FedRAMP 20x Key Security Indicators (KSI) 2026

fedramp_20x_ksi_2026.07.14.01

FedRAMP-20x-KSIv2026.07.14.01

OfficialVerified

FedRAMP 20x Key Security Indicators (KSIs) from the FedRAMP Consolidated Rules for 2026 (release 2026.07.14.01, https://github.com/FedRAMP/rules). KSIs are outcome-oriented indicators that cloud service providers must demonstrate through automation and continuous monitoring; they do not replace the FedRAMP Rules (FRR) program obligations. Class A authorizations mandate a subset of seven KSIs via FRC-CLA-MFR; Classes B and C apply the full catalog within the Minimum Assessment Scope, with five indicators optional on Class B and required on Class C.

33requirements443checks

Prowler prowler-compliance-fedramp-20x-ksi

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler aws --compliance fedramp_20x_ksi_2026.07.14.01

Requirements (33)

KSI-CMT-LMCModifications to the cloud service offering are logged and monitored.16

Attributes

Theme: KSI-CMT: Change Management
NISTControls: AU-2, CM-3, CM-3.2, CM-4.2, CM-6, CM-8.3, MA-2
Class Applicability: Required for Classes B and C

KSI-CMT-RMVChanges to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable.2

Attributes

Theme: KSI-CMT: Change Management
NISTControls: CM-2, CM-3, CM-5, CM-6, CM-7, CM-8.1, SI-3
Class Applicability: Required for Classes B and C

KSI-CNA-DFPThe functionality and privileges for infrastructure and services are strictly defined.6

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: CM-2, SI-3
Class Applicability: Required for Classes B and C

KSI-CNA-EISAutomated services are used to persistently assess the security of all machine-based information resources and automatically enforce their intended operational state.4

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: CA-2.1, CA-7.1
Class Applicability: Optional for Class B, required for Class C

KSI-CNA-IBPThe use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance.8

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: AC-17.3, CM-2, PL-10
Class Applicability: Required for Classes B and C

KSI-CNA-MATMachine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised.35

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: AC-17.3, AC-18.1, AC-18.3, AC-20.1, CA-9, SC-7.3, SC-7.4, SC-7.5, SC-7.8, SC-8, SC-10, SI-10, SI-11, SI-16
Class Applicability: Required for Classes B and C

KSI-CNA-OFAMachine-based information resources are persistently reviewed to ensure they are appropriately optimized for high availability and rapid recovery.37

Attributes

Theme: KSI-CNA: Cloud Native Architecture
Class Applicability: Required for Classes B and C

KSI-CNA-RNTMachine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic.11

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: AC-17.3, CA-9, CM-7.1, SC-7.5, SI-8
Class Applicability: Required for Classes B and C

KSI-CNA-RVPThe effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed.20

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: SC-5, SI-8, SI-8.2
Class Applicability: Required for Classes B and C

KSI-CNA-ULNLogical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls.9

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: AC-12, AC-17.3, CA-9, SC-4, SC-7, SC-7.7, SC-8, SC-10
Class Applicability: Required for Classes B and C

KSI-IAM-AAMThe lifecycle and privileges of all accounts, roles, and groups are securely managed using automation.6

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2.2, AC-2.3, AC-2.13, AC-6.7, IA-4.4, IA-12, IA-12.2, IA-12.3, IA-12.5
Class Applicability: Required for Classes B and C

KSI-IAM-APMSecure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used.13

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-3, IA-5.1, IA-5.2, IA-5.6, IA-6, AC-2, IA-2, IA-2.1, IA-2.2, IA-2.8, IA-5, IA-8, SC-23
Class Applicability: Required for Classes B and C

KSI-IAM-ELPIdentity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need.10

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2.5, AC-2.6, AC-3, AC-4, AC-6, AC-12, AC-14, AC-17, AC-17.1, AC-17.2, AC-17.3, AC-20, AC-20.1, CM-2.7, CM-9, IA-2, IA-3, IA-4, IA-4.4, IA-5.2, IA-5.6, IA-11, PS-2, PS-3, PS-4, PS-5, PS-6, SC-4, SC-20, SC-21, SC-22, SC-23, SC-39, SI-3
Class Applicability: Required for Classes B and C

KSI-IAM-JITA least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.24

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2, AC-2.1, AC-2.2, AC-2.3, AC-2.4, AC-2.6, AC-3, AC-4, AC-5, AC-6, AC-6.1, AC-6.2, AC-6.5, AC-6.7, AC-6.9, AC-6.10, AC-7, AC-20.1, AC-17, AU-9.4, CM-5, CM-7, CM-7.2, CM-7.5, CM-9, IA-4, IA-4.4, IA-7, PS-2, PS-3, PS-4, PS-5, PS-6, PS-9, RA-5.5, SC-2, SC-23, SC-39
Class Applicability: Required for Classes B and C

KSI-IAM-SNUAppropriately secure authentication methods are used and persistently reviewed for non-user accounts and services.13

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2, AC-2.2, AC-4, AC-6.5, IA-3, IA-5.2, RA-5.5
Class Applicability: Required for Classes B and C

KSI-IAM-SUSAccounts with privileged access are disabled or otherwise secured in response to suspicious activity.3

