Key Security Indicators

Official source: Key Security Indicators (KSI), FedRAMP Consolidated Rules release 2026.10.14.01. This page is a plain-English summary. The official rule text governs.

In short

Key Security Indicators (KSIs) are the security capabilities a FedRAMP 20x cloud service offering demonstrates. There are 46 indicators in 10 themes, from identity and access management to recovery planning. Each one describes an outcome, such as “Logs are persistently reviewed and audited,” rather than a specific control to implement. KSIs are written as capability statements, not as MUST or SHOULD rules. What you must do with them comes from other rulesets: you document how you meet each KSI in your Security Decision Record, automate their verification and validation, and include them in your annual independent assessment. Class A uses 7 KSIs. Class B and C use all 46, and 5 of them are marked optional for Class B.

Who it applies to

KSIs apply to FedRAMP 20x certifications only. Rev5 certifications use Rev5 controls instead.

Class	Which KSIs	Source
Class A	7 KSIs: `KSI-CED-RAT`, `KSI-CMT-LMC`, `KSI-CNA-RNT`, `KSI-IAM-AAM`, `KSI-IAM-APM`, `KSI-INR-RIR`, `KSI-SVC-SIN`	`FRC-CLA-MFR` and the 20x Class A ruleset
Class B	All 46. Five are marked Optional for Class B (see Differences by class).	20x Class B ruleset
Class C	All 46	20x Class C ruleset
Class D	The KSI reference doesn’t publish Class D variants.

FRC-CLA-MFR says providers MUST address the listed KSIs to receive a Class A certification, even if they intend to pursue a Rev5 Program Certification path in the future.

Key dates

The Key Security Indicators reference page doesn’t publish its own effective dates. KSIs take effect through the rulesets that require them. Check the dates on those pages:

Security decision record (SDR-CSX-KSI, SDR-CSX-KMT)
FedRAMP certification (FRC-CLA-MFR, FRC-CSX-VVK)
Independent verification and validation (IVV-CSX-AIA)

How the other rules use KSIs

Rule	Force	What it means for you
`SDR-CSX-KSI`	MUST	For each applicable KSI, include short high-level summaries in your Security Decision Record: the measures that demonstrate it (or why you have none and the resulting risk), the cycle for persistent measures, verification, verification of your automation, and validation.
`SDR-CSX-KMT`	Class A MAY, Class B SHOULD, Class C MUST, Class D MUST	Include historical KSI metrics in your Security Decision Record. Class B: 30-day and up-to-a-year summaries. Class C adds all daily metric data for up to a year. Class D must significantly exceed lower classes, with specifics to be set during the 20x Phase 4 Pilot.
`FRC-CSX-VVK`	Class A MAY, Class B SHOULD, Class C MUST, Class D MUST	Implement automated methods to persistently verify and validate your KSIs. Class B: at least 1 automated method per KSI. Class C: at least 2. Class D: at least 4.
`IVV-CSX-AIA`	MUST	Class B, C and D: include all KSIs in a FedRAMP independent assessment at least once a year. Class A: meet the expectations of your underlying alternative security framework.

What you need to do

Each table lists every indicator in the theme. KSIs carry no MUST or SHOULD force, so the tables show what each indicator asks you to demonstrate. “Class A” marks the 7 indicators that apply to Class A. “Optional for Class B” marks indicators published with an Optional label for Class B. Key terms: persistently, information resource, machine-based information resources and federal customer data.

Cybersecurity education (CED)

Indicator	What it means for you
`KSI-CED-RAT` Reviewing All Training	Persistently review how effective your security training is. That covers at least general training for all employees, role-specific training for high-risk roles, secure software delivery training for engineers, and training for incident response and disaster recovery staff. Class A.

Change management (CMT)

Indicator	What it means for you
`KSI-CMT-LMC` Logging Changes	Log and monitor changes to your cloud service offering. Class A.
`KSI-CMT-RMV` Redeploying vs Modifying	Change machine-based resources by redeploying version-controlled resources instead of modifying them directly, wherever reasonable.
`KSI-CMT-RVP` Reviewing Change Procedures	Persistently review how effective your documented change management procedures are.
`KSI-CMT-VTD` Validating Throughout Deployment	Automate persistent testing and validation of changes throughout deployment.

