From Chaos to Compliance: Building Governance That Actually Scales

From Chaos to Compliance: Building Governance That Actually Scales by Stacey Onewl, PhD Let’s be honest. In most organizations, compliance is often treated like the annoying hall monitor of cybersecurity; the team everyone loves to blame when innovation slows down, audits go awry, or someone discovers a control gap the size of a small planet. Meanwhile, security engineering is out there building cool things, fighting fires, and wondering why compliance keeps getting in the way. Here’s the plot twist: Compliance isn’t the villain. Bad compliance is. In this talk, I’ll break down how compliance, when done right, becomes the backbone of scalable, defensible, engineering‑aligned security and how, when it’s done wrong, it becomes a bureaucratic nightmare that drags everyone down. Drawing on 15+ years of leading enterprise assurance programs, advising boards, and working shoulder‑to‑shoulder with engineers, I’ll show how to turn compliance from a checkbox chore into a strategic accelerator that actually helps teams ship faster and safer. Expect candor. Expect uncomfortable truths. Expect a few spicy takes about frameworks like FedRAMP , NIST SP 800‑53, CMMC, and PCI DSS. And expect to walk away with a blueprint for making compliance something your engineers don’t roll their eyes at.