Secure by Design, Trusted Through Compliance

Michael Darling opens by questioning the divide between technical security teams and governance, risk and compliance staff. He argues both should aim at the same outcome: reducing the chance that a material impact hits the organization. In his framing, security is risk management that enables the business rather than a department that says no.

The core of the talk is a structured model. Governance comes first, defining decision makers, stakeholders and executive oversight. Risk framing follows, covering legal and contractual constraints, the threat actors targeting the industry, and what different failures would cost. Technical baselines such as CIS benchmarks or NIST 800-53 come next, adjusted with administrative and physical controls. Darling recommends short process documents that name the people, procedures and technology behind each control, which keeps policies usable. He also shows how tiering internet-facing assets for faster remediation puts risk-based priorities into practice.

Compliance frameworks such as SOC 2 and ISO 27001 are presented as a way to communicate trust to customers, auditors and regulators. Darling suggests generating audit evidence from routine workflows, such as closed ticket records, and mentions OSCAL as a machine-readable option. He closes by arguing that compliance is a business competitiveness issue and should describe what the organization really does.