Why Carl for Your Boardroom or Executive Audience
The most expensive lesson in regulatory compliance is the one organizations learn at audit. Tooling stacks have grown. Automation has matured. GRC platforms produce dashboards that look reassuring on a Tuesday and collapse the first time an OCR investigator, a CMMC assessor, or a state AG asks what's actually behind the green checkmarks. The problem is rarely the tools. The problem is the absence of experienced regulatory judgment sitting above them.
Carl B. Johnson has spent 30 years inside the rules that govern high-risk organizations. As CISO at Cleared Systems, he runs active vCISO engagements every week for healthcare systems, defense suppliers, federal contractors, and technology companies operating under serious regulatory pressure — HIPAA, CMMC, NIST 800-171, ITAR, CUI, and the rapidly evolving rules around AI and privacy. His keynote work draws directly from those engagements: what's failing in real programs, what auditors and regulators are flagging this quarter, and what experienced leadership actually changes about how a program performs.
For board meetings, executive offsites, audit committee briefings, and CISO roundtables, Carl delivers the kind of content that helps senior leadership ask sharper questions and make better decisions about regulatory oversight — not just at the technical level, but at the governance level where the consequential calls actually get made.
Available Sessions on Regulatory vCISO Leadership
Regulatory vCISO Services for High-Risk Organizations
The keynote built from active vCISO engagements across healthcare, defense, federal contracting, and technology. Covers why tools and automation alone keep failing under audit, what experienced regulatory leadership materially changes about program maturity, the failure patterns Carl sees most often inside organizations that thought they were covered, and the governance shape that distinguishes programs that hold up from programs that crack. Audience walks away with a clear-eyed picture of where regulatory judgment belongs in their operating model.
When Compliance Tools Aren't Enough: What Boards Should Be Asking
Focused briefing for boards, audit committees, and senior executive teams. Skips the technical detail and goes straight to governance: the questions directors should be asking the CIO, CISO, and Chief Compliance Officer about regulatory program maturity, the warning signs that show up before an audit failure, the M&A diligence questions that surface real compliance risk, and the oversight patterns that distinguish well-governed programs from ones running on tool dashboards and hope.
Building a Regulatory vCISO Function: In-House, Fractional, or Outsourced
Hands-on session for executive teams, compliance leaders, and audit committee chairs evaluating how to bring regulatory leadership into their organization. Covers when a full-time CISO is the right answer versus a fractional or vCISO model, what the function should actually be responsible for, the reporting structure that gives it real authority, the budget shape that's realistic at different organization sizes, and the failure patterns to avoid when standing up the function.
Download the One-Sheet
Get a printable, shareable PDF of this topic — perfect for circulating to your event committee or program chair. Includes the same sessions, audience profile, and FAQs as this page in a 2-page format.
Who This Is For
Audiences where regulatory governance is a boardroom-level concern — the people responsible for oversight, not the people running the controls.
- Boards and audit committees
- Executive leadership offsites
- CISO roundtables and peer groups
- GRC and compliance association events
- M&A diligence and integration sessions
- Private equity portfolio operations forums
- CFO and CRO leadership events
- Industry events for highly regulated sectors
What Audiences Walk Away With
- A clear-eyed view of where compliance tooling stops working and where experienced regulatory judgment has to take over
- The specific failure patterns Carl sees most often in organizations that thought they were covered
- A working framework for evaluating whether a full-time CISO, fractional CISO, or vCISO model is right for the organization
- The governance and reporting structure that gives a compliance function real authority — not just budget
- The board-level questions that surface real regulatory risk in M&A diligence before it becomes a post-close problem
- A practical view of what the compliance function should own, what it should challenge, and what it should escalate