between Schellman and risk3sixty. You can find the original post here.

The Future of Control Testing: How AI Is Reshaping Internal Audit, SOC 2, SOX, and Continuous Controls Monitoring

christian.hyatt@risk3sixty.com (Christian Hyatt) — Tue, 05 May 2026 04:00:00 GMT

Yesterday I spoke with a team that is responsible for testing 1000s of controls a year. They have an entire staff that goes through the process of gathering evidence, documenting results, and reporting them to leadership day after day.

Georgia Tech Students Are Showing Us the Future of Cybersecurity Work

christian.hyatt@risk3sixty.com (Christian Hyatt) — Tue, 21 Apr 2026 04:00:00 GMT

I am blown away by what Georgia Tech students are building right now.

Introducing the risk3sixty Ecosystem

sawyer.miller@risk3sixty.com (Sawyer Miller) — Mon, 20 Apr 2026 04:00:00 GMT

risk3sixty was founded 10 years ago because Christian Hyatt and Christian White wanted to build a business aligned to their personal values. That meant creating something special.

The Future of GRC: Why Compliance Professionals Must Become Program Architects

christian.hyatt@risk3sixty.com (Christian Hyatt) — Thu, 16 Apr 2026 04:00:00 GMT

For years, too many talented people entered GRC expecting to do meaningful, high-impact work only to find themselves stuck chasing screenshots, organizing evidence folders, and repeatedly following up with engineers for audit artifacts.

Why GRC Teams Spend More Time Managing Tools Than Managing Risk

christian.hyatt@risk3sixty.com (Christian Hyatt) — Wed, 04 Mar 2026 05:00:00 GMT

Most GRC leaders didn’t buy a GRC platform because they were chasing shiny objects or trying to impress the board with new software.

The Hidden Work No One Accounts for in SOC 2, ISO 27001, and PCI Programs

christian.hyatt@risk3sixty.com (Christian Hyatt) — Wed, 25 Feb 2026 05:00:00 GMT

Leaders Must Balance Peace and Urgency

christian.hyatt@risk3sixty.com (Christian Hyatt) — Mon, 23 Feb 2026 05:00:00 GMT

I’ve always been restless. I don’t sit still well. My mind tends to run ahead of me, constantly generating new ideas like services we could launch, improvements we could make, markets we could explore. There is always something else we could do, and if I’m not careful, I can convince myself that we should do all of it.

What It Actually Takes to Run a GRC Program (And Why Most People Get It Wrong)

christian.hyatt@risk3sixty.com (Christian Hyatt) — Wed, 18 Feb 2026 05:00:00 GMT

Most people think running a GRC program is about getting ready for audits.