<?xml version="1.0" encoding="UTF-8"?>
<!--
  Pages are listed by hand. Articles are listed by tools/compile.py, one per
  compiled page. This site is the canonical home of the articles.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://federatedcybersecurity.com/</loc></url>
  <url><loc>https://federatedcybersecurity.com/federated-cybersecurity.html</loc></url>
  <url><loc>https://federatedcybersecurity.com/federated-cyber-risk.html</loc></url>
  <url><loc>https://federatedcybersecurity.com/federated-third-party-risk.html</loc></url>
  <url><loc>https://federatedcybersecurity.com/federated-practice-monitoring.html</loc></url>
  <url><loc>https://federatedcybersecurity.com/articles.html</loc></url>
  <url><loc>https://federatedcybersecurity.com/terms.html</loc></url>
  <url><loc>https://federatedcybersecurity.com/about.html</loc></url>

  <!-- The compiler (tools/compile.py) rewrites everything between these two comments. -->
  <!-- articles:start -->
  <url>
    <loc>https://federatedcybersecurity.com/articles/what-federated-cyber-risk-is.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/five-principles-of-participation.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/from-doctor-to-public-health-official.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/five-core-principles.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/why-central-risk-management-stalls.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/misaligned-incentives.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/coverage-visibility-culture.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/what-full-coverage-costs.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/what-safety-culture-teaches-security.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/how-the-methodologies-developed.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/the-ownership-conversation.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/making-the-case-to-leadership.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/winning-over-stakeholders.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/governance-for-a-federated-program.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/defining-the-operating-model.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/putting-the-operating-model-to-work.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/who-is-on-a-resource-team.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/choosing-your-first-teams.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/supporting-new-teams.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/scaling-in-waves.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/risk-first-then-the-plan.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/a-security-plan-in-an-hour.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/five-kinds-of-waste-in-security-planning.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/document-once.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/one-inventory-many-baselines.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/build-from-where-you-are.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/the-operational-minimum.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/who-signs.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/questions-a-non-specialist-can-answer.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/yes-no-or-not-applicable.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/when-a-team-reports-a-gap.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/progress-you-can-see.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/following-a-gap-to-its-fix.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/signals-not-verdicts.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/two-scores.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/reading-patterns.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/deciding-where-to-intervene.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/from-pattern-to-playbook.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/monitoring-yourself.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/how-risk-is-quantified.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/working-at-the-objective-level.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/we-use-central-it-so-were-covered.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/whose-gap-is-it.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/shared-responsibility-is-not-shared-access.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/valuing-a-program-without-incident-data.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/dependency-trees-and-drift.html</loc>
    <lastmod>2026-10-11</lastmod>
  </url>
  <url>
    <loc>https://federatedcybersecurity.com/articles/how-common-control-services-work.html</loc>
    <lastmod>2026-10-09</lastmod>
  </url>
  <!-- articles:end -->
</urlset>
