Trevor Vaughan

Automating compliance for fun and…mostly for fun.

Over the last couple of decades, I’ve done everything from large-scale compliance automation to helping to start a company as well as professional consulting.

My primary focus is on DevSecOps and the surrounding ecosystem, but I happily dabble in anything from business process automation to federal policy ontology mappings.

Personal Blog

Except where explicitly noted, all articles and opinions are my own and do not reflect any employer or customer views.

FIPS Enabling the FOSS Puppet Server

Intro This is primarily a running log for anyone that needs to FIPS-enable the FOSS version of Puppet. Pull Requests are most welcome if things change over...

FIPS 140-3

A Quick Note This article is written from my point of view and is trying to skirt the line between horribly boring compliance and things that folks might c...

Blogs and New Year Resolutions

Attempting to motivate myself to actually keep notes on things that I find interesting in a more organized fashion.

Java Spring STIG

This article provides guidance on ensuring that the embedded Tomcat server provided with the Spring Framework is configured in accordance with the Tomcat Sec...