Leanpub Header

Skip to main content
Go to Leanpub.com

Being Right Is Not the Same as Being Believed

Being Right Is Not the Same as Being Believed
This book is 100% completeLast updated on 2026-08-09
Jeff Christman

You are good at the cloud and new to compliance, and the scanner just flagged everything you built as a wall of red. This book teaches the two things the tool cannot do: read a finding for the risk underneath it, and get a manager, an assessor, and an Authorizing Official to act on what you found. Being right is only half the job. This is about the other half.

Minimum price

$19.00

$29.00

You pay

Author earns

$

Also available for 1 book credit with a Reader Membership

PDF
EPUB
About

About

About the Book

You built the environment. Then a scanner walked through it and returned a wall of red.

The findings feel wrong, and some of them are. A scanner checks whether a setting matches a rule. It does not see the architecture. It does not see the boundary. It does not see the control that already handles the risk. It produces findings, not truth, and on your first federal ATO that difference is most of the job.

This is a book for the cloud engineer who is good at the technology and suddenly disoriented by a process that flags the system they built as failure. You are not a beginner at cloud. You are a beginner at compliance. The distance between those two is a skill, and the skill is teachable.

That skill is translation, and it runs in two directions. Reading past a finding to the risk question underneath it is translation from a machine to the truth. Getting a manager, an assessor, or an Authorizing Official to act on that truth is translation from truth to a decision. Being right is not the same as being believed. This book teaches both, as one skill.

It stays at the layer that does not move: reasoning, control intent, and the structure of an argument that holds up under an assessor's signature. Not button locations. Not screenshots. The thinking that survives the next revision of the portal.

You are not making excuses. You are reading the system correctly, and learning to say so in a form the people above you can accept.

Share this book

Feedback

Email the Author

Author

About the Author

Jeff Christman

Jeff Christman is a cloud engineer who works at the seam where automated compliance meets real architecture. He builds and assesses systems in Azure Government and AWS GovCloud against FedRAMP and NIST 800-53, and spends most of his time on the part the tools cannot do: telling a real finding from a false one, and carrying that judgment to the managers, assessors, and Authorizing Officials who have to act on it. His current book, Reading Past the Scanner, is written for engineers meeting federal compliance for the first time. He is also the author of Designing Calm, on building a money system that fits the way your brain works, and The Grass Was Fine, a novel about an engineer assessing purgatory as an institution, one finding at a time.

Contents

Table of Contents

Chapter 1: The Scanner Is Not the Assessor

  1. What the scanner actually measures
  2. What it structurally cannot see
  3. A finding that describes nothing
  4. The wall of red and the person across the table

Chapter 2: Being Right Is Not the Same as Being Believed

  1. Two directions
  2. Telling is not explaining
  3. Everyone is speaking a different language
  4. The manager is not a wall
  5. The decision is not yours
  6. Where this leaves you

Chapter 3: Reading a Control for Intent

  1. The layers under a finding
  2. Finding the intent
  3. Intent cuts both ways
  4. The why was the intent all along
  5. One finding, read all the way down
  6. When the answer is elsewhere

Chapter 4:Inherited, Shared, and Compensating Controls

  1. A note before we go further
  2. Inherited: a control you do not own
  3. Shared: a control you own half of
  4. Compensating: a control that satisfies the intent another way
  5. What the split looks like in one system
  6. Presenting "already handled" without sounding like a dodge

Chapter 5: Discovering Compensating Controls

  1. The question is not what is missing
  2. Trace the risk to its path
  3. Inventory what is already there
  4. Test the candidate against the intent
  5. Confirm it is real, not merely present
  6. One finding, discovered all the way
  7. Discovery is not a solo act
  8. Where this leaves you

Chapter 6: Writing the Compensating Control Narrative

  1. The page is colder than the room
  2. Write to the questions a skeptic will ask
  3. Name the residual, or the whole thing reads as a sale
  4. The document is an instrument, not an argument
  5. One narrative, written to sign
  6. Where this leaves you

Chapter 7: When Best Practice and Compliance Diverge

  1. Two measurements
  2. Which way it diverges
  3. When "best practice" is the excuse
  4. Holding ground is keeping both numbers visible
  5. One finding, two measurements
  6. Where this leaves you

Chapter 8: Compliance in Infrastructure as Code

  1. Where a control lives
  2. Drift is the default returning
  3. A guardrail is a rule engine too
  4. The cost is paid up front or paid at the crunch
  5. One control, moved off the treadmill
  6. Where this leaves you

Chapter 9: Triaging Scanner Output at Scale

  1. The pile is not random
  2. Triage sorts, it does not resolve
  3. The two ways triage fails
  4. Presenting the triage, not the tracker
  5. One scan, triaged
  6. Where this leaves you

Chapter 10: Case Studies

  1. An encryption-at-rest finding on an inherited control
  2. A recovery finding you would rather dismiss
  3. Triage at scale, ending in a risk acceptance
  4. What the three have in common

Conclusion: The Reading and the Room

  1. What this was, and what it was not
  2. The reading and the room
  3. Being right, being believed, being in charge
  4. What comes next

The Leanpub 60 Day 100% Happiness Guarantee

Within 60 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.

See full terms...

Earn $8 on a $10 Purchase, and $16 on a $20 Purchase

We pay 80% royalties on purchases of $7.99 or more, and 80% royalties minus a 50 cent flat fee on purchases between $0.99 and $7.98. You earn $8 on a $10 sale, and $16 on a $20 sale. So, if we sell 5000 non-refunded copies of your book for $20, you'll earn $80,000.

(Yes, some authors have already earned much more than that on Leanpub.)

In fact, authors have earned over $15 million writing, publishing and selling on Leanpub.

Learn more about writing on Leanpub

Free Updates. DRM Free.

If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).

Most Leanpub books are available in PDF (for computers) and EPUB (for phones, tablets and Kindle). The formats that a book includes are shown at the top right corner of this page.

Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.

Learn more about Leanpub's ebook formats and where to read them

Write and Publish on Leanpub

You can use Leanpub to easily write, publish and sell in-progress and completed ebooks and online courses!

Leanpub is a powerful platform for serious authors, combining a simple, elegant writing and publishing workflow with a store focused on selling in-progress ebooks.

Leanpub is a magical typewriter for authors: just write in plain text, and to publish your ebook, just click a button. (Or, if you are producing your ebook your own way, you can even upload your own PDF and/or EPUB files and then publish with one click!) It really is that easy.

Learn more about writing on Leanpub