The practitioner's guide.
A book, peer-reviewed papers, and speaking work, drawn from two decades of operating in regulated environments.
The Executive Control Plane
Building calm, governable IT and security organizations.
Most technology organizations are not ungovernable because they lack talent. They are ungovernable because they lack the structures that make ownership explicit, decisions routable, and evidence continuous.
This book provides the practitioner's framework for building those structures, drawn from two decades of operating experience in regulated environments.
Selected writing.
Operability Debt Is Not Technical Debt: An Enforceable Ledger and Promotion Gate for Regulated Software Delivery
The Operability Debt Ledger and Minimum Viable Operable gate with complete technical specifications, CI/CD integration, and results from a 22-week pilot.
In reviewThe Control Plane for Trust: Designing Organizational Reliability the Way We Design Systems
Applies the control plane metaphor from networking to organizational decision-making. Introduces a minimum viable control plane built from ownership, seams, cadence, and evidence.
In reviewStop Being the System: How to Build Privacy and AI Governance That Scales Without Heroics
Argues that privacy programs relying on specific individuals to carry compliance create operability debt. Offers a practical framework for building repeatable governance.
In reviewAvailable topics.
Chris speaks on building governable technology organizations at industry conferences and executive forums. Talks are drawn from operational experience, not theory.
The Operability Gate: Why MVPs Are Not Enough
What it takes for a system to be truly operable, not just functional. Ownership, recovery, visibility, and the evidence that makes trust possible.
The Control Plane for Trust
Applying the control plane metaphor to how organizations make decisions, handle incidents, and prove posture under pressure.
Stop Being the System
How to build privacy and security programs that scale without depending on any single person to carry the compliance burden.
Choreographing the Bad Day
Incident response as organizational design. How to make the first 30 minutes of an outage boring, predictable, and evidence-producing.
For speaking inquiries: support@oceanusnetworks.com