INSIGHTS
Four articles on the rules you are answering to, and one map you can print.
Signed by its author, dated when published and when last checked, and published when we have something, not on a schedule.
Who each article is for.
Where an article names an obligation it names the exemption beside it, so that a reader below a threshold can recognize their own position.
Security assessment or COST: which question are you asking
Bought under one word, they answer different questions: which one your situation calls for.
Security Assessment, Offensive Security.
The seller servicer information security stack
Five rulebooks at once, and they disagree on what starts a clock.
Offensive Security, Mortgage, AI Governance Assessment.
The post CAT board packet
The CAT was withdrawn in 2025 with no successor: what the board gets now, and what the examiner hears.
Security Assessment, Examination and Evidence Readiness.
AI in the loan workflow and adverse action
What a lender must explain when a model shapes a denial; what changed in 2026.
AI in Regulated Decisions, AI Governance.
The notification clock map
Fourteen duties, five starting moments: what starts each, how long it runs, who it does not reach. Print it.
Cyber Defense, Financial Services.
None of it requires an engagement. Continuing work: Advisory and vCISO, the AI Governance Program.
Reviewed means last checked against the instruments named; both dates are also in the feed. The feed collects no address and runs through no processor.
Bring the instrument that prompted it, and your date.
Everything here is published without a form, and stays that way.