FedRAMP 20x Key Security Indicators (KSI) 2026

fedramp_20x_ksi_2026.07.14.01

FedRAMP-20x-KSIv2026.07.14.01

OfficialVerified

FedRAMP 20x Key Security Indicators (KSIs) from the FedRAMP Consolidated Rules for 2026 (release 2026.07.14.01, https://github.com/FedRAMP/rules). KSIs are outcome-oriented indicators that cloud service providers must demonstrate through automation and continuous monitoring; they do not replace the FedRAMP Rules (FRR) program obligations. Class A authorizations mandate a subset of seven KSIs via FRC-CLA-MFR; Classes B and C apply the full catalog within the Minimum Assessment Scope, with five indicators optional on Class B and required on Class C.

19requirements90checks

Prowler prowler-compliance-fedramp-20x-ksi

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler gcp --compliance fedramp_20x_ksi_2026.07.14.01

Requirements (19)

KSI-CMT-LMCModifications to the cloud service offering are logged and monitored.10

Attributes

Theme: KSI-CMT: Change Management
NISTControls: AU-2, CM-3, CM-3.2, CM-4.2, CM-6, CM-8.3, MA-2
Class Applicability: Required for Classes B and C

KSI-CNA-DFPThe functionality and privileges for infrastructure and services are strictly defined.1

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: CM-2, SI-3
Class Applicability: Required for Classes B and C

KSI-CNA-MATMachine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised.11

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: AC-17.3, AC-18.1, AC-18.3, AC-20.1, CA-9, SC-7.3, SC-7.4, SC-7.5, SC-7.8, SC-8, SC-10, SI-10, SI-11, SI-16
Class Applicability: Required for Classes B and C

KSI-CNA-OFAMachine-based information resources are persistently reviewed to ensure they are appropriately optimized for high availability and rapid recovery.7

Attributes

Theme: KSI-CNA: Cloud Native Architecture
Class Applicability: Required for Classes B and C

KSI-CNA-RNTMachine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic.3

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: AC-17.3, CA-9, CM-7.1, SC-7.5, SI-8
Class Applicability: Required for Classes B and C

KSI-CNA-ULNLogical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls.2

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: AC-12, AC-17.3, CA-9, SC-4, SC-7, SC-7.7, SC-8, SC-10
Class Applicability: Required for Classes B and C

KSI-IAM-AAMThe lifecycle and privileges of all accounts, roles, and groups are securely managed using automation.1

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2.2, AC-2.3, AC-2.13, AC-6.7, IA-4.4, IA-12, IA-12.2, IA-12.3, IA-12.5
Class Applicability: Required for Classes B and C

KSI-IAM-ELPIdentity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need.2

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2.5, AC-2.6, AC-3, AC-4, AC-6, AC-12, AC-14, AC-17, AC-17.1, AC-17.2, AC-17.3, AC-20, AC-20.1, CM-2.7, CM-9, IA-2, IA-3, IA-4, IA-4.4, IA-5.2, IA-5.6, IA-11, PS-2, PS-3, PS-4, PS-5, PS-6, SC-4, SC-20, SC-21, SC-22, SC-23, SC-39, SI-3
Class Applicability: Required for Classes B and C

KSI-IAM-JITA least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.4

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2, AC-2.1, AC-2.2, AC-2.3, AC-2.4, AC-2.6, AC-3, AC-4, AC-5, AC-6, AC-6.1, AC-6.2, AC-6.5, AC-6.7, AC-6.9, AC-6.10, AC-7, AC-20.1, AC-17, AU-9.4, CM-5, CM-7, CM-7.2, CM-7.5, CM-9, IA-4, IA-4.4, IA-7, PS-2, PS-3, PS-4, PS-5, PS-6, PS-9, RA-5.5, SC-2, SC-23, SC-39
Class Applicability: Required for Classes B and C

KSI-IAM-SNUAppropriately secure authentication methods are used and persistently reviewed for non-user accounts and services.7

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2, AC-2.2, AC-4, AC-6.5, IA-3, IA-5.2, RA-5.5
Class Applicability: Required for Classes B and C

KSI-MLA-LETA list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur.16

Attributes

Theme: KSI-MLA: Monitoring, Logging, and Auditing
NISTControls: AC-2.4, AC-6.9, AC-17.1, AC-20.1, AU-2, AU-7.1, AU-12, SI-4.4, SI-4.5, SI-7.7
Class Applicability: Required for Classes B and C

KSI-MLA-OSMA Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes.3

Attributes

Theme: KSI-MLA: Monitoring, Logging, and Auditing
NISTControls: AC-17.1, AC-20.1, AU-2, AU-3, AU-3.1, AU-4, AU-5, AU-6.1, AU-6.3, AU-7, AU-7.1, AU-8, AU-9, AU-11, IR-4.1, SI-4.2, SI-4.4, SI-7.7
Class Applicability: Required for Classes B and C

KSI-PIY-GIVAuthoritative sources are used to automatically generate real-time inventories of all information resources when needed.1

Attributes

Theme: KSI-PIY: Policy and Inventory
NISTControls: CM-2.2, CM-7.5, CM-8, CM-8.1, CM-12, CM-12.1, CP-2.8
Class Applicability: Required for Classes B and C

KSI-RPL-ABOThe alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed.4

Attributes

Theme: KSI-RPL: Recovery Planning
NISTControls: CM-2.3, CP-6, CP-9, CP-10, CP-10.2, SI-12
Class Applicability: Required for Classes B and C

KSI-SCR-MITPersistently identify, review, and mitigate potential supply chain risks.2

Attributes

Theme: KSI-SCR: Supply Chain Risk
NISTControls: AC-20, RA-3.1, SA-9, SA-10, SA-11, SA-15.3, SA-22, SI-7.1, SR-5, SR-6, CA-7.4, SC-18
Class Applicability: Required for Classes B and C

KSI-SVC-ASMManagement, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed.5

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: AC-17.2, IA-5.2, IA-5.6, SC-12, SC-17
Class Applicability: Required for Classes B and C

KSI-SVC-SINInformation is encrypted or otherwise secured from unwanted access or modification.10

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: AC-1, AC-17.2, CP-9.8, SC-8, SC-8.1, SC-13, SC-20, SC-21, SC-22, SC-23, SC-28, SC-28.1
Class Applicability: Required for Classes B and C

KSI-SVC-VCMThe authenticity and integrity of communications between machine-based information resources is persistently validated using automation.1

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: SC-23, SI-7.1
Class Applicability: Optional for Class B, required for Class C

KSI-SVC-VRIUse cryptographic methods to validate the integrity of machine-based information resources.4

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: CM-2.2, CM-8.3, SC-13, SC-23, SI-7, SI-7.1, SR-10
Class Applicability: Required for Classes B and C