Spoiledlunchhttps://511d98a7.spoiledlunch.pages.dev/Nerdy Stuff. Tech Talk. Zero Freshness. Analysis and commentary on GRC, security, and AI.Hugo 0.160.1en-usTue, 26 May 2026 09:00:00 -0400Compliance Exceptions Tell You More Than Your Passed Controlshttps://511d98a7.spoiledlunch.pages.dev/articles/2026-05-01-compliance-exceptions-tell-you-more-than-your-passed-controls/Tue, 26 May 2026 09:00:00 -0400https://511d98a7.spoiledlunch.pages.dev/articles/2026-05-01-compliance-exceptions-tell-you-more-than-your-passed-controls/Article • May 26, 2026 • 4 min read | Topics: GRC | Organizations love to report passed controls because passed controls are flattering. They suggest order. They suggest repeatability. They suggest that the environment behaves the way the framework …SpoiledlunchGRCcomplianceexceptionscontrolsauditCompliance Gets Better When Regulators Ship Tools Instead of Sloganshttps://511d98a7.spoiledlunch.pages.dev/articles/2026-04-24-compliance-gets-better-when-regulators-ship-tools-instead-of-slogans/Fri, 24 Apr 2026 08:20:00 -0400https://511d98a7.spoiledlunch.pages.dev/articles/2026-04-24-compliance-gets-better-when-regulators-ship-tools-instead-of-slogans/Article • April 24, 2026 • 2 min read | Topics: GRC | A lot of compliance guidance dies as slideware because it explains principles without changing the operator’s daily work. The more interesting recent GRC signal is that standards bodies and …SpoiledlunchGRCcompliancegdprcsf 2.0governanceWhy AI Governance Frameworks Are Security Theaterhttps://511d98a7.spoiledlunch.pages.dev/articles/2026-04-20-ai-governance-security-theater/Mon, 20 Apr 2026 09:00:00 -0700https://511d98a7.spoiledlunch.pages.dev/articles/2026-04-20-ai-governance-security-theater/Article • April 20, 2026 • 4 min read | Topics: AI, GRC | Most enterprise AI governance frameworks are elaborate exercises in checkbox compliance that miss the actual risks. They’re designed to satisfy auditors and executives, not to manage the …SpoiledlunchAIGRCgovernancerisk managemententerprise AIcomplianceThe SOC 2 Compliance Cargo Culthttps://511d98a7.spoiledlunch.pages.dev/articles/2026-04-18-soc2-compliance-cargo-cult/Sat, 18 Apr 2026 14:30:00 -0700https://511d98a7.spoiledlunch.pages.dev/articles/2026-04-18-soc2-compliance-cargo-cult/Article • April 18, 2026 • 7 min read | Topics: GRC, Security | SOC 2 compliance has become a cargo cult ritual in enterprise security. Organizations implement the ceremonial controls, follow the prescribed procedures, and wait for security to magically appear. …SpoiledlunchGRCSecuritySOC 2compliancesecurity controlsauditEDPB Sets a 2026-2027 Programme Focused on Compliance and Regulatory Coordinationhttps://511d98a7.spoiledlunch.pages.dev/news/2026-02-12-edpb-sets-a-2026-2027-programme-focused-on-compliance-and-regulatory-coordination/Thu, 12 Feb 2026 09:00:00 +0100https://511d98a7.spoiledlunch.pages.dev/news/2026-02-12-edpb-sets-a-2026-2027-programme-focused-on-compliance-and-regulatory-coordination/News Brief • February 12, 2026 | Topics: GRC | Summary: The European Data Protection Board adopted its 2026-2027 work programme on February 12, 2026. The programme emphasizes making GDPR compliance …SpoiledlunchGRCEDPBGDPRprivacycompliance