What Are FedRAMP 20x KSI (Key Security Indicators)?

The Federal Risk and Authorization Management Program (FedRAMP) stops accepting new Rev5 certification applications on June 11, 2027. After that, a cloud service provider (CSP) beginning a new authorization must follow the applicable FedRAMP authorization path and machine-readable package requirements.

Where 20x applies, the 20x model uses Key Security Indicators (KSIs), defined in FedRAMP Request for Comment 0006 (RFC-0006), Phase One Key Security Indicators (June 2025). These indicators use machine-readable KSI security evidence to support continuously verifiable results.

For SaaS vendors planning federal market entry, that shift changes the compliance work and who owns it. It also changes how long evidence stays valid. RFC-0014, Phase Two Key Security Indicators, was published September 10, 2025, and extended the model while sharpening the gap analysis vendors should run before entering the submission pipeline.

Key Takeaways

• Measurable security capabilities. KSIs replace control narratives. FedRAMP 20x maps National Institute of Standards and Technology (NIST) SP 800-53 Rev5 controls to security capabilities that resolve to true or false and stay continuously verifiable.  
• Eleven security themes. Ten themes, expanding to eleven. FedRAMP's Phase 1 materials organize the KSIs into ten themes, and FedRAMP added an Authorization by FedRAMP (KSI-AFR) theme in November 2025.  
• Persistent security validation. Persistent validation replaces annual snapshots. Under RFC-0017, the Persistent Validation and Assessment Standard, running infrastructure must generate evidence continuously.  
• Higher automation expectations. Phase 2 raises the automation bar. FedRAMP guidance strongly encourages automated validation for KSIs, though it has not locked in specific per-KSI automation thresholds, so a gap analysis belongs on this year's roadmap.

KSIs Replace NIST 800-53 Control Narratives With Measurable Security Capabilities

FedRAMP 20x is the program's next-generation authorization framework, designed to replace long control narratives with machine-readable indicators that a running cloud service can prove continuously. Instead of writing paragraphs for every applicable control, providers demonstrate security capabilities that resolve to true or false and remain valid as the service changes.

RFC-0006 defines FedRAMP Key Security Indicators as "an abstraction layer that is simpler to approach and assess." Each KSI bundles security capabilities that must be implemented and validated, designed so results "can often be automatically derived from technical configurations and resolved to true or false."

The contrast with traditional FedRAMP is deliberate. Under the legacy model, a CSP wrote a System Security Plan (SSP) with a control narrative for every applicable control from the NIST SP 800-53 Rev5 catalog, and an agency Authority to Operate (ATO) followed an independent assessor review of those narratives. Legacy Rev5 Moderate packages required control narratives across the full Rev5 baseline. Under FedRAMP 20x, validating a Moderate-categorized service uses a baseline-specific KSI set; RFC-0006 and RFC-0014 do not publish a definitive aggregate total.

RFC-0006 is now retained for historical reference. The FedRAMP Consolidated Rules for 2026 were released June 24, 2026; optional early adoption began July 4, 2026, and adoption becomes mandatory January 1, 2027. The current ruleset is v2026.07.14.01.

FedRAMP 20x Groups KSIs Into Eleven Core Security Themes

FedRAMP's Phase 1 materials organize the KSIs into ten themes, each mapped to NIST SP 