Blog — Keystone

Keystone blog

Notes on compliance, cloud operations, and secure systems

Short reads on rule changes, deadlines, and the gap between documentation and proof.

AI regulation

Congress will not settle the AI rules before the midterms. Your customers will not wait.

The federal debate is deadlocked, so the binding rules are being written in state capitols, in Brussels, and in procurement questionnaires. Five artefacts every proposed regime asks for.

16 September 2026

Read

Audit

The shared responsibility model is a diagram, not evidence. That is where audits stall.

A responsibility matrix says who was supposed to do something and never shows that anybody did. Four failure patterns, why a provider attestation is not your evidence, and what auditors accept instead.

13 September 2026

Read

Sovereignty

On 12 January 2027, switching your cloud provider becomes free. Nobody can prove they can do it.

EU Data Act Article 29 takes switching charges to zero and DORA Article 28(8) requires exit strategies that are tested, not documented. Almost nobody holds a test report.

10 September 2026

Read

FedRAMP 20x

FedRAMP 20x asks you to prove 92 things automatically. Five of them your compliance platform structurally cannot do.

The 2026 rules require two automated validation methods for each of 46 Key Security Indicators. Five are written with verbs a read-only platform cannot satisfy.

7 September 2026

Read

FedRAMP

FedRAMP eliminated POA&Ms. Here's what replaced them — and who still has to keep them.

On 4 July 2026 FedRAMP eliminated Plans of Action and Milestones entirely. Rev5 providers keep POA&Ms until at least 11 June 2027, and agencies keep a narrowed version. Includes a published correction against the machine-readable ruleset.

4 September 2026

Read