David Thompson

David has spent 14 years on the wrong side of the audit calendar.

At Sandbox Banking, he owned the SOC 2 and PCI DSS programs end to end. At CoSo Cloud, he added SOC 2, FedRAMP, DoD IL4, and HIPAA. Before that, he rebuilt security posture at the South Carolina Department of Revenue after a public breach.

He has lived the full framework surface: SOC 2, PCI DSS, FedRAMP, DoD IL4, HIPAA, SOX, ISO 27001, NIST 800-30, 800-53, and 800-171, STIG, and CIS. He has 20+ AWS, security, and infrastructure certifications.

David is not the person who read the framework. He is the person who ran it.