About
According to Larker and Tavan, “Governance and management are two sides of the same…
Articles by Keyaan J.
-
The Clock Is a Governance Test, not a Planning Tool
The Clock Is a Governance Test, not a Planning Tool
Time tests whether decision authority can still decide. Time pressure exposes whether governance can decide in time…
1 Comment -
Governance must be prescriptive before it is adaptive
Governance must be prescriptive before it is adaptive
This is the final part in a series of Governance and Risk Extremes articles that examine what happens when exposure…
7 Comments -
Governance must optimize for system stability, not local comfort
Governance must optimize for system stability, not local comfort
Governance and Risk Extremes examines what happens when risk moves beyond routine management and into conditions where…
1 Comment -
Apathy Is a Governance Choice, Not a Personality Flaw
Apathy Is a Governance Choice, Not a Personality Flaw
This article is Part IV of the Governance and Risk Extremes series. The series examines what happens when risk moves…
1 Comment -
Governance Fails First as a Human Capability Problem
Governance Fails First as a Human Capability Problem
This series examines Governance and Risk Extremes—what happens when risk moves beyond routine management and into…
10 Comments -
When Governance Works, Organizations and Society Change
When Governance Works, Organizations and Society Change
This article is part of a series on Governance and Risk Extremes. The series examines what happens when risk moves…
1 Comment -
Risk Lives Between Extremes. Governance Decides Where You Stand.
Risk Lives Between Extremes. Governance Decides Where You Stand.
Governance is often reduced to a checklist. Policies are approved.
12 Comments -
Promises and Perils of Risk Quantification and Communication
Promises and Perils of Risk Quantification and Communication
Hat Tip to Jeff Smith, MBA, CISSP and insomnia for inspiring this rant based on my response to smart things he said…
2 Comments -
Risk Governance Theory and Practice
Risk Governance Theory and Practice
I appreciate the privilege that I had to close Day 1 at the 2025 Global CISO Forum hosted by EC-Council in Atlanta on…
-
Getting the Board on Board with Cybersecurity
Getting the Board on Board with Cybersecurity
I have the privilege of presenting at the Southeast Cybersecurity Summit in Birmingham, AL for another consecutive…
12 Comments
Activity
11K followers
-
Keyaan J. Williams shared thisReposting for awareness. My last conversation with Marco Nutini was so groundbreaking that my companies have developed ontologies, taxonomies, and controlled vocabularies to ensure consistent communication about everything that matters.Keyaan J. Williams shared thisThe Risk Ontology Survey - 1.4 A risk can remain abstract indefinitely. What changes is not the risk itself, but our ability to observe its effects. When something becomes observable—directly or indirectly—organizations assign a label to that observation. At that point, we move from a hypothetical construct to an empirical signal. “Event” is the most widely used term, but it carries ambiguity: it is used both for hypothetical occurrences and for those that actually materialize. To reduce this ambiguity, many organizations reserve terms like “incident” or “issue” for observed cases—although these are often used with overlapping meanings. In some environments, “issue” becomes a catch-all for manifested conditions. This distinction then propagates into practice: “mitigation plans” are applied to risks, while “corrective actions” are applied to issues. The underlying problem is not terminology—it is the lack of a clear model linking abstraction (risk) to observation (evidence) to response (action). This is the preamble to the fourth question of Group 1 of the Risk Ontology Survey I am coordinating, under the guidance of Graeme Keith and Andrew Shea from the Enterprise Risk Quantification Institute. If you haven’t participated yet, the first group of questions is still open. You have two options: 1) Visit the official survey page and answer Group 1 (five questions). You’ll need to provide an email to be notified when the next groups are released. 2) Or respond post-by-post here on LinkedIn via polls. We’ll incorporate that data as well. Comments are very welcome in either case. 👉 Link to the survey’s official page: https://lnkd.in/d6_e3cch 👉 Link to the introductory article: https://lnkd.in/dpTzaQA8 👉 Answer post-by-post below: #riskmanagement #riskontology
-
Keyaan J. Williams shared thisReposting for awareness.Keyaan J. Williams shared thisWe have an Intern position open on the ABM Information Security team reporting to me out of our Dunwoody office. If interested, please apply!
