<?xml version="1.0" encoding="UTF-8"?>
<!-- Generated by scripts/build-blog.mjs — run `npm run blog` to refresh. -->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://ctrlfort.com/</loc>
    <lastmod>2026-09-03</lastmod>
    <changefreq>monthly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/</loc>
    <lastmod>2026-09-03</lastmod>
    <changefreq>weekly</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/risk-register-that-actually-works</loc>
    <lastmod>2026-09-03</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/threat-vulnerability-residual-risk-model</loc>
    <lastmod>2026-09-02</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/repeatable-explainable-defensible-ai-assessments</loc>
    <lastmod>2026-09-01</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/control-parameters-itsp10033</loc>
    <lastmod>2026-08-31</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/mandatory-security-controls-government-of-canada</loc>
    <lastmod>2026-08-30</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/beyond-checklists-repeatable-security-assessments</loc>
    <lastmod>2026-08-25</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/itsp10033-vs-nist-800-53</loc>
    <lastmod>2026-08-25</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/cloud-security-assessment-and-authorization</loc>
    <lastmod>2026-08-24</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/continuous-monitoring-and-ongoing-assurance</loc>
    <lastmod>2026-08-23</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/authorization-decisions-ato-iato-risk-acceptance</loc>
    <lastmod>2026-08-16</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/security-assessment-reports-and-poams</loc>
    <lastmod>2026-08-09</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/from-finding-to-risk-statement</loc>
    <lastmod>2026-08-02</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/assessing-control-effectiveness</loc>
    <lastmod>2026-07-26</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/control-responses-and-evidence-collection</loc>
    <lastmod>2026-07-19</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/control-profile-selection-and-tailoring</loc>
    <lastmod>2026-07-12</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/security-categorization-and-assessment-scoping</loc>
    <lastmod>2026-07-05</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/what-makes-assessment-evidence-defensible</loc>
    <lastmod>2026-06-28</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/assessments-dont-reduce-risk-decisions-do</loc>
    <lastmod>2026-06-21</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/saa-terminology-explained</loc>
    <lastmod>2026-06-14</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://ctrlfort.com/blog/what-is-security-assessment-and-authorization</loc>
    <lastmod>2026-06-07</lastmod>
    <changefreq>yearly</changefreq>
    <priority>0.8</priority>
  </url>
</urlset>
