Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

From NIST 800-53 to FedRAMP: What it really takes to bridge the gap

In this article If your cloud platform is already compliant with NIST SP 800-53, you’ve laid important groundwork for security and risk management. But when the goal shifts to serving U.S. federal agencies, the bar is raised significantly. That’s where FedRAMP enters the picture. While FedRAMP is built on NIST 800-53, the two are not interchangeable. FedRAMP adds a layer of rigor, documentation, and oversight specifically tailored to the requirements of the federal government.

Beyond PCI and HIPAA: How Feroot Powers Australian Privacy Act (APA) Compliance

Yes—if your website collects data from individuals located in Australia, the Australian Privacy Act (APA) may apply, even if your company is not based there. This law is enforced by the Office of the Australian Information Commissioner (OAIC) and governs how “APP entities” handle personal information—including that collected by websites, apps, scripts, and third-party services.

Implementing Robust Security Protocols for Agentic AI Autonomy

In this new wave of machine-driven decision-making, the paradigm shift in artificial intelligence towards increasing autonomy is becoming increasingly significant. Autonomous or agentic AI systems, those capable of acting on their own and acclimatising themselves to new environments, are redefining the space by taking actions towards a goal without direct human intervention. Although this is exciting in terms of what it will enable for AI driven processes and creativity, it also introduces a more advanced set of security risks to contend with when dealing with autonomous based AI systems.
Featured Post

Moving Beyond Compliance to True Resilience

Organisations can no longer afford to rely solely on achieving compliance as a defence strategy. Cyber threats are not only more sophisticated, they are relentless. While regulatory compliance sets a baseline, true cyber resilience demands a proactive, layered approach. Businesses must not only pass audits but also recover seamlessly from cyber-attacks to avoid disruption to business continuity.

The final CMMC rule is here-enforcement starts November 10

After years of drafts, revisions, and shifting timelines, the Cybersecurity Maturity Model Certification (CMMC) program is no longer just a concept. It's a contractual requirement, and enforcement begins soon. ‍ On September 9, 2025, the U.S. Department of Defense (DoD) released the final CMMC rule (48 CFR) for public inspection, with official publication in the Federal Register on September 10. From this point forward, all DoD contracts require some level of CMMC certification. ‍

Simplify NYDFS 500.7 Compliance With KeeperPAM

Organizations regulated by the New York Department of Financial Services (NYDFS) must adhere to 23 NYCRR Part 500, a cybersecurity regulation designed to protect sensitive consumer data and financial systems. Among its core requirements, Section 500.7 specifically focuses on access privileges, requiring financial services companies to implement controls that limit access to nonpublic information based on the principle of least privilege.

Why ISO 27001 Auditors Can Reject Documentation

ISO 27001 is one of the most complex security frameworks commonly in use around the world. That complexity comes from the way it is designed: not as a checklist to follow, but rather as a series of guidelines to achieve. The difference between those two things is stark, even if it doesn’t sound like it. The way ISO 27001 works is that you develop an ISMS, or Information Security Management System.

CyberArk empowers Australia's cyber resilience with IRAP assessment completion at the protected level

As ransomware strains hospital operations and supply‑chain attacks target energy grids, Australia’s public and regulated sectors need proven cyber resilience. At the heart of most breaches lie human error and weak identity controls, making the Infosec Registered Assessors Program (IRAP) assessment program the gold standard for moving sensitive workloads to the cloud.

Beyond PCI and HIPAA: How Feroot Powers General Data Protection Regulation (GDPR) Compliance

Yes. If your website is accessible in the EU and collects any user data—through forms, cookies, session recordings, pixels, or embedded scripts—then GDPR likely applies. But compliance isn’t as simple as publishing a privacy policy or showing a cookie banner. Modern web apps expose personal data through invisible front-end technologies like third-party JavaScript, ad tags, tag managers, and behavioral trackers.