By Justin Beals, CEO & Founder, Strike Graph
In 2027, federated compliance will become the standard operating model for enterprises, prime contractors and any organization that attests for more than the systems it directly controls. The driver is shadow compliance: the compliance work, evidence and risk decisions that happen outside the program leadership thinks it is running. Regulators have spent the last two years moving accountability onto the individuals who sign attestations. In 2027, those individuals will stop signing for activity they can’t see.
Shadow Compliance Is Shadow IT for Your Audit Program
Every security leader knows shadow IT. On SecureTalk, Chuck Borges, the Social Security Administration’s first dedicated Chief Data Officer, described data being duplicated into cloud environments where people worked on it outside the governance that existed. The same pattern now runs through compliance programs.
It shows up in four places. Subsidiaries and plants run their own audits out of their own spreadsheets, so every acquisition or new facility multiplies the compliance effort. Regulated data leaves the boundary through normal work: an engineer copies specifications into a Teams channel, a program manager references them in a SharePoint proposal draft, finance pulls cost data for a subcontractor invoice. None of that is negligence, and all of it extends exposure past what the System Security Plan describes. Suppliers answer questionnaires nobody verifies. And platforms report green checkmarks for controls no one at the organization designed or tested.
In every case, the person accountable for the result has no evidence of what happened.
Why 2027 Forces the Issue
Accountability now sits with named individuals. The Affirming Official at one of our customers, an $8.5 billion prime contractor for the Department of War, pulled me aside with a concern: they were liable for their entire supply chain’s flow-down requirements, and a security questionnaire plus an SPRS score wasn’t going to cut it. They read DFARS correctly. DFARS 252.204-7012(m) requires the prime to flow the clause to subcontractors without alteration, and the prime remains responsible for enforcement. DFARS 252.204-7021 requires the Affirming Official to affirm continuous compliance annually in SPRS. DOJ recovered $52 million under its Civil Cyber-Fraud Initiative in FY2025, and those cases turn on attestation gaps.
The July 13, 2026 suspension of CMMC Phase 2 raised the stakes. The third-party assessment requirement is on hold, and the self-assessment and SPRS affirmation remain. With no C3PAO in the loop, nobody else catches a supplier’s gap before the prime attests to it. Primes can still require third-party assessments from subcontractors by contract, but the signature on the affirmation is still theirs.
The same structure exists outside defense. SOX Section 404 holds management responsible for internal controls over financial reporting, including outsourced operations. NIS2 holds management bodies liable for gross negligence, and DORA allows individual penalties for ICT governance failures.
Meanwhile, the workload keeps growing. In Strike Graph’s 2025 State of AI in Compliance Report, 75.8% of respondents expected the number of frameworks they manage to increase or become more complex, and only 4.4% reported high confidence that their current processes could keep pace. More frameworks across more entities, signed by fewer people with more personal exposure, created shadow compliance. That same pressure will end it.
Centralizing Everything Fails, and So Does Letting Everyone Go Their Own Way
The instinct is to pull everything to headquarters. Centralized audits don’t scale across dozens or hundreds of subsidiaries and subcontractors. Each has its own infrastructure, its own data boundaries and its own security maturity. A single template creates bottlenecks, inflates costs and misses the details that decide whether security works.
Pure decentralization fails in the other direction. When entities and suppliers self-attest without verifiable evidence, the parent inherits risk it can’t measure, and the Affirming Official signs for it anyway.
What Federated Compliance Looks Like
Federated compliance gives each entity local accountability for its own implementation and evidence, then feeds that evidence into shared verification so the parent organization can see and validate the whole. Four capabilities define it.
- The parent publishes standards. Corporate defines risks, controls and evidence requirements once and pushes them to some or all entities.
- Entities customize locally. A plant or subsidiary inherits the corporate standard and adds controls for its own regulations without affecting anyone else.
- Controls get inherited once and recorded. When central IT or HR runs a control, business units subscribe to that control and its evidence, so one group’s security implementation becomes documented compliance evidence for another.
- Evidence gets tested. Suppliers and entities submit evidence, and that evidence is checked against the requirement it claims to meet, on a schedule that keeps it current.
We saw this work with Sanmina on CMMC preparation. A federated data architecture gave the parent organization enterprise visibility while each facility kept its own controls, and the company demonstrated comprehensive supply chain management to assessors.
In manufacturing and defense supply chains, these assessments run to hundreds of evidence artifacts per location. Nobody can manage that volume centrally by hand, and nobody can trust it if each site manages it alone.
Three Predictions for 2027
First, executives who sign attestations will require evidence from subsidiaries and suppliers before they sign. Questionnaires will stop counting as proof for anyone handling regulated data.
Second, the metrics will change. Boards and primes will track the share of suppliers with current third-party assessments versus self-attestations, POA&M remediation velocity, evidence freshness, and which controls each entity inherits from another. The age of the evidence will matter more than a percent-compliant score.
Third, GRC tools will split along architecture. Platforms that lock frameworks, controls and evidence inside isolated workspaces can separate entities, but they can’t govern them. Enterprises will move to tools that model inherited controls and shared evidence across entities, because that is the only way one attestation can accurately reflect many organizations.
When I was a CTO, I spent weeks before every audit gathering evidence, mapping controls and hoping I hadn’t missed anything. That was for one company. In 2027, the people signing attestations will answer for dozens or hundreds of organizations at once. The organizations that federate will be able to show the evidence behind every signature. The rest will keep running compliance in the shadows until an assessor, a customer or the DOJ finds the gap first.
##
ABOUT THE AUTHOR
Justin Beals is the CEO and Founder of Strike Graph, an AI-native compliance platform that works with more than 300 organizations on frameworks including SOC 2, ISO 27001, CMMC and HIPAA. He founded Strike Graph in 2020 at Madrona Venture Labs after dealing with long security review cycles firsthand as a startup CTO. He has more than 20 years of experience building AI systems. Before Strike Graph, he served as CTO of NextStep and of Koru, which won the 2018 Most Impactful Startup award from Wharton People Analytics. He holds a patent for the Training, Tracking & Placement System and authored “Aligning curriculum and evidencing learning effectiveness using semantic mapping of learning assets,” published in the International Journal of Emerging Technologies in Learning (iJET). Justin hosts the SecureTalk podcast, serves on the board of Ada Developers Academy, and earned a BA from Fort Lewis College. He is based in the Seattle area.
