About
Meet Brian
Brian is the architect and co-creator of NIST’s Open Security Controls Assessment Language (OSCAL), as well as the inaugural chair of the OSCAL Foundation. His achievements are built on 35 years of experience with information technology (IT), quality management, business process re-engineering (BPR), and cyber solution architecture.
Throughout his career, Brian has successfully conceived, designed and implemented cybersecurity and regulatory compliance solutions for commercial and government organizations.
Whether creating the FAA’s first ATC cybersecurity program, automating assessment activities to achieve 60% execution efficiencies, or leading the first CSPs through accelerated processes on behalf of the FedRAMP PMO, Brian brings a passion for enduring results to any challenge!
The Right Experience
Over 35 years of experience:
- OSCAL Co-Creator
- FedRAMP PMO Authorization Lead
- Cloud Service Provider Trust and Compliance Manager
- Assessment Automation Design and Implementation
- Air Traffic Control System Support
- Telecommunication Industry Cyber Solutions
- Pharmaceutical Industry Cyber Program Manager
- Financial Industry Cyber Program Manager
- Government Agency Support: CBP, DoD, DOL, EPA, FAA, FedRAMP PMO, NRC, US-CERT
- Over 20 Proposals as a Cyber Solution Architect
- Architect/Cyber Tech Prop Lead with >85%
The Right Skills
Cyber Security Strategist
Process
Automation
Quality
Management
(QM)
Enterprise Security Architecture
Information Technology (IT) Administration
Business Process Re-engineering (BPR)
Cybersolution
Architect
Cyber-Solution Architecture
The Right Certifications
Certified Information System Security Professional (CISSP) since 2000
Project Management Professional (PMP) since 2009
Certified Cloud Security Professional (CCSP) since 2019
Want to know more?
Contact us for a free consultation.
Let's discuss your goals and determine how we can best help you!
News and Updates
Published! Multi-Cloud Architecture Challenges
August 25, 2026 We are excited to announce the DRAFT publication of NIST IR 8613, Multi-Cloud Architecture Challenges, which is out for public review and comment! Brian Ruf serves as a co-chair for the Multi-Cloud Security Public Working Group (MCSPWG), where he...
The Python OSCAL Library
August 15, 2026 Ruf Risk is excited to announce Version 3.1.0 of the Python OSCAL Library! Now with advanced import handling and profile processing!Brian first conceived of this library in 2020, and has been actively developing it over the past few years. Earlier...
First OSCAL-Based PCI Report
January 13, 2026 It was an honor to provide OSCAL advising and implementation support for AWS as they became the first organization to publish a compliance report in OSCAL format. The AWS Fall Payment Card Industry (PCI) Data Security Standard (DSS) Attestation of...