What Government IT Stacks Lose Between Systems
A typical agency runs one vendor for email security, another for file sharing, a third for its records system, a fourth for forms. Each secures its own channel reasonably well....
Security and Compliance Blog
Learn security strategies, compare vendors, and implement best practices to prevent breaches and compliance violations from risky third party communications.
Posts by Paul Sechser
Paul Sechser, Public Sector Director | Federal & Defense Cybersecurity Leader | Zero-Trust and CMMC 2.0 Strategist, Kiteworks
With over two decades of experience advancing cybersecurity, compliance, and data governance across the federal and defense sectors, Paul Sechser leads Kiteworks’ public sector strategy, helping agencies modernize and secure sensitive data exchange. As Public Sector Director, he partners with DoD, civilian, and intelligence organizations to implement Zero-Trust architectures, unify data control across systems, and achieve continuous compliance with CMMC 2.0, NIST 800-171, FedRAMP, and DFARS requirements.
Paul’s career is defined by his ability to bridge mission assurance and cybersecurity innovation—translating policy mandates into actionable governance frameworks that strengthen national resilience. Known for his deep understanding of defense acquisition, regulatory enforcement, and secure collaboration, he drives programs that deliver measurable gains in audit readiness, operational efficiency, and cyber maturity across complex ecosystems.
What Public Sector Audit Trails Actually Need to Withstand
An agency can usually produce an access log when an oversight body asks. Far fewer can answer a harder question: could someone with administrative access have quietly edited that log...
Government GRC and the Architecture Problem Underneath It
Risk, compliance and IT security teams at most agencies each work from their own systems: a risk register, a policy configuration, a separate audit log export. Each team can answer...
Public Records Cross More Systems Than Most Agencies Track
Most agencies do not have one data governance policy. They have several: one for the records system, another for email, a different one again for file sharing, and often no...
Public Sector Agencies Face the Same 24-Hour Bar as Everyone Else
Public sector agencies classified as essential or important entities face a fixed reporting clock once a significant incident is discovered: 24 hours for an early warning, 72 for a detailed...
What CUI Protection Actually Requires From Key Custody
Every platform vendor serving defence contractors says CUI is encrypted. That claim hides the detail that actually determines protection: who holds the key. If the vendor holds it, encryption protects...
Citizen Records and the Question of Who Can Actually Decrypt Them
Every platform vendor serving government agencies says citizen data is encrypted. That claim hides the detail that actually determines protection: who holds the key. If the vendor holds it, encryption...
Citizen Data Location Is a Sovereignty Decision, Not a Hosting Default
A government agency can usually confirm which country hosts its citizen records. Fewer can confirm whether the provider operating that infrastructure is itself subject to a foreign jurisdiction that could...
5 Critical Security Challenges in Defense Supply Chain Communications
Defense contractors face unprecedented scrutiny over their cybersecurity posture as nation-state actors increasingly target supply chain vulnerabilities. Recent high-profile breaches have demonstrated how attackers exploit weaknesses in contractor communications to...
DFARS Class Deviation 2026-O0025, Revision 3: What It Actually Changes for CMMC
Defense contractors watching the CMMC timeline got another data point on September 3, 2026, when the Department of War issued Revision 3 of DARS Class Deviation 2026-O0025. The revision writes...
How to Secure Interagency Data Transfers in Public Administration
Government agencies regularly exchange sensitive information across organisational boundaries, creating complex security challenges that traditional perimeter-based defences cannot adequately address. From citizen records and intelligence briefings to procurement data and...
Best Practices for Government Document Classification and Protection
Government agencies handle extraordinarily sensitive information that demands rigorous protection standards. From intelligence reports and diplomatic communications to citizen data and operational plans, these documents require classification systems that balance...
How to Secure Classified Information Sharing Between Government Departments
Government departments handle some of the most sensitive information imaginable—intelligence reports, defence assessments, diplomatic communications, and critical infrastructure data. When these agencies need to collaborate and share classified materials, they...
What Public Sector Organizations Need for FedRAMP-Equivalent AI Security
Artificial intelligence adoption in government agencies requires security controls that match the sensitivity of mission-critical data and operations. Public sector organizations face unique challenges when implementing AI systems: they must...
Data Sovereignty for National Security
In today’s interconnected digital world, data sovereignty has become a cornerstone of national security strategy. As governments handle increasingly sensitive information across borders and partnerships, the ability to maintain control...