-
Keyaan J. Williams shared this“Time‑bounded governance is the exercised capacity of the decision authority to perform the required governance act within a finite time horizon before sustained exposure results in catastrophic consequence.” Overview on LinkedIn: https://lnkd.in/dt8P52ry Full details on Substack: https://lnkd.in/d9SHrvPB
-
Keyaan J. Williams shared thisTime does not create governance failure. It reveals whether decision authority was designed—and required—to act before choice expired. This article examines time‑bounded governance and addresses why those with decision authority who cannot act within the available time horizon are indistinguishable from authority that does not exist. Delay quietly reallocates accountability before consequence makes the failure visible.The Clock Is a Governance Test, not a Planning ToolThe Clock Is a Governance Test, not a Planning Tool
-
Keyaan J. Williams shared thisRe: Breaking into cybersecurity Cybersecurity is not plumbing. There is no defined path from apprentice to journeyman to master like there is in the skilled trades. In my experience, success requires a broad understanding followed by specialization. I started with core communications infrastructure as an ISDN bridge and switch operator. That led to data center and system administration. That led to an opportunity as a security analyst, which opened the door to a long security career. Now, I focus more on enterprise risk and risk governance because of my work with board directors and corporate officers. Everyone will walk their own path. Many roads lead to the same destination. The Special Publications from NIST have been a constant throughout this journey. I told someone new to the profession that he would learn much from reading the following NIST Standards in addition to (or instead of) focusing on entry-level certifications. All the standards are publicly available here: https://lnkd.in/ey5aK8BS There is much more to read on the site. I recommend starting with these to build a strong foundation. NIST SP 800-30 NIST SP 800-34 NIST SP 800-37 NIST SP 800-39 NIST SP 800-53 (Chapter 1-2 Only) NIST SP 800-160 vol1 and vol2 NIST SP 800-171 This library has served me well throughout my career. My employees have this list as required reading in their first six months on the job. I believe they will serve others well whether you are at the beginning or you have been at this for a while. Standards are the starting point - not the destination. The objective is to learn the fundaments. Then, you can specialize in any area. God bless you. Peace be with you. Sincerely, ~Keyaan
-
Keyaan J. Williams shared thisThis is the final part of a six-part series of articles about Governance and Risk Extremes. Under pressure, adaptation fails unless governance was prescriptive first. Prescriptive authority prevents drift. Enforceable boundaries force escalation while options still exist. Durable accountability keeps consequences attached to decision authority when outcomes remain uncertain. If you govern enterprise exposure, require decision ready escalation and explicit acts of acceptance, constraint, or non-acceptance.Governance must be prescriptive before it is adaptiveGovernance must be prescriptive before it is adaptive
-
Keyaan J. Williams reposted thisKeyaan J. Williams reposted this📅 𝗥𝗶𝘀𝗸 𝗚𝗼𝘃𝗲𝗿𝗻𝗮𝗻𝗰𝗲 𝗟𝘂𝗻𝗰𝗵 𝗮𝗻𝗱 𝗟𝗲𝗮𝗿𝗻 𝗼𝗻 𝗝𝘂𝗻𝗲 𝟯𝗿𝗱 📅 𝙀𝙭𝙘𝙡𝙪𝙨𝙞𝙫𝙚 𝙗𝙚𝙣𝙚𝙛𝙞𝙩 𝙛𝙤𝙧 𝙖𝙘𝙩𝙞𝙫𝙚 𝙄𝙎𝙎𝘼 𝙢𝙚𝙢𝙗𝙚𝙧𝙨 Metro Atlanta ISSA is excited to announce an EXCLUSIVE event for active ISSA members on Wednesday June 3rd! Keyaan J. Williams will be presenting a Lunch and Lunch on Risk Governance. Topics will include: : (1) Board Governance Principles, (2) Integrating Cybersecurity and Enterprise Risk Management, (3) Putting the Company in a Legally Defensible Position, and (4) Corporate Response after a Cyber or Privacy Incident. Reserve your spot now on Eventbrite! ISSA membership will be validated, then a Teams meeting invite email will be sent validated attendees at a later date. https://lnkd.in/eFMyHAJ5Risk Governance Lunch and Learn - ISSA members ONLYRisk Governance Lunch and Learn - ISSA members ONLY
-
Keyaan J. Williams reposted thisKeyaan J. Williams reposted thisCome and have a good discussion with Keyaan J. Williams and I on pragmatic vendor risk management that works for your organization.
