Continuous ATO in Practice
A technical breakdown of Continuous ATO — what it actually requires, how OSCAL enables machine-readable evidence, and where most DoD programs fail to sustain it.
Technical Journal
Notes on secure systems, software delivery, and applied AI.
Field-informed writing on cybersecurity, DevSecOps, architecture, automation, and the engineering practices that make complex systems more trustworthy.
Start Here
Choose a path through the journal.
Recently Updated
Evergreen notes
Featured Essay
July 12, 2026
devsecops
Latest Notes
5 total
ai
ATO for AI Systems
How AI models actually get authorized in the DoD — the Assess Only construct, the coming NIST 800-53 AI overlays, and the re-authorization trigger problem...
cybersecurity
Army RMF 2.0: How the Updated Framework Works
How Army RMF 2.0 (Project Sentinel) restructured control selection, inheritance, and monitoring — and how it maps onto the DoD's new five-phase Cybersecurity Risk Management...
architecture
CDAO, Swarms, and the Kill Chain as Microservices
Why the kill chain is decomposing into services on a data fabric — what Replicator's dissolution into DAWG reveals, how Open DAGIR works as an...
cybersecurity
SBOM in the Defense Industrial Base
A practical breakdown of SBOM requirements, format standards, toolchain options, and where DIB contractors consistently fall short when the contracting officer asks for one.
