Skip to main content
Official source: Complete Ruleset Reference, Key Security Indicators and Rev5 Control Guidance, FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English guide. The official text governs.

​
In short

The FedRAMP Rules (FRR) tell each party what to do and when, with an explicit force (MUST, SHOULD or MAY) on every rule. The Key Security Indicators (KSI) describe what security capabilities a 20x offering must show. KSI statements carry no force keyword of their own. The FRR rules connect them: they make you summarize, automate, measure and independently assess each indicator.

​
The core distinction

One-liner: FRR tells you what to do and when, with the force of a rule. KSI tells you what a secure 20x offering looks like.

​
Who the FRR rules apply to

By subset audience, the 245 FRR rules break down as: This is overwhelmingly a provider rulebook. See Rule summaries for every ruleset.

​
The Key Security Indicator themes

Indicator IDs follow KSI-THEME-KEY, such as KSI-CED-RAT (Reviewing All Training). See the Key Security Indicators summary for each one.

​
How indicators vary by class

  • Class A uses 7 indicators, the ones listed in FRC-CLA-MFR: KSI-CED-RAT, KSI-CMT-LMC, KSI-CNA-RNT, KSI-IAM-AAM, KSI-IAM-APM, KSI-INR-RIR and KSI-SVC-SIN. The rule’s note says you need these even if you plan to move to a Rev5 path later.
  • Classes B and C use all 46 indicators (20x Ruleset Reference).
  • Five indicators are marked “Optional” for Class B and stated without that label for Class C: KSI-CNA-EIS (Enforcing Intended State), KSI-MLA-ALA (Authorizing Log Access), KSI-SVC-PRR (Preventing Residual Risk), KSI-SVC-RUD (Removing Unwanted Data) and KSI-SVC-VCM (Validating Communications).
  • Class D isn’t available for 20x yet. FedRAMP lists it as coming in 2027 (Choosing a Certification Path).

​
How FRR and KSI connect

​
1. FRR rules make the indicators enforceable

Because KSI statements have no force of their own, the obligations come from FRR rules that name them:

​
2. Both now map to NIST SP 800-53

  • KSI: 45 of the 46 indicators list related SP 800-53 controls, covering 302 unique controls and enhancements across 16 families. The only indicator without a mapping is KSI-PIY-RES (Reviewing Executive Support).
  • FRR: 35 rules list related controls, covering 59 unique controls and enhancements. Most are in Vulnerability Detection and Response (10 rules), Incident Evaluation and Communication (4) and Vulnerability Evaluation and Reporting (4).
  • These mappings changed recently. The per-rule changelogs record control-mapping updates dated 2026-10-13 on all 35 mapped FRR rules and 40 indicators. The release notes for 2026.10.14.01 don’t mention them, so check the per-rule changelog on the official page when you rely on a mapping.
If your team thinks in controls, the indicators are still the main bridge: they carry far more mappings than the FRR rules.
A control mapping is a pointer, not the requirement. The rule or indicator statement is what you must meet. A mapping doesn’t prove that implementing the control satisfies the statement.

​
3. Shared definitions

FRR rules and KSI statements both use FedRAMP Definitions, such as “persistently”, “information resource” and “machine-based information resources”. A defined term has the same meaning in both, so read the definition before you interpret either.

​
Where Rev5 control guidance fits

The Rev5 Control Guidance collection (CTL) holds FedRAMP guidance and organization-assigned parameter values for NIST SP 800-53 Rev. 5 controls. Rev5 providers MUST follow it (FRC-CSF-FFG) and use it when assigning parameters (FRC-CSF-ACP). It’s a partial guidance layer, not a full control catalog:
  • It has 79 entries across 14 control families.
  • Of the 302 controls the indicators reference, 70 have a guidance entry.
  • Three families that indicators reference have no guidance entries at all: AT (Awareness and Training), PL (Planning) and PM (Program Management).
Your Rev5 baseline is set separately, by class, in FRC-CSF-BSL: 155, 322 or 409 controls for Classes B, C and D.

​
Status and timing

  • Every FRR ruleset has the status Stable except Agency Use (AGU), which FedRAMP lists as Placeholder (Complete Ruleset Reference).
  • “Is this in effect?” is a per-ruleset question. Each ruleset has its own optional adoption, obtaining, maintaining and grace dates, and they differ between 20x and Rev5. See Key dates.

​
A short way to explain it

FRR tells providers what to do and when, with the force of a rule. KSI describes what security capabilities a 20x offering must have. The indicators become obligations through FRR rules that require you to summarize them, automate their validation, report their metrics and have them independently assessed every year. Both now point to NIST SP 800-53 controls, with the indicators carrying most of the mappings.