-
Keyaan J. Williams reposted thisKeyaan J. Williams reposted this🌐 𝗬𝗼𝘂'𝗿𝗲 𝗶𝗻𝘃𝗶𝘁𝗲𝗱 𝗼𝗻 𝗔𝗽𝗿𝗶𝗹 𝟮𝟳𝘁𝗵 𝗮𝘁 𝟵𝗮𝗺 𝗣𝗧 / 𝟭𝟮𝗽𝗺 𝗘𝗧 / 𝟰𝗽𝗺 𝗔𝗰𝗰𝗿𝗮 / 𝟱𝗽𝗺 𝗟𝗼𝗻𝗱𝗼𝗻 🌎 𝗚𝗹𝗼𝗯𝗶𝗻𝗮𝗿 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀 𝗮𝗻𝗱 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀 𝘁𝗼 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗔𝗱𝗮𝗽𝘁𝗮𝘁𝗶𝗼𝗻 𝗯𝘆 𝗦𝗠𝗕𝘀 𝗧𝗿𝘂𝘀𝘁𝘄𝗼𝗿𝘁𝗵𝘆 𝗦𝘆𝘀𝘁𝗲𝗺𝘀 𝗶𝗻 𝗮𝗻 𝗔𝗜‑𝗔𝗰𝗰𝗲𝗹𝗲𝗿𝗮𝘁𝗲𝗱 𝗥𝗶𝘀𝗸 𝗘𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁 Join this Globinar to explore practical challenges and solutions for cybersecurity adaptation, featuring insights on how small and medium-sized businesses can build stronger defenses, manage risk, and stay secure in an increasingly digital economy. 🎙️ 𝗦𝗽𝗲𝗮𝗸𝗲𝗿𝘀: Keyaan J. Williams - Managing Director, CLASS-LLC Frans Meuwissen - Managing Partner in Amplify Now Global 🗓️ 𝗠𝗼𝗻𝗱𝗮𝘆, 𝗔𝗽𝗿𝗶𝗹 𝟮𝟳𝘁𝗵 at 9am PT / 12pm ET / 4pm Accra / 5pm London / 6pm CET / 8pm Dubai / 9:30pm Mumbai 🗓️ 𝗧𝘂𝗲𝘀𝗱𝗮𝘆, 𝗔𝗽𝗿𝗶𝗹 𝟮𝟴𝘁𝗵 at 12am Singapore / 1am Seoul + Tokyo / 2am Sydney 🔗 𝗥𝗲𝗴𝗶𝘀𝘁𝗲𝗿 𝗛𝗲𝗿𝗲: https://lnkd.in/gFQbTSeE
-
Keyaan J. Williams liked thisKeyaan J. Williams liked thisSeveral weeks ago, I had the honor of serving as the opening keynote speaker for Georgia State University #Cybersecurity Lunch & Learn. This was my second time being invited into that role, and I did not take it lightly. This time, I chose a different topic and a different tone. I wanted #students to understand that cybersecurity is not just about protecting #data, #networks, #devices, or #systems. It is about protecting #people. In my talk, I shared a real-world cyber dilemma around the evolving meaning of safety at work and in the marketplace. We talked about child safety, online exploitation, AI, deepfakes, sextortion, corporate governance gaps, and the responsibility cybersecurity professionals have when human harm shows up inside digital environments. For students preparing to enter the field, I wanted to offer more than career advice. I wanted to offer a practical reminder: Your technical skills will matter. Your judgment will matter more. Your values will matter most. Cybersecurity professionals sit close to the detection layer. We see patterns others may miss. We encounter risks before they become headlines. And increasingly, the threats we face are not only technical. They are #human, #moral, #legal, and #organizational. That means the next generation of cybersecurity #leaders must be prepared to lead with #competence and #conscience. I’m grateful to Whitfield Samuel for hosting and for continuing to create meaningful spaces for Georgia State students to connect with alumni and industry leaders. I was also grateful to share the agenda with presenters and panelists who could have easily been plenary speakers themselves. That kind of room reminds me why Atlanta’s technology and cybersecurity ecosystem is so special. Special thanks as well to Saprea for providing research and thought-leadership content that helped shape portions of the presentation and discussion around online safety, exploitation, and emerging cyber risks. To the Georgia State students in the room: thank you for your curiosity, your questions, and your willingness to sit with a hard topic. The future of cybersecurity will not be won by the people who only protect systems. It will be led by the people who understand who those systems are meant to protect. David W. Anna Brechin CISA, CISSP Dane Bamburry, MBA Melissa F. Felicia Hedgebeth Dathan Knott Keyaan J. Williams Chris Yadon, MPA #Cybersecurity #GeorgiaStateUniversity #CyberLeadership #TechForGood #DigitalSafety #AI #YouthSafety #Leadership
-
Keyaan J. Williams liked thisKeyaan J. Williams liked thisWe have an Intern position open on the ABM Information Security team reporting to me out of our Dunwoody office. If interested, please apply!
