FedRAMP 20x Key Security Indicators (KSI) 2026
FedRAMP 20x Key Security Indicators (KSIs) from the FedRAMP Consolidated Rules for 2026 (release 2026.07.14.01, https://github.com/FedRAMP/rules). KSIs are outcome-oriented indicators that cloud service providers must demonstrate through automation and continuous monitoring; they do not replace the FedRAMP Rules (FRR) program obligations. Class A authorizations mandate a subset of seven KSIs via FRC-CLA-MFR; Classes B and C apply the full catalog within the Minimum Assessment Scope, with five indicators optional on Class B and required on Class C.
ProwlerRun this compliance with Prowler
Run in Prowler Cloudprowler m365 --compliance fedramp_20x_ksi_2026.07.14.01Requirements (15)
KSI-CMT-LMCModifications to the cloud service offering are logged and monitored.3
Attributes
- Theme
KSI-CMT: Change Management
- NISTControls
AU-2, CM-3, CM-3.2, CM-4.2, CM-6, CM-8.3, MA-2
- Class Applicability
Required for Classes B and C
KSI-CNA-DFPThe functionality and privileges for infrastructure and services are strictly defined.6
Attributes
- Theme
KSI-CNA: Cloud Native Architecture
- NISTControls
CM-2, SI-3
- Class Applicability
Required for Classes B and C
KSI-CNA-IBPThe use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance.1
Attributes
- Theme
KSI-CNA: Cloud Native Architecture
- NISTControls
AC-17.3, CM-2, PL-10
- Class Applicability
Required for Classes B and C
KSI-CNA-MATMachine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised.16
Attributes
- Theme
KSI-CNA: Cloud Native Architecture
- NISTControls
AC-17.3, AC-18.1, AC-18.3, AC-20.1, CA-9, SC-7.3, SC-7.4, SC-7.5, SC-7.8, SC-8, SC-10, SI-10, SI-11, SI-16
- Class Applicability
Required for Classes B and C
KSI-IAM-AAMThe lifecycle and privileges of all accounts, roles, and groups are securely managed using automation.1
Attributes
- Theme
KSI-IAM: Identity and Access Management
- NISTControls
AC-2.2, AC-2.3, AC-2.13, AC-6.7, IA-4.4, IA-12, IA-12.2, IA-12.3, IA-12.5
- Class Applicability
Required for Classes B and C
KSI-IAM-APMSecure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used.4
Attributes
- Theme
KSI-IAM: Identity and Access Management
- NISTControls
AC-3, IA-5.1, IA-5.2, IA-5.6, IA-6, AC-2, IA-2, IA-2.1, IA-2.2, IA-2.8, IA-5, IA-8, SC-23
- Class Applicability
Required for Classes B and C
KSI-IAM-ELPIdentity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need.12
Attributes
- Theme
KSI-IAM: Identity and Access Management
- NISTControls
AC-2.5, AC-2.6, AC-3, AC-4, AC-6, AC-12, AC-14, AC-17, AC-17.1, AC-17.2, AC-17.3, AC-20, AC-20.1, CM-2.7, CM-9, IA-2, IA-3, IA-4, IA-4.4, IA-5.2, IA-5.6, IA-11, PS-2, PS-3, PS-4, PS-5, PS-6, SC-4, SC-20, SC-21, SC-22, SC-23, SC-39, SI-3
- Class Applicability
Required for Classes B and C
KSI-IAM-JITA least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.5
Attributes
- Theme
KSI-IAM: Identity and Access Management
- NISTControls
AC-2, AC-2.1, AC-2.2, AC-2.3, AC-2.4, AC-2.6, AC-3, AC-4, AC-5, AC-6, AC-6.1, AC-6.2, AC-6.5, AC-6.7, AC-6.9, AC-6.10, AC-7, AC-20.1, AC-17, AU-9.4, CM-5, CM-7, CM-7.2, CM-7.5, CM-9, IA-4, IA-4.4, IA-7, PS-2, PS-3, PS-4, PS-5, PS-6, PS-9, RA-5.5, SC-2, SC-23, SC-39
- Class Applicability
Required for Classes B and C
KSI-IAM-SNUAppropriately secure authentication methods are used and persistently reviewed for non-user accounts and services.4
Attributes
- Theme
KSI-IAM: Identity and Access Management
- NISTControls
AC-2, AC-2.2, AC-4, AC-6.5, IA-3, IA-5.2, RA-5.5
- Class Applicability
Required for Classes B and C
KSI-IAM-SUSAccounts with privileged access are disabled or otherwise secured in response to suspicious activity.7
Attributes
- Theme
KSI-IAM: Identity and Access Management
- NISTControls
AC-2, AC-2.1, AC-2.3, AC-2.13, AC-7, PS-4, PS-8
- Class Applicability
Required for Classes B and C
KSI-MLA-LETA list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur.3
Attributes
- Theme
KSI-MLA: Monitoring, Logging, and Auditing
- NISTControls
AC-2.4, AC-6.9, AC-17.1, AC-20.1, AU-2, AU-7.1, AU-12, SI-4.4, SI-4.5, SI-7.7
- Class Applicability
Required for Classes B and C
KSI-MLA-OSMA Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes.1
Attributes
- Theme
KSI-MLA: Monitoring, Logging, and Auditing
- NISTControls
AC-17.1, AC-20.1, AU-2, AU-3, AU-3.1, AU-4, AU-5, AU-6.1, AU-6.3, AU-7, AU-7.1, AU-8, AU-9, AU-11, IR-4.1, SI-4.2, SI-4.4, SI-7.7
- Class Applicability
Required for Classes B and C
KSI-SVC-ASMManagement, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed.1
Attributes
- Theme
KSI-SVC: Service Configuration
- NISTControls
AC-17.2, IA-5.2, IA-5.6, SC-12, SC-17
- Class Applicability
Required for Classes B and C
KSI-SVC-SINInformation is encrypted or otherwise secured from unwanted access or modification.3
Attributes
- Theme
KSI-SVC: Service Configuration
- NISTControls
AC-1, AC-17.2, CP-9.8, SC-8, SC-8.1, SC-13, SC-20, SC-21, SC-22, SC-23, SC-28, SC-28.1
- Class Applicability
Required for Classes B and C
KSI-SVC-VCMThe authenticity and integrity of communications between machine-based information resources is persistently validated using automation.3
Attributes
- Theme
KSI-SVC: Service Configuration
- NISTControls
SC-23, SI-7.1
- Class Applicability
Optional for Class B, required for Class C