FedRAMP 20x Key Security Indicators (KSI) 2026

fedramp_20x_ksi_2026.07.14.01

FedRAMP-20x-KSIv2026.07.14.01

OfficialVerified

FedRAMP 20x Key Security Indicators (KSIs) from the FedRAMP Consolidated Rules for 2026 (release 2026.07.14.01, https://github.com/FedRAMP/rules). KSIs are outcome-oriented indicators that cloud service providers must demonstrate through automation and continuous monitoring; they do not replace the FedRAMP Rules (FRR) program obligations. Class A authorizations mandate a subset of seven KSIs via FRC-CLA-MFR; Classes B and C apply the full catalog within the Minimum Assessment Scope, with five indicators optional on Class B and required on Class C.

16requirements73checks

Prowler prowler-compliance-fedramp-20x-ksi

Run this compliance with Prowler

Run in Prowler Cloud

Run

prowler kubernetes --compliance fedramp_20x_ksi_2026.07.14.01

Requirements (16)

KSI-CMT-LMCModifications to the cloud service offering are logged and monitored.1

Attributes

Theme: KSI-CMT: Change Management
NISTControls: AU-2, CM-3, CM-3.2, CM-4.2, CM-6, CM-8.3, MA-2
Class Applicability: Required for Classes B and C

KSI-CMT-RMVChanges to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable.3

Attributes

Theme: KSI-CMT: Change Management
NISTControls: CM-2, CM-3, CM-5, CM-6, CM-7, CM-8.1, SI-3
Class Applicability: Required for Classes B and C

KSI-CNA-DFPThe functionality and privileges for infrastructure and services are strictly defined.7

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: CM-2, SI-3
Class Applicability: Required for Classes B and C

KSI-CNA-MATMachine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised.14

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: AC-17.3, AC-18.1, AC-18.3, AC-20.1, CA-9, SC-7.3, SC-7.4, SC-7.5, SC-7.8, SC-8, SC-10, SI-10, SI-11, SI-16
Class Applicability: Required for Classes B and C

KSI-CNA-OFAMachine-based information resources are persistently reviewed to ensure they are appropriately optimized for high availability and rapid recovery.2

Attributes

Theme: KSI-CNA: Cloud Native Architecture
Class Applicability: Required for Classes B and C

KSI-CNA-RNTMachine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic.5

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: AC-17.3, CA-9, CM-7.1, SC-7.5, SI-8
Class Applicability: Required for Classes B and C

KSI-CNA-RVPThe effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed.5

Attributes

Theme: KSI-CNA: Cloud Native Architecture
NISTControls: SC-5, SI-8, SI-8.2
Class Applicability: Required for Classes B and C

KSI-IAM-ELPIdentity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need.10

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2.5, AC-2.6, AC-3, AC-4, AC-6, AC-12, AC-14, AC-17, AC-17.1, AC-17.2, AC-17.3, AC-20, AC-20.1, CM-2.7, CM-9, IA-2, IA-3, IA-4, IA-4.4, IA-5.2, IA-5.6, IA-11, PS-2, PS-3, PS-4, PS-5, PS-6, SC-4, SC-20, SC-21, SC-22, SC-23, SC-39, SI-3
Class Applicability: Required for Classes B and C

KSI-IAM-SNUAppropriately secure authentication methods are used and persistently reviewed for non-user accounts and services.8

Attributes

Theme: KSI-IAM: Identity and Access Management
NISTControls: AC-2, AC-2.2, AC-4, AC-6.5, IA-3, IA-5.2, RA-5.5
Class Applicability: Required for Classes B and C

KSI-MLA-LETA list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur.1

Attributes

Theme: KSI-MLA: Monitoring, Logging, and Auditing
NISTControls: AC-2.4, AC-6.9, AC-17.1, AC-20.1, AU-2, AU-7.1, AU-12, SI-4.4, SI-4.5, SI-7.7
Class Applicability: Required for Classes B and C

KSI-MLA-OSMA Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes.4

Attributes

Theme: KSI-MLA: Monitoring, Logging, and Auditing
NISTControls: AC-17.1, AC-20.1, AU-2, AU-3, AU-3.1, AU-4, AU-5, AU-6.1, AU-6.3, AU-7, AU-7.1, AU-8, AU-9, AU-11, IR-4.1, SI-4.2, SI-4.4, SI-7.7
Class Applicability: Required for Classes B and C

KSI-SCR-MITPersistently identify, review, and mitigate potential supply chain risks.1

Attributes

Theme: KSI-SCR: Supply Chain Risk
NISTControls: AC-20, RA-3.1, SA-9, SA-10, SA-11, SA-15.3, SA-22, SI-7.1, SR-5, SR-6, CA-7.4, SC-18
Class Applicability: Required for Classes B and C

KSI-SVC-ASMManagement, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed.5

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: AC-17.2, IA-5.2, IA-5.6, SC-12, SC-17
Class Applicability: Required for Classes B and C

KSI-SVC-SINInformation is encrypted or otherwise secured from unwanted access or modification.7

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: AC-1, AC-17.2, CP-9.8, SC-8, SC-8.1, SC-13, SC-20, SC-21, SC-22, SC-23, SC-28, SC-28.1
Class Applicability: Required for Classes B and C

KSI-SVC-VCMThe authenticity and integrity of communications between machine-based information resources is persistently validated using automation.10

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: SC-23, SI-7.1
Class Applicability: Optional for Class B, required for Class C

KSI-SVC-VRIUse cryptographic methods to validate the integrity of machine-based information resources.4

Attributes

Theme: KSI-SVC: Service Configuration
NISTControls: CM-2.2, CM-8.3, SC-13, SC-23, SI-7, SI-7.1, SR-10
Class Applicability: Required for Classes B and C