Experience
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Education
Licenses & Certifications
-
-
-
-
Holistic Information Security Practitioner
Holistic Information Security Practitioner Institute (HISPI)
Issued -
John Maxwell Team (JMT) Certified Member
The John Maxwell Team
Issued -
-
-
-
Certified Information Privacy Manager (CIPM)
IAPP - International Association of Privacy Professionals
Volunteer Experience
-
-
Atlanta Chapter (Founding Member)
Private Directors Association®
- Present 5 years 10 months
Economic Empowerment
-
-
-
Member, CISO Advisory Council
Information Systems Security Association (ISSA)
- 1 year 8 months
Science and Technology
-
-
Board Of Directors
Information Systems Security Association (Atlanta Chapter)
- Present 16 years
Science and Technology
Board of Directors, Chapter Advisory Board (2013-Present)
President (2012)
Vice President (2011)
Director of Association Relations (2010)
Recommendations received
11 people have recommended Keyaan J.
Join now to viewOther similar profiles
Explore more posts
-
SNH TECHNOLOGIES
🚨 70% of small businesses close within 6 months of a major cyberattack. Don’t be a stat. A resilient business doesn’t just back up data. It defends, detects, and adapts. You need proactive monitoring and real-time threat intelligence so you don't just recover from a cyberattack—you resist it.
-
Robert W.
Vulnerability Summary for the Week of November 10, 2025 The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard....
-
Manuel W. Lloyd
Doctrine Emergency Bulletin: Global SBOM Guidance Issued On September 3, 2025, CISA, NSA, and 14 allied nations released joint guidance on Software Bills of Materials (SBOMs), urging governments and industry to adopt SBOMs as a baseline for software supply chain security. This Doctrine Emergency Bulletin (DEB) underscores that transparency without sovereignty is insufficient. SBOMs reveal components — but only Zero Doctrine™ enforces isolation and doctrinal control. Join our tabletop simulation: “Supply Chain Breach Doctrine Response.”b Book here » https://lnkd.in/eWAERm8k 📜 Our Cybersecurity Constitution™ Article V, Clause 4 — Sovereign Origination of Technical Input states “No foreign-origin technical instruction shall be admitted into sovereign systems, even under domestic escort.” Stay sovereign, stay uncompromised. — Manuel W. Lloyd
-
Lockwell
Cybersecurity audits can feel intimidating—especially if you don’t have an IT team. The good news? You don’t need one. This guide shows how small organizations can get audit-ready in just 7 days using simple, accessible steps. Whether you're prepping for NIST compliance or a partner review, we’ve got you covered. 👉 https://lnkd.in/dX6c2eZV #CyberCompliance #AuditReady #SmallBizSecurity #Lockwell
6 Comments -
European Union Agency for Cybersecurity (ENISA)
#ENISA welcomes the publication of the third edition of the Guide to Developing a National Cybersecurity Strategy The updated NCS Guide is designed to help countries develop, update, and implement national #cybersecurity policies that support progress in today’s rapidly shifting digital landscape. With contributions from 37 expert organisations, this edition offers valuable insights for policymakers. Find out more below 👇 #Cybersecurity #NCSGuide #NationalCybersecurityStrategy
1 Comment -
On Call Compliance Solutions
𝗕𝘂𝗹𝗹𝗲𝘁𝗽𝗿𝗼𝗼𝗳 𝗬𝗼𝘂𝗿 𝗦𝗦𝗣 𝘄𝗶𝘁𝗵 𝗘𝘃𝗶𝗱𝗲𝗻𝗰𝗲 Want to survive CMMC or DIBCAC without surprises? Write your SSP by assessment objective and link evidence to each one. Clear proof beats “interpretation” every time. Simple. Defensible. Effective. #CMMC #NIST800171 #CyberSecurity #Compliance
-
Cyber News Live
CISA released new guidance to help critical infrastructure organizations address insider threats. The guidance outlines strategies to prevent, detect, and mitigate threats from within. Organizations and government entities should implement mandatory training, establish reporting mechanisms, and foster a culture of trust to address insider threats. 🛡️ #CyberNewsLive https://lnkd.in/eAGHdMPT
-
Virtual Service Operations
Post 6: Audit-Ready Operations "Are you ready for your CMMC assessment?" Wrong question. Right question: "Are your daily IT operations generating audit-ready evidence?" VSO's managed services are built compliance-first: Security monitoring with documented analysis Infrastructure changes with evidence trails Incident response with compliance reporting Configuration management with baseline tracking We don't prep you for audits. We operate audit-ready systems. Learn more at: https://vso-inc.com/cmmc/ #CMMC #ManagedServices #Compliance
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content