FedRAMP 20x pilot providers show how they measure training and incident response as security signals

In a March 2026 FedRAMP event, three Phase Two pilot providers showed how they measure whether training and incident response work. FedRAMP said Key Security Indicators ask for evidence of effectiveness, not proof that a policy exists.

By FedXchange · March 11, 2026

FedRAMP's video, on its governance tracker page. The player loads from YouTube only when you press play.

On March 11, 2026, the Federal Risk and Authorization Management Program (FedRAMP) held a 20x Community Update special event called "Using Outcomes as a Security Signal." Guest speakers from three cloud companies in the FedRAMP 20x Phase Two pilot, Confluent, Infusion Points, and Persona, described how they measure two Key Security Indicator (KSI) themes: Cybersecurity Education (CED) and Incident Response (INR). A KSI is a security outcome that a 20x provider shows evidence for, in place of a long written control description.

In short:

What FedRAMP said. A FedRAMP speaker said the KSIs ask providers to show that training and incident response work, not only that a policy exists. The speaker said everything in the event was subject to change and was meant only to inform the public.
Who it affects. Cloud service providers seeking a FedRAMP Certification through 20x, providers on Rev5 (FedRAMP's existing path, which 20x is set to replace for new applicants) thinking of moving to 20x, and agency staff who read 20x evidence.
What providers can do. Measure what they already track, review it persistently, and report it as KSI evidence. The panelists said a provider with a strong Rev5 program already has much of the work done.
What changed that day. FedRAMP launched its updated FedRAMP Marketplace during the event. The speaker also said the Consolidated Rules for 2026 would come in the next few months.

The measurement loop the pilot panelists described

Source: the March 11, 2026, FedRAMP video. This is how the panelists described their own approaches, not a FedRAMP rule.

Read the steps as text

Measure. Collect data the company already uses, such as training surveys, engagement in security chat channels, and incident response times.
Review. Review the effectiveness of training and incident response persistently, as the KSIs ask.
Find causes. Use root cause analysis and tabletop exercises to find gaps.
Change. Change training, tools, staffing, or process where the data shows a gap.
Report. Show the results to agencies as KSI evidence, for example in a trust center.

What did FedRAMP say it wants from Key Security Indicators?

The FedRAMP speaker said that in a traditional Rev5 system security plan, a training control often amounts to a training policy and a requirement that everyone take training. In the video, the speaker said FedRAMP "rewrote this after the first cohort to explain that we don't actually care if you are forcing people to take training. We want to know that you are reviewing the effectiveness of that training."

The speaker said incident response works the same way: "I don't really care if your IR policy says that you'll respond to incidents within an hour. I want to know how many times in the last year you actually responded to an incident within an hour." (Words from the video. "IR" means incident response.)

The current KSIs say this directly. In the Consolidated Rules for 2026 (CR26), KSI-CED-RAT begins "The effectiveness of relevant cybersecurity education and training is persistently reviewed" and covers general training, role-specific training for high-risk roles, secure software delivery training, and incident response or disaster recovery training. KSI-INR-RIR says "The effectiveness of documented incident response procedures is persistently reviewed."

The speaker said "persistently" is defined and can mean any known cycle: every month, or every time an incident happens. CR26's definitions now define it as "Occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties."

How did the pilot providers measure training?

Persona. A panelist showed a trust center chart of a "security engagement index," based on staff who post in or read the company's security chat channels, set against training growth. Another chart tracked secure coding patterns in recent code changes. A panelist said root causes from past incidents led the company to create that metric.
Infusion Points. A panelist said the company surveys its engineers on whether role-specific training helps them. The company pays for the first two attempts at certification exams, so the results help decide which training is worth paying for at each level of experience.
Confluent. A panelist, a site reliability engineer, said the company checks that every active account in its identity provider belongs to a person with valid training in the past 12 months. The panelist said the check found an account still active for an IT manager who had left the company.

The FedRAMP speaker said engagement in a chat channel is something no agency would ask for, but it is a meaningful signal of a security culture.

How did they measure incident response?

A Confluent panelist described a metric the description calls "Minutes of Customer Agony": how long an incident lasted, combined with how many customers it affected. The company also tracks the average time to acknowledge, mitigate, and resolve incidents, and whether action items from root cause analysis get done.

An Infusion Points panelist said the company records tabletop exercises as tickets, so the reports are machine-readable, and runs automated penetration tests. A Persona panelist said the company writes a root cause analysis for every incident, even small ones, and uses the patterns to choose tabletop scenarios.

The FedRAMP speaker read a question about events versus incidents and said the law's definition is very broad. CR26 uses the definition in 44 United States Code (U.S.C.) 3552(b)(2): an occurrence that, without lawful authority, actually or imminently jeopardizes the integrity, confidentiality, or availability of information or an information system, or that violates or threatens to violate law, security policies, security procedures, or acceptable use policies.

What did the panelists advise Rev5 providers?

An Infusion Points panelist said to start with FedRAMP's Balance Improvement Releases, such as the optional Significant Change Notifications process, and to work with agency sponsors one step at a time. The same panelist said "authorization or I guess I should say certification," because FedRAMP Notice 0004, issued February 25, 2026, had just set "FedRAMP Certification" as the single official label. That is the current term under CR26.

A Confluent panelist said a provider that already met the Rev5 Moderate baseline (now part of FedRAMP Certification Class C) has most controls in place and needs to map them to the KSIs and report them.

The FedRAMP speaker suggested running a tabletop exercise on a hard KSI, such as reviewing executive support. CR26 lists it as KSI-PIY-RES: "Executive support for achieving the provider's security goals is persistently reviewed and demonstrated." Panelists said the non-technical KSIs, such as training and supply chain risk, were the hardest to show.

A panelist also praised public comments on FedRAMP's requests for comment, RFC-0019 through RFC-0024.

How does 20x fit with agency security laws?

The FedRAMP speaker said the FedRAMP Authorization Act directs FedRAMP to build a process for agencies to review cloud security, and that the Office of Management and Budget (OMB) issued Memorandum M-24-15 as guidance. The speaker said agencies remain responsible for 44 U.S.C. chapter 35, OMB Circular A-130, and Federal Information Processing Standards (FIPS) 199 and 200. The speaker said those apply to agencies, not to private companies, and the KSIs are based on National Institute of Standards and Technology (NIST) Special Publication 800-53.

What did FedRAMP announce?

The speaker said the Consolidated Rules for 2026 would include final 20x requirements for Classes A, B, and C and Rev5 updates. The speaker said FedRAMP intended them to be valid for two years, mandatory at the end of 2026, and good until December 31, 2028. FedRAMP's changelog records CR26's release on June 24, 2026. Optional adoption began July 4, 2026, and the rules become mandatory on January 1, 2027. FedRAMP's Important Dates page does not list an end date.

FedRAMP's changelog records the updated Marketplace launch on March 11, 2026.

Sources

Share this post:LinkedIn X Email

A weekly email on Fridays, an alert on the day the watch finds something new, or both. Free.