Cloud native architecture (CNA)

Indicator	What it means for you
`KSI-CNA-DFP` Defining Functionality and Privileges	Strictly define the functionality and privileges of your infrastructure and services.
`KSI-CNA-EIS` Enforcing Intended State	Use automated services to persistently assess the security of all machine-based resources and automatically enforce their intended state. Optional for Class B.
`KSI-CNA-IBP` Implementing Best Practices	Persistently compare how you use and configure third-party machine-based resources against the original provider’s best practices and guidance.
`KSI-CNA-MAT` Minimizing Attack Surface	Persistently review machine-based resources for minimal attack surface and minimal lateral movement if compromised.
`KSI-CNA-OFA` Optimizing for Availability	Persistently review machine-based resources for high availability and rapid recovery.
`KSI-CNA-RNT` Restricting Network Traffic	Persistently review machine-based resources to make sure they limit inbound and outbound network traffic. Class A.
`KSI-CNA-RVP` Reviewing Protections	Persistently review how effective your protections are against denial of service attacks and other unwanted activity.
`KSI-CNA-ULN` Using Logical Networking	Use logical networking to enforce traffic flow controls, and persistently review it.

Identity and access management (IAM)

Indicator	What it means for you
`KSI-IAM-AAM` Automating Account Management	Use automation to securely manage the lifecycle and privileges of all accounts, roles and groups. Class A.
`KSI-IAM-APM` Adopting Passwordless Methods	Use secure passwordless authentication when feasible. Otherwise, use strong passwords with phishing-resistant MFA. Class A.
`KSI-IAM-ELP` Ensuring Least Privilege	Use and persistently review access measures so each user or device can reach only the resources it needs.
`KSI-IAM-JIT` Authorizing Just-in-Time	Use and persistently review a least-privileged, role- and attribute-based, just-in-time authorization model for all user and non-user accounts and services.
`KSI-IAM-SNU` Securing Non-User Authentication	Use and persistently review secure authentication for non-user accounts and services.
`KSI-IAM-SUS` Responding to Suspicious Activity	Disable or otherwise secure privileged accounts in response to suspicious activity.

Incident response (INR)

Indicator	What it means for you
`KSI-INR-AAR` Generating After Action Reports	Produce incident after action reports and persistently incorporate lessons learned.
`KSI-INR-RIR` Reviewing Incident Response Procedures	Persistently review how effective your documented incident response procedures are. Class A.
`KSI-INR-RPI` Reviewing Past Incidents	Persistently review past incidents for patterns or vulnerabilities not previously identified.

Monitoring, logging and auditing (MLA)

Indicator	What it means for you
`KSI-MLA-ALA` Authorizing Log Access	Use and persistently review a least-privileged, role- and attribute-based, just-in-time model for access to log data, based on data sensitivity you define. Optional for Class B.
`KSI-MLA-EVC` Evaluating Configurations	Persistently evaluate and test the configuration of machine-based resources, especially infrastructure as code.
`KSI-MLA-LET` Logging Event Types	Keep and persistently review a list of the resources and event types you log, monitor and audit, to make sure that happens.
`KSI-MLA-OSM` Operating SIEM Capability	Use and persistently review a SIEM or similar system for centralized, tamper-resistant logging of events, activities and changes.
`KSI-MLA-RVL` Reviewing Logs	Persistently review and audit logs.

Policy and inventory (PIY)

Indicator	What it means for you
`KSI-PIY-GIV` Generating Inventories	Use authoritative sources to automatically generate real-time inventories of all information resources when needed.
`KSI-PIY-RES` Reviewing Executive Support	Persistently review and demonstrate executive support for your security goals.
`KSI-PIY-RIS` Reviewing Investments in Security	Persistently review how effective your security investments are.
`KSI-PIY-RSD` Reviewing Security in the SDLC	Persistently review how well you build security and privacy into your software development lifecycle and align with CISA Secure by Design principles.
`KSI-PIY-RVD` Reviewing Vulnerability Disclosures	Persistently review how effective your vulnerability disclosure program is.

Recovery planning (RPL)

Indicator	What it means for you
`KSI-RPL-ABO` Aligning Backups with Objectives	Persistently review whether your backups of machine-based resources align with your recovery objectives.
`KSI-RPL-ARP` Aligning Recovery Plan	Persistently review whether your recovery plans align with your recovery objectives.
`KSI-RPL-RRO` Reviewing Recovery Objectives	Define your Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), and persistently review them against your business needs and capabilities.
`KSI-RPL-TRC` Testing Recovery Capabilities	Persistently test your ability to recover from incidents and contingencies in line with your recovery objectives.

