Paramify

That time when Isaac got the invite for a technical webinar with Prescient Security And Kenny did not. Kenny says, "That's awesome, Isaac." 🤷🏻‍♂️

A young GRC pro after seeing they have 16,000+ hours of SharePoint screen time

Hey Denver!! 👋 Tanner and Caze are at ISC2 Security Congress right now. We're handing out borderline infinite energy drinks and giving away a custom pair of Nike By You shoes. If you're at the show, come find us! If you're not at ISC2 Security Congress that's sad... but you can still meet with us virtually. lnkd.in/eEHJhPP9

This is gonna be big... like indoor plumbing big. Join the waitlist: lnkd.in/gq7CXm4m

How it feels to manually manage POA&Ms in Sharepoint

If you know what BOD 26-04 is, congrats, you're in the 0.001% of the population. If you don't, give Isaac 5 minutes and you can join this elite 0.001%. On June 10, 2026, CISA issued BOD 26-04, which tells federal civilian agencies to prioritize security updates based on risk. It replaces two older patching directives, BOD 19-02 and BOD 22-01. Agencies rely on FedRAMP® Certified cloud services to meet the directive, so FedRAMP aligned its own rules with it. VDR (Vulnerability Detection and Response) and VER (Vulnerability Evaluation and Reporting) become mandatory on December 7, 2026, for Rev5 and 20x offerings obtaining or maintaining FedRAMP® Certification. Isaac breaks down how CISA's four factors match up with FedRAMP rules: → Is the asset publicly exposed? FedRAMP asks you to evaluate whether vulnerabilities are internet-reachable, which goes a step further. → Is it on CISA's KEV (Known Exploited Vulnerabilities) catalog? FedRAMP® expects KEVs remediated by the catalog's due dates. → Can exploitation be automated? FedRAMP® says assume it can unless you have evidence otherwise. → How much control could an attacker gain? FedRAMP® pairs this with a Potential Agency Impact N-rating (PAIN), from N0 to N5. If your tools can't show internet reachability, likely exploitability, KEV status, and a PAIN rating for each finding yet, December 7 is a good date to circle. How's your team getting ready for BOD 26-04?

We're putting pro skaters on a rooftop in DC with A-LIGN and Carahsoft 🛹 Our event, RAMP UP, is right after Cloud Service Providers Advisory Board (CSP-AB) annual event on Tuesday, Sept 29 from 5-7 PM. Free drinks, free food, arcade games, bowling, and a custom skateboard up for grabs for each framework: FedRAMP®, GovRAMP, DoW IL, RMF, FISMA, CMMC. Why? Because why not. Tuesday, Sept 29 | 5-7 PM | DC Register to get the venue location Free trolley there and back Come hang with the Paramify crew. Spots are limited, register here: lnkd.in/e9r4C7UG

What is FedRAMP® Class B? Class A lets an existing SOC 2 Type II, GovRAMP, or Rev 5 assessment do some of the work. Class B is where you address FedRAMP directly: all applicable key security indicators, automated validation behind them, and continuous monitoring data your agency customers can actually see. Where Class B sits in the Consolidated Rules for 2026: - FedRAMP says a Class B certification carries enough information for most Low security objectives and some Moderate or High ones - At Class B, FedRAMP expects at least 1 automated method validating each KSI. Class C requires 2 plus 6 months of historical metrics, Class D requires 4 plus 18 months - Applying for Class B requires a fresh independent assessment from a FedRAMP Recognized assessor, completed within the previous 3 months - The 2026 rules took effect July 4, 2026 for new 20x applications. Active 20x certifications need to be following them by January 1, 2027 FedRAMP's guidance is to start at the lowest class that meets what your agency customers actually require, then uplift from there. If agencies are asking you for FedRAMP without demanding deep operational transparency, Class B is probably your spot. If you're looking at FedRAMP Class B, we should talk! lnkd.in/eX6ych56

"We hesitated for like 6 hours." That's how long it took Paramify to commit to FedRAMP® 20x. We had been building off of capabilities since the templates era, so 20x was just a question of how to validate them. Today that's thousands of fetchers and validators, built faster than any integration can keep up with. Watch the full video here: lnkd.in/eA5aQ64N

Continuous validation isn't going to stay a FedRAMP® 20x thing. SOC 2, ISO 27001, CMMC are all still paper chases built around a single point in time audits. Once continuous validation is proven with the highest standard in security, it's going to come for everything else. If you're looking for a tool built for modern security package management, we should talk: lnkd.in/eyQ4Z8eG

We're proud to announce that Liam Smith has been promoted to temporary HubSpot Super Admin.

The change to continuous validation could be a career maker. Mike and Kenny get into why the CISOs who get comfortable with continuous validation now are about to be in serious demand. More software. More compute. More risk. A threat landscape that will not sit still. FedRAMP® is leading this. VDR and CR26 deadlines start December 7, 2026. If you're looking at FedRAMP 20x, we should talk: lnkd.in/eUgfXFdQ

Put your security capabilities in once. It applies everywhere. Paramify does this for FedRAMP Rev 5 or 20x, DoD ILs, CMMC, FISMA, you name it. If you're serious about federal compliance, we should talk: lnkd.in/e5yF-7ps

Shout to Bizzdesign for getting FedRAMP® Class C (Moderate) Certified! That certification is looking so right! Congratulations to the team! Isn't FedRAMP fun!?!?

Some people feel like the FedRAMP CR26 deadlines are coming too fast, but it's been the slow-moving steamroller from Austin Powers. They just didn't believe the government could move this quickly. But the threats aren't slowing down and waiting for everybody to get ready. That's exactly why this speed of progress matters. Mike and Kenny get into what this pace of change actually means and why it's a good thing. If you're looking at FedRAMP® 20x, we should talk: paramify.com/request-demo?ut…

Compliance is not a once-a-year screenshot exercise anymore. It's risks that have solutions which have capabilities that are continuously validated. All the time. Mike and Kenny talk about what this shift means for CISOs and why it changes everything about how you think about your program.

"If Paramify went away, I'd have to invent Paramify." That's Todd Kistner, VP of Cloud Operations at Vbrick, talking about what it takes to get FedRAMP 20x certified. Before Paramify, their team tracked compliance through spreadsheets, Word docs, and Jira tickets. Four people full-time just to do Rev 5. Todd himself spent an entire Labor Day weekend, four straight days of 12-hour shifts, just writing documentation. After Paramify, they're focused on real security work instead of busy work. They avoided hiring one or two additional headcount. And they're saving as much as a full day of work per week. "Without a tool like Paramify, this process of getting FedRAMP® certification is most likely not possible." - Shailesh Lohiya, CTO "Paramify was the only platform where the architecture seemed to align to the concepts behind what we were seeing with 20x and evidence automation." - Terry M, CIO "With Paramify, it's radically simple, focused, and it gets the job done quickly and better in fact than the prior process." - Paul Sparta, CEO If you're serious about 20x, we should talk: lnkd.in/e4YcG6-C

"POA&Ms"

I guess you can say things are getting pretty serious 🤷‍♂️ We're now embedded directly into Defense Unicorns' Unified Defense Stack (UDS). UDS is the airgap-native platform trusted by the U.S. Army, Navy, Air Force, and Space Force to deliver mission-critical software. Paramify now automates the compliance layer inside it. Control mapping, documentation, and evidence across IL 4 and IL 5, handled. What once required significant manual effort, resources, and time can now be automated to support ten or more organizations at a time. Robert Slaughter, CEO of @DefenseUnicorns: "Paramify accelerates our ability to onboard new mission partners. By embedding Paramify's automation into UDS, we can take on more customers without sacrificing the security rigor that our defense environments demand." Speed and compliance, no tradeoff. Read the full release: lnkd.in/eJ37tJ_5