TTI Technical Lead. #AWS Certified Developer Associate #AWSCertified
West Hollywood, CA
Joined April 2007
- Tweets10.8K
- Following550
- Followers254
- Likes675
1/
When I started as a CTO, I had a 90-day plan.
The plan was not to change anything yet.
That sounds passive. A founder hires a CTO to fix what is broken.
But I learned quickly that the fastest way to fail in your first 90 days is to act before you understand the company.
7/
The failure was not the original decision.
It was not revisiting the decision when the business changed.
The decisions you make in the back half of your first 90 days are only right if you spend the early weeks understanding the people, the system, and the money.
8/
I wrote up the full version here, including how listening first led to the two calls I’m proudest of:
- AI on the first pass of pull request review
- a cloud migration that cut our infrastructure bill 66%
armandomonroy.com/writing/fi…
The codebase is not going anywhere.
If your startup is building SOC 2 and HIPAA as separate projects, you're doing most of the work twice. Two sets of access control policies, two rounds of evidence collection, two vendor security reviews.
Before you start, ask your auditor to build an integrated control matrix.
A healthtech startup I reviewed had all five SOC 2 trust service criteria in their scope. Their auditor told them to include everything "to be safe." The result: 40% more audit work, five months instead of three, and $17,000 in extra costs they did not need to spend.
🤖 Made with AI
The real advantage for healthtech: about 60-70% of SOC 2 Security criteria overlap with HIPAA's Security Rule. Build them together and you save roughly a third of the total effort compared to doing them sequentially. One set of controls, two frameworks.
Scope decides speed. The fastest SOC 2 projects I have been part of all started with a clear scoping decision that matched the criteria to the product and the buyers. Everything after that moved faster because the scope was right. Full post: armandomonroy.com/writing/so…
For 23 years, HIPAA has had a quiet escape hatch called "addressable" specifications. It let healthtech startups skip controls like encryption at rest by writing a paragraph explaining why. That escape
hatch is about to close. Here is what is changing and why it matters:
🤖 Made with AI
If finalized in May 2026, you get 240 days to comply. 60 days until effective, 180 days to implement. That puts the deadline around January 2027. For a startup with five engineers and no security hire, that is not a 180-day project. Start now.
Here's the thing: enterprise health system buyers already require most of these controls. The proposed rule isn't adding new expectations. It's catching the regulation up to
where the market already is. armandomonroy.com/writing/hi…