Travis Good

Architect of security and privacy programs for 1,000+ hypergrowth companies. Author of "Complete Cloud Compliance," HITRUST 3rd Party Council member, and recognized speaker on startup security.

Do You Need FedRAMP to Sell to the Government?
CASE STUDY
Travis Good
decorative
October 13, 2026

Do You Need FedRAMP to Sell to the Government?

What you need to know about FedRAMP requirements and if it's the right next step for your business.

Read Post
Penetration testing requirements across compliance frameworks
CASE STUDY
Travis Good
decorative
October 5, 2026

Penetration Testing Requirements: Written Into the Standard, Expected in Practice, or Only Proposed

Which frameworks require a pen test? From PCI DSS and FedRAMP to SOC 2, ISO 27001, and HIPAA, we break down when pen testing is a requirement.
Read Post
Abstract illustration for Colorado SB 26-189 ADMT developer and deployer notice requirements for SaaS
CASE STUDY
Travis Good
decorative
October 2, 2026

Does Colorado's New ADMT Law Apply to Our SaaS - and What Docs / Notices Do We Owe by January 1, 2027?

Colorado SB 26-189 replaces the 2024 AI Act. Developer vs deployer checklist, covered ADMT exclusions, and Jan 1 2027 notice clocks for SaaS.
Read Post
Illustration for GovRAMP (formerly StateRAMP) for SaaS selling to SLED / SLTT buyers including North Carolina
CASE STUDY
Travis Good
decorative
October 2, 2026

SOC 2 Won't Clear Multi-State SLED Deals - What GovRAMP (Formerly StateRAMP) Actually Requires

SOC 2 is not GovRAMP for multi-state SLED SaaS. Status ladder (Core/Ready/Authorized), StateRAMP rename, FedRAMP Fast Track one-way, NC Apr 2026-2027.
Read Post
Illustration for TX-RAMP certification versus SOC 2 for SaaS selling to Texas agencies
CASE STUDY
Travis Good
decorative
October 1, 2026

SOC 2 Won't Clear a Texas Agency Deal - What TX-RAMP Actually Requires for SaaS

SOC 2 does not replace TX-RAMP for Texas agency SaaS deals. Level 1 vs 2, Manual 4.0 provisional, Fast Track, and why hyperscaler cert is not yours.
Read Post
Abstract illustration for EU Data Act switching and portability obligations for SaaS
CASE STUDY
Travis Good
decorative
October 1, 2026

Does the EU Data Act Apply to Our SaaS - and What Do Buyers Expect Before January 2027?

Most B2B SaaS is a Data Act data processing service. Switching clocks, portability, and Trust Center disclosures buyers expect before January 2027.
Read Post
Illustration for Shared Assessments SIG 2026 remake and AI resilience remapping
CASE STUDY
Travis Good
decorative
September 30, 2026

We Already Completed SIG - Do We Need to Remake It for SIG 2026?

SIG 2026 deepens AI (ISO 42001) and resilience mappings without new domains. Remap AI and ORF rows if buyers ask for 2026 - not a zero rewrite.
Read Post
Illustration for IRAP assessment versus SOC 2 for US SaaS selling to Australian government
CASE STUDY
Travis Good
decorative
September 30, 2026

SOC 2 Won't Clear an Australian Government Deal - What IRAP Actually Is for US SaaS

SOC 2 does not replace an IRAP assessment for Australian government cloud. What IRAP is, why hyperscaler coverage is not yours, and a US SaaS playbook.
Read Post
Illustration for CCPA cybersecurity audits and SaaS vendors
CASE STUDY
Travis Good
decorative
September 29, 2026

CCPA Cybersecurity Audits Are Live - Does Your SaaS Need One?

Not every CCPA business needs an annual cyber audit. Significant-risk thresholds, the 2028 certification clock, and what SaaS vendors should prepare.
Read Post