Identity provider
Account lifecycle, authentication strength, least privilege, just-in-time access and non-user credentials. Covers most KSI-IAM indicators.
Continuous validation under FedRAMP 20x
Key Security Indicators (KSIs)
Key takeaway: Key Security Indicators (KSIs) are the measurable security outcomes a FedRAMP 20x provider demonstrates persistently. The Consolidated Rules for 2026 (CR26) reference lists 10 themes and 46 indicators, and Class A uses a set of 7. For each applicable KSI a provider records the measures, the review cycle, and how they were verified and validated in its Security Decision Record (SDR), and a FedRAMP Recognized independent assessment service includes all KSIs in an assessment at least once a year for Class B and Class C. These rules apply to 20x certifications to obtain from July 4, 2026 and to maintain from January 1, 2027.
Use this page to see every indicator, how a KSI is proven, which dates apply and where the evidence comes from. Related guides: What Is FedRAMP 20x, the 20x roadmap, certification classes, OSCAL for FedRAMP and VDR and VER.
10themes in the CR26 KSI reference
46indicators across those themes
7indicators for Class A, in 6 themes
Jan 1, 2027SDR and independent assessment rules apply to maintain 20x certification
Dates checked against fedramp.gov on October 14, 2026. Indicator wording is paraphrased from the CR26 reference.
What a KSI is
From a narrative to a measured outcome
A Key Security Indicator is an outcome statement for a cloud service, such as access is limited to what each user needs, or logs are persistently reviewed. A provider does not answer it once in a narrative. It sets up measures, runs them on a cycle, and shows that they are accurate and working.
Every indicator in the CR26 reference lists the NIST SP 800-53 controls it relates to, and FedRAMP updated those control mappings on October 13, 2026. CR26 launched on June 24, 2026. The indicators use the word persistently: a review that happens on a defined cycle, ideally through automation, not a point-in-time check.
The KSI rules in the Security Decision Record and the independent assessment rulesets are labeled 20x. Rev5 providers follow the Rev5 rulesets and control baselines instead.
Primary sources CR26 Key Security Indicators, Class A KSIs.
Ten themes
The ten KSI themes
CR26 groups the 46 indicators into ten themes. Each prefix is the middle part of the indicator ID.
| Theme | Prefix | Indicators | What it covers |
|---|---|---|---|
| Cybersecurity Education | CED | 1 | Whether training works for general staff, high-risk roles, developers and incident staff. |
| Change Management | CMT | 4 | Logging changes, redeploying instead of modifying, reviewing procedures, validating during deployment. |
| Cloud Native Architecture | CNA | 8 | Defined functions and privileges, intended state, attack surface, availability, traffic limits, denial-of-service protection. |
| Identity and Access Management | IAM | 6 | Account automation, phishing-resistant authentication, least privilege, just-in-time access, non-user credentials. |
| Incident Response | INR | 3 | After-action reports, procedure review and learning from past incidents. |
| Monitoring, Logging, and Auditing | MLA | 5 | Log access, configuration evaluation, event types, SIEM operation and log review. |
| Policy and Inventory | PIY | 5 | Inventories, executive support, security investment, secure development and vulnerability disclosure. |
| Recovery Planning | RPL | 4 | Backups, recovery plans, recovery objectives and recovery testing. |
| Supply Chain Risk | SCR | 2 | Mitigating supply chain risk and monitoring third-party software for upstream vulnerabilities. |
| Service Configuration | SVC | 8 | Configuration drift, secrets, residual risk, unwanted data, information protection, communications and resource integrity. |
The seven Class A indicators are KSI-CED-RAT, KSI-CMT-LMC, KSI-CNA-RNT, KSI-IAM-AAM, KSI-IAM-APM, KSI-INR-RIR and KSI-SVC-SIN, across six themes. The Class A ruleset reference lists three rulesets: Certification Package Overview, FedRAMP Certification and Marketplace Listing. The Class B and Class C KSI pages list the full set of 46. Four indicators carry class tags in the reference (KSI-CNA-EIS, KSI-MLA-ALA, KSI-SVC-PRR and KSI-SVC-RUD), so confirm the tag for your class on fedramp.gov before you scope.
Primary sources CR26 Key Security Indicators, Class A KSIs.
How a KSI is proven
From measure to independent assessment
Under CR26 the Security Decision Record carries the evidence, and a FedRAMP independent assessment tests it.
Define measures
For each applicable KSI, decide the measures that show the outcome and the objective each measure serves.
Run them persistently
Set the cycle for each persistent measure and automate it where it makes sense.
Record them in the SDR
SDR-CSX-KSI: summarize the measures, the cycle, how they were verified and how they were validated.
Independent assessment
IVV-CSX-AIA: include all KSIs in a FedRAMP independent assessment at least once a year (Class B and Class C).
Keep the metrics
SDR-CSX-KMT: Class C keeps historical metrics. Class B should keep a 30-day summary.
The independent assessment is done by a FedRAMP Recognized independent assessment service. FedRAMP itself can perform it only for explicitly prioritized services, which the rules call extremely rare. The Security Decision Record replaces the traditional System Security Plan for 20x.
The rules, by ID
Rule IDs and requirements as published for 20x Class B and Class C.
| Rule | Applies to | What it requires |
|---|---|---|
| SDR-CSX-KSI | Class B and C, 20x | MUST include, for each applicable KSI, short summaries of the measures and their objectives, the cycle for persistent measures, verification that the measures demonstrate the KSI and that the automation is accurate, and validation that the measures work as intended. |
| SDR-CSX-KMT | Class C: MUST. Class B: SHOULD. | Include a 30-day summary of each metric and a summary up to the past year where available. Class C also includes all daily metric data up to the past year where available. FedRAMP changed the Class B rule from MUST to SHOULD on October 8, 2026. |
| SDR-CSO-FRR | Class B and C | MUST provide the SDR in human-readable and JSON formats and cover, for each applicable rule, how it is followed, verification, validation, independent verification and validation, responses to comments and artifacts. |
| IVV-CSX-AIA | Class B and C, 20x | MUST include all Key Security Indicators in a FedRAMP independent assessment at least once per year. |
| IVV-IAS-VIM | Assessor, Class B and C | MUST verify that implemented measures match the documented measures by reviewing the measures themselves, not only documentation or screenshots. |
| IVV-IAS-VEF | Assessor, Class B and C | MUST validate that the implemented measures achieve their intended outcomes. |
Effective dates
When the SDR and independent assessment rules apply
Optional adoption and initial certification began July 4, 2026. Maintaining a 20x certification under the rules starts January 1, 2027. The grace period ends at the first FedRAMP independent assessment started after January 1, 2027.
Primary sources Security Decision Record, Class B, Security Decision Record, Class C, Independent Verification and Validation, Class B, Independent Verification and Validation, Class C.
All 46 indicators
Every CR26 Key Security Indicator
The full CR26 list, in theme order.
| Indicator | Name | What it asks | Class tag |
|---|---|---|---|
| KSI-CED-RAT | Reviewing All Training | Training effectiveness is persistently reviewed for general staff, high-risk roles, secure development and incident response or recovery staff. | Class A set |
| KSI-CMT-LMC | Logging Changes | Changes to the cloud service offering are logged and monitored. | Class A set |
| KSI-CMT-RMV | Redeploying vs Modifying | Changes to machine-based resources are made by redeploying version-controlled resources where reasonable, not by direct modification. | |
| KSI-CMT-RVP | Reviewing Change Procedures | Documented change procedures are persistently reviewed for effectiveness. | |
| KSI-CMT-VTD | Validating Throughout Deployment | Testing and validation of changes during deployment is automated. | |
| KSI-CNA-DFP | Defining Functionality and Privileges | Infrastructure and service functions and privileges are strictly defined. | |
| KSI-CNA-EIS | Enforcing Intended State | Automated services assess security and enforce the intended operational state. | Class-tagged, Optional |
| KSI-CNA-IBP | Implementing Best Practices | Use and configuration of third-party resources are compared against provider best practices. | |
| KSI-CNA-MAT | Minimizing Attack Surface | Resources keep a minimal attack surface and limit lateral movement if compromised. | |
| KSI-CNA-OFA | Optimizing for Availability | Resources are persistently reviewed for high availability and rapid recovery. | |
| KSI-CNA-RNT | Restricting Network Traffic | Resources are reviewed to limit inbound and outbound traffic. | Class A set |
| KSI-CNA-RVP | Reviewing Protections | Protection against denial-of-service and other unwanted activity is persistently reviewed. | |
| KSI-CNA-ULN | Using Logical Networking | Logical networking is used and reviewed to enforce traffic flow controls. | |
| KSI-IAM-AAM | Automating Account Management | Account, role and group lifecycles and privileges are managed through automation. | Class A set |
| KSI-IAM-APM | Adopting Passwordless Methods | Passwordless authentication is used where feasible, otherwise strong passwords with phishing-resistant MFA. | Class A set |
| KSI-IAM-ELP | Ensuring Least Privilege | Access is limited to what each user or device needs and is reviewed persistently. | |
| KSI-IAM-JIT | Authorizing Just-in-Time | A least-privilege, role- and attribute-based, just-in-time model covers all user and non-user accounts and services. | |
| KSI-IAM-SNU | Securing Non-User Authentication | Non-user accounts and services use appropriately secure authentication, reviewed persistently. | |
| KSI-IAM-SUS | Responding to Suspicious Activity | Privileged accounts are disabled or otherwise secured when suspicious activity occurs. | |
| KSI-INR-AAR | Generating After Action Reports | After-action reports are generated and lessons learned are incorporated. | |
| KSI-INR-RIR | Reviewing Incident Response Procedures | Documented incident response procedures are persistently reviewed. | Class A set |
| KSI-INR-RPI | Reviewing Past Incidents | Past incidents are reviewed for patterns or vulnerabilities not previously identified. | |
| KSI-MLA-ALA | Authorizing Log Access | A least-privilege, role- and attribute-based, just-in-time model governs log access, based on data sensitivity. | Class-tagged, Optional |
| KSI-MLA-EVC | Evaluating Configurations | Machine-based resource configurations, especially infrastructure as code, are persistently evaluated and tested. | |
| KSI-MLA-LET | Logging Event Types | A list of resources and event types to be logged, monitored and audited is maintained and reviewed. | |
| KSI-MLA-OSM | Operating SIEM Capability | A SIEM or similar system provides centralized, tamper-resistant logging, reviewed persistently. | |
| KSI-MLA-RVL | Reviewing Logs | Logs are persistently reviewed and audited. | |
| KSI-PIY-GIV | Generating Inventories | Authoritative sources automatically generate real-time inventories of information resources when needed. | |
| KSI-PIY-RES | Reviewing Executive Support | Executive support for security goals is persistently reviewed and demonstrated. | |
| KSI-PIY-RIS | Reviewing Investments in Security | The effectiveness of security investments is persistently reviewed. | |
| KSI-PIY-RSD | Reviewing Security in the SDLC | Software development security, aligned with CISA Secure by Design principles, is persistently reviewed. | |
| KSI-PIY-RVD | Reviewing Vulnerability Disclosures | The vulnerability disclosure program is persistently reviewed. | |
| KSI-RPL-ABO | Aligning Backups with Objectives | Backups are persistently reviewed for alignment with recovery objectives. | |
| KSI-RPL-ARP | Aligning Recovery Plan | Recovery plans are persistently reviewed for alignment with recovery objectives. | |
| KSI-RPL-RRO | Reviewing Recovery Objectives | RTO and RPO are defined and reviewed against business needs and capabilities. | |
| KSI-RPL-TRC | Testing Recovery Capabilities | Recovery from incidents and contingencies is persistently tested. | |
| KSI-SCR-MIT | Mitigating Supply Chain Risk | Supply chain risks are persistently identified, reviewed and mitigated. | |
| KSI-SCR-MON | Monitoring Supply Chain Risk | Third-party software is automatically monitored for upstream vulnerabilities. | |
| KSI-SVC-ACM | Automating Configuration Management | Configuration is automated and reviewed persistently for drift. | |
| KSI-SVC-ASM | Automating Secret Management | Keys, certificates and other secrets are automatically managed, protected and regularly rotated. | |
| KSI-SVC-EIS | Evaluating and Improving Security | Information resources are persistently evaluated and improvements are persistently made. | |
| KSI-SVC-PRR | Preventing Residual Risk | Plans, procedures and resource state are reviewed after changes to remove residual risks to federal customer data. | Class-tagged, Optional |
| KSI-SVC-RUD | Removing Unwanted Data | Unwanted federal customer data is removed promptly when an agency requests it. | Class-tagged, Optional |
| KSI-SVC-SIN | Securing Information | Information is encrypted or otherwise protected from unwanted access or modification. | Class A set |
| KSI-SVC-VCM | Validating Communications | See the CR26 reference for the full statement. | |
| KSI-SVC-VRI | Validating Resource Integrity | See the CR26 reference for the full statement. |
Wording is paraphrased. The two indicators whose full statements are not reproduced here, KSI-SVC-VCM and KSI-SVC-VRI, are in the CR26 reference. Class A set marks the seven indicators on the Class A page. Class-tagged, Optional marks the four that carry class tags in the reference. A blank cell means no tag.
Primary sources CR26 Key Security Indicators.
Evidence sources
Where the evidence for each theme usually comes from
Examples of the systems that typically hold the evidence. Your architecture decides which ones you use.
Infrastructure as code and CI/CD
Change logs, redeploy-not-modify records, deployment tests and intended-state enforcement. Covers KSI-CMT and much of KSI-CNA.
SIEM and logging
Event types, centralized tamper-resistant logs, log review and incident records. Covers KSI-MLA and KSI-INR.
Inventory and configuration management
Real-time inventories, drift detection and configuration evaluation. Covers KSI-PIY-GIV, KSI-SVC-ACM and KSI-MLA-EVC.
Secrets and encryption
Rotation records, certificate inventories and data protection settings. Covers KSI-SVC-ASM and KSI-SVC-SIN.
Backup and recovery tooling
Backup alignment, recovery objectives and recovery test results. Covers the four KSI-RPL indicators.
Supplier monitoring
Upstream vulnerability feeds and supplier reviews. Covers KSI-SCR-MON and KSI-SCR-MIT.
Policy, training and review records
Training reviews, executive support, investment and disclosure reviews. Covers KSI-CED-RAT and most of KSI-PIY.
Quzara
Cybertorch produces the evidence, NISTcompliance.ai organizes it
One certified boundary for the operating evidence and the record that cites it.
Operating evidence from Cybertorch
Cybertorch is a 24/7 U.S. citizen SOC on Azure Government, FedRAMP Certified Class D (High). Its logging, SIEM and incident response records are evidence for the monitoring and incident response indicators.
Reuse, confirmed in writing
Which indicators you can reuse from Cybertorch depends on your boundary. Your Cybertorch responsibility matrix defines exactly what you inherit and what stays yours.
Evidence kept organized
With KSI validation, NISTcompliance.ai keeps the evidence behind each indicator organized and current, and generates OSCAL and other machine-readable documentation from control evidence across 800-plus NIST SP 800-53 Rev 5 controls.
Assessor workflow
Auditor Co-Pilot lets assessors query the package and its evidence. Answers cite their sources.
NISTcompliance.ai operates inside the Cybertorch FedRAMP boundary on Azure Government. AI drafts and compares, and ISSOs, assessors and authorizing officials make every determination.
Common questions about Key Security Indicators
What is a Key Security Indicator?
An outcome statement from the CR26 reference, such as access being limited to what each user needs. A 20x provider sets measures for it, runs them persistently, records them in its Security Decision Record and has them independently assessed.
How many KSIs are there under CR26?
The CR26 reference lists 10 themes and 46 indicators. Class A uses a set of 7 indicators across 6 themes. Where an earlier article or deck gives different counts, use the CR26 reference.
Which KSIs does Class A use?
KSI-CED-RAT (Reviewing All Training), KSI-CMT-LMC (Logging Changes), KSI-CNA-RNT (Restricting Network Traffic), KSI-IAM-AAM (Automating Account Management), KSI-IAM-APM (Adopting Passwordless Methods), KSI-INR-RIR (Reviewing Incident Response Procedures) and KSI-SVC-SIN (Securing Information).
How is a KSI proven?
The provider records the measures, their cycle, and the verification and validation for each applicable KSI in its Security Decision Record (SDR-CSX-KSI). A FedRAMP independent assessment includes all KSIs at least once a year for Class B and Class C (IVV-CSX-AIA).
Who validates the KSIs?
A FedRAMP Recognized independent assessment service. FedRAMP itself can perform the assessment only for explicitly prioritized services, which the rules call extremely rare. The assessor verifies that implemented measures match the documented ones and validates that they achieve their outcomes.
What is the Security Decision Record?
A persistently maintained, verified and validated record of a provider's security decisions. It replaces the traditional System Security Plan for 20x and must be provided in human-readable and JSON formats (SDR-CSO-FRR).
What metrics must I keep?
Class C providers must include historical metrics for each applicable KSI: a 30-day summary, a summary up to the past year where available, and daily data up to the past year where available (SDR-CSX-KMT). For Class B the rule is SHOULD, which FedRAMP changed from MUST on October 8, 2026.
When do these rules apply?
Optional adoption and initial certification began July 4, 2026. Maintaining certification under them starts January 1, 2027, and the grace period ends at the first FedRAMP independent assessment started after that date.
Do KSIs replace NIST SP 800-53 controls?
Each indicator lists the SP 800-53 controls it relates to, and FedRAMP updated those mappings on October 13, 2026. The KSI rules are labeled 20x. Rev5 providers follow the Rev5 rulesets and control baselines.
What about Class D?
FedRAMP has said 20x Class D Program Certification is coming in 2027, and RFC-0033 proposed a Class D pilot. See the RFC tracker for its status.
How does Quzara help with KSI evidence?
Cybertorch supplies operating evidence from a 24/7 U.S. citizen SOC, and NISTcompliance.ai keeps the evidence behind each indicator organized and generates OSCAL and other machine-readable documentation inside the same FedRAMP boundary.
Build your KSI evidence pipeline against the CR26 reference
Quzara advisory, Cybertorch monitoring and NISTcompliance.ai automation help you set measures, keep the evidence and prepare for the independent assessment. Engage Quzara through our GSA HACS vehicle or directly.