FedRAMP Key Security Indicators, explained

FedRAMP 20x asks cloud service providers to prove their security with Key Security Indicators (KSIs) instead of long written descriptions of controls. A KSI names a security outcome, such as "privileged accounts are disabled when there is suspicious activity," and the provider shows, with measures and data, that the outcome holds. This post explains what KSIs are, how many there are, how they relate to the National Institute of Standards and Technology (NIST) SP 800-53 controls, what each certification class must do with them, and what agencies should look for.

What a KSI is

A control says what protection must exist. A KSI says what result the protection must produce, and asks the provider to measure it. FedRAMP puts it this way: controls "define required protections," while KSIs "provide measurable validation that those protections are functioning properly."

Each KSI has three parts in FedRAMP's rules:

FedRAMP is deliberately vague about how to meet each one. It says the activities "vary considerably by cloud service offering." The provider decides what to measure and how. FedRAMP also warns providers not to treat KSIs as a paperwork exercise. It wants engineers, not only compliance staff, to build the measures.

The ten themes and 46 indicators

The Consolidated Rules for 2026 (CR26), published in June 2026, list 46 KSIs in ten themes. Every one is marked stable.

Many of the statements use the word "persistently." FedRAMP defines it as an activity that repeats in cycles over a long period, even if not without gaps, and whose status "will always be known." A KSI is not met once at assessment time. It is met every day the service runs.

How KSIs relate to NIST controls

KSIs do not replace the NIST SP 800-53 catalog. FedRAMP's rules file links each KSI to the controls it covers. Across all 46 indicators, the file names 209 different controls and control enhancements.

Some KSIs cover a lot of ground. "Authorizing Just-in-Time" (KSI-IAM-JIT) links to 38 controls, and "Ensuring Least Privilege" (KSI-IAM-ELP) links to 34. Two link to none: "Optimizing for Availability" (KSI-CNA-OFA) and "Reviewing Executive Support" (KSI-PIY-RES). Those two measure outcomes that the control catalog does not name directly.

For an agency, the links matter. They show which of the agency's own control questions a provider's KSI evidence helps answer.

What each class must do

FedRAMP 20x certifies services in four classes, from Class A (least assurance) to Class D (most). The KSI rules grow stricter with each class.

Sources: FedRAMP rules FRC-CSX-VVK, SDR-CSX-KMT, IVV-CSX-AIA, FRC-CLA-ASF, and FRC-CLA-MFR.

Class A works differently. A Class A provider must hold a certification from the past 12 months under FedRAMP Rev5 (the older FedRAMP process), SOC 2 Type II, or GovRAMP. On top of that, it must address 7 named KSIs:

• Logging Changes (KSI-CMT-LMC)
• Restricting Network Traffic (KSI-CNA-RNT)
• Reviewing All Training (KSI-CED-RAT)
• Automating Account Management (KSI-IAM-AAM)
• Adopting Passwordless Methods (KSI-IAM-APM)
• Reviewing Incident Response Procedures (KSI-INR-RIR)
• Securing Information (KSI-SVC-SIN)

Five KSIs are optional for Class B and required for Class C:

• Enforcing Intended State (KSI-CNA-EIS)
• Authorizing Log Access (KSI-MLA-ALA)
• Preventing Residual Risk (KSI-SVC-PRR)
• Removing Unwanted Data (KSI-SVC-RUD)
• Validating Communications (KSI-SVC-VCM)

Where the evidence lives

KSI evidence goes into the Security Decision Record (SDR). That is the 20x replacement for the system security plan: a record of the provider's security decisions, kept current over the life of the service. For each KSI, the provider must give a short summary of five things:

1. The measures that show the KSI, and what each one is for. If there are none, the reason and the risk to customers.
2. How often each persistent measure runs.
3. A check that the measures really show the KSI.
4. A check that the automation is accurate and enough, or why a measure does not need automation.
5. Proof that the measures are produced correctly and working as intended.

FedRAMP also says providers should apply all KSIs to every part of the service inside the Minimum Assessment Scope.

What this means for agencies

A KSI-based package reads differently from a Rev5 package. Instead of paragraphs about each control, you get measures, cycles, and data. Here is how to use it:

• Ask for the metrics. A Class C provider must keep daily KSI data for up to a year. Ask how long each measure has run, and what it showed when something went wrong.
• Check the class against your use. Class A covers 7 KSIs and leans on an outside framework. FedRAMP presumes Class A is adequate only for pilots, testing, or negligible-risk use.
• Map KSIs to your own controls. Each KSI lists the NIST controls it supports. Use those links to see which parts of your system security plan the provider's evidence helps with, and which parts remain yours.
• Read the reasons for gaps. A provider may skip a measure if it explains the reason and the risk to customers. Those explanations are where your risk decisions start.
• Keep reviewing. Agencies must review every Ongoing Certification Report the provider sends every 3 months. Ask that changes to KSI measures be included.

FedXchange tracks FedRAMP's rules and the federal guidance behind them, and writes agency policies and procedures that name the services an agency uses. The governance tracker lists CR26 and watches FedRAMP's rules file for changes.

Sources

• FedRAMP, Key Security Indicators, the overview for providers.
• FedRAMP, Key Security Indicators reference, all 46 indicators with their statements and linked controls.
• FedRAMP, Consolidated Rules for 2026, machine-readable rules file, fedramp-consolidated-rules.json, version 2026.10.08.01 (October 8, 2026). The counts in this post come from this file.
• FedRAMP, FedRAMP Certification rules: FRC-CSX-VVK (automated checks by class), FRC-CSX-MAS, FRC-CLA-ASF, and FRC-CLA-MFR (Class A).
• FedRAMP, Security Decision Record rules: SDR-CSX-KSI and SDR-CSX-KMT.
• FedRAMP, Independent Verification and Validation rules: IVV-CSX-AIA.
• FedRAMP, Collaborative Continuous Monitoring rules for providers: CCM-OCR-AVL, and for agencies: CCM-AGM-ROR.
• FedRAMP, Certification classes for agencies.
• NIST, SP 800-53 Rev. 5.

Icons by Font Awesome Free, licensed CC BY 4.0.