Supply chain risk (SCR)

Indicator	What it means for you
`KSI-SCR-MIT` Mitigating Supply Chain Risk	Persistently identify, review and mitigate potential supply chain risks.
`KSI-SCR-MON` Monitoring Supply Chain Risk	Automatically monitor third-party software for upstream vulnerabilities, for example through contractual notification requirements or active monitoring services.

Service configuration (SVC)

Indicator	What it means for you
`KSI-SVC-ACM` Automating Configuration Management	Manage the configuration of machine-based resources with automation, and persistently review it for drift.
`KSI-SVC-ASM` Automating Secret Management	Automate, and persistently review, the management, protection and regular rotation of keys, certificates and other secrets.
`KSI-SVC-EIS` Evaluating and Improving Security	Persistently look for ways to improve the security of your information resources, and make those improvements.
`KSI-SVC-PRR` Preventing Residual Risk	After changes, persistently review plans, procedures and resource state to remove leftover elements that would likely harm the confidentiality, integrity or availability of federal customer data. Optional for Class B.
`KSI-SVC-RUD` Removing Unwanted Data	Promptly remove unwanted federal customer data when an agency asks, in line with customer agreements, including from backups if appropriate. This typically covers spills or a change in how the customer uses the service. Optional for Class B.
`KSI-SVC-SIN` Securing Information	Encrypt or otherwise protect information from unwanted access or modification. Class A.
`KSI-SVC-VCM` Validating Communications	Use automation to persistently validate the authenticity and integrity of communications between machine-based resources. Optional for Class B.
`KSI-SVC-VRI` Validating Resource Integrity	Use cryptographic methods to validate the integrity of machine-based resources.

Differences by class

Five indicators publish separate Class B and Class C statements. The wording is the same, but the Class B statement is labeled Optional:

Indicator	Class B	Class C
`KSI-CNA-EIS` Enforcing Intended State	Optional	Same statement, no Optional label
`KSI-MLA-ALA` Authorizing Log Access	Optional	Same statement, no Optional label
`KSI-SVC-PRR` Preventing Residual Risk	Optional	Same statement, no Optional label
`KSI-SVC-RUD` Removing Unwanted Data	Optional	Same statement, no Optional label
`KSI-SVC-VCM` Validating Communications	Optional	Same statement, no Optional label

All other indicators have a single statement that applies to every class that uses them. Class A uses only the 7 indicators listed under Who it applies to.

What FedRAMP staff have said

You decide what counts as a distinct automated method. On 2026-09-18, asked how FedRAMP judges whether two automated validations are distinct methods under FRC-CSX-VVK, pete-gov said it is up to the provider. Poor choices make customers less likely to find your assurance adequate. He said FedRAMP will include its own report on how assuring and diverse it finds your methods during certification. Discussion #176 comment

No FedRAMP-defined minimum configuration baseline. On 2026-09-02, in a thread about meeting secure configuration expectations for 20x (the question referred to “ACM” and to CIS benchmarks and DISA STIGs), pete-gov confirmed there is no FedRAMP-defined minimum tier, as long as your chosen configuration is risk-based, applied and evidenced. He noted that this covers only obtaining and keeping a FedRAMP Certification, and some agency customers might write such requirements into their contracts. Discussion #147 comment

Start here

Rule summaries

Discussion digests

In short

Who it applies to

Key dates

How the other rules use KSIs

What you need to do

Cybersecurity education (CED)

Change management (CMT)

Cloud native architecture (CNA)

Identity and access management (IAM)

Incident response (INR)

Monitoring, logging and auditing (MLA)

Policy and inventory (PIY)

Recovery planning (RPL)

Supply chain risk (SCR)

Service configuration (SVC)

Differences by class

What FedRAMP staff have said

​In short

​Who it applies to

​Key dates

​How the other rules use KSIs

​What you need to do

​Cybersecurity education (CED)

​Change management (CMT)

​Cloud native architecture (CNA)

​Identity and access management (IAM)

​Incident response (INR)

​Monitoring, logging and auditing (MLA)

​Policy and inventory (PIY)

​Recovery planning (RPL)

​Supply chain risk (SCR)

​Service configuration (SVC)

​Differences by class

​What FedRAMP staff have said

​Related

In short

Who it applies to

Key dates

How the other rules use KSIs

What you need to do

Cybersecurity education (CED)

Change management (CMT)

Cloud native architecture (CNA)

Identity and access management (IAM)

Incident response (INR)

Monitoring, logging and auditing (MLA)

Policy and inventory (PIY)

Recovery planning (RPL)

Supply chain risk (SCR)

Service configuration (SVC)

Differences by class

What FedRAMP staff have said

Related