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2, AC-2.1, AC-2.3, AC-2.13, AC-7, PS-4, PS-8
Class Applicability: Required for Classes B and C

KSI-MLA-ALAA least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity.4

Attributes

Theme: KSI-MLA: Monitoring, Logging, and Auditing
NISTControls: SI-11
Class Applicability: Optional for Class B, required for Class C

KSI-MLA-EVCThe configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested.1

Attributes

Theme: KSI-MLA: Monitoring, Logging, and Auditing
NISTControls: CA-7, CM-2, CM-6, SI-7.7
Class Applicability: Required for Classes B and C

KSI-MLA-LETA list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur.43

Attributes

Theme: KSI-MLA: Monitoring, Logging, and Auditing
NISTControls: AC-2.4, AC-6.9, AC-17.1, AC-20.1, AU-2, AU-7.1, AU-12, SI-4.4, SI-4.5, SI-7.7
Class Applicability: Required for Classes B and C

KSI-MLA-OSMA Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes.7

Attributes

Theme: KSI-MLA: Monitoring, Logging, and Auditing
NISTControls: AC-17.1, AC-20.1, AU-2, AU-3, AU-3.1, AU-4, AU-5, AU-6.1, AU-6.3, AU-7, AU-7.1, AU-8, AU-9, AU-11, IR-4.1, SI-4.2, SI-4.4, SI-7.7
Class Applicability: Required for Classes B and C

KSI-PIY-GIVAuthoritative sources are used to automatically generate real-time inventories of all information resources when needed.3

Attributes

Theme: KSI-PIY: Policy and Inventory
NISTControls: CM-2.2, CM-7.5, CM-8, CM-8.1, CM-12, CM-12.1, CP-2.8
Class Applicability: Required for Classes B and C

KSI-RPL-ABOThe alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed.17

Attributes

Theme: KSI-RPL: Recovery Planning
NISTControls: CM-2.3, CP-6, CP-9, CP-10, CP-10.2, SI-12
Class Applicability: Required for Classes B and C

KSI-RPL-ARPThe alignment of recovery plans with defined recovery objectives is persistently reviewed.3

Attributes

Theme: KSI-RPL: Recovery Planning
NISTControls: CP-2, CP-2.1, CP-2.3, CP-4.1, CP-6, CP-6.1, CP-6.3, CP-7, CP-7.1, CP-7.2, CP-7.3, CP-8, CP-8.1, CP-8.2, CP-10, CP-10.2
Class Applicability: Required for Classes B and C

KSI-RPL-TRCThe capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested.1

Attributes

Theme: KSI-RPL: Recovery Planning
NISTControls: CP-2.1, CP-2.3, CP-4, CP-4.1, CP-6, CP-6.1, CP-9.1, CP-10, IR-3, IR-3.2
Class Applicability: Required for Classes B and C

KSI-SCR-MITPersistently identify, review, and mitigate potential supply chain risks.10

Attributes

Theme: KSI-SCR: Supply Chain Risk
NISTControls: AC-20, RA-3.1, SA-9, SA-10, SA-11, SA-15.3, SA-22, SI-7.1, SR-5, SR-6, CA-7.4, SC-18
Class Applicability: Required for Classes B and C

KSI-SCR-MONThird party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services.5

Attributes

Theme: KSI-SCR: Supply Chain Risk
NISTControls: AC-20, CA-3, IR-6.3, PS-7, RA-5, SA-9, SI-5, SR-5, SR-6, SR-8
Class Applicability: Required for Classes B and C

KSI-SVC-ACMThe configuration of machine-based information resources is managed using automation and persistently reviewed for drift.3

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: AC-2.4, CM-2, CM-2.2, CM-2.3, CM-6, CM-7.1, PL-9, PL-10, SA-5, SI-5, SR-10
Class Applicability: Required for Classes B and C

KSI-SVC-ASMManagement, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed.33

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: AC-17.2, IA-5.2, IA-5.6, SC-12, SC-17
Class Applicability: Required for Classes B and C

KSI-SVC-EISInformation resources are persistently evaluated for opportunities to improve security and those improvements are persistently made.1

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: CM-7.1, CM-12.1, MA-2, PL-8, SC-7, SC-39, SI-2.2, SI-4, SR-10
Class Applicability: Required for Classes B and C

KSI-SVC-PRRPlans, procedures, and the state of information resources are persistently reviewed after making changes to limit and remove unwanted residual elements that would likely negatively affect the confidentiality, integrity, or availability of federal customer data.4

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: SC-4
Class Applicability: Optional for Class B, required for Class C

KSI-SVC-SINInformation is encrypted or otherwise secured from unwanted access or modification.97

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: AC-1, AC-17.2, CP-9.8, SC-8, SC-8.1, SC-13, SC-20, SC-21, SC-22, SC-23, SC-28, SC-28.1
Class Applicability: Required for Classes B and C

KSI-SVC-VCMThe authenticity and integrity of communications between machine-based information resources is persistently validated using automation.3

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: SC-23, SI-7.1
Class Applicability: Optional for Class B, required for Class C

KSI-SVC-VRIUse cryptographic methods to validate the integrity of machine-based information resources.7

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: CM-2.2, CM-8.3, SC-13, SC-23, SI-7, SI-7.1, SR-10
Class Applicability: Required for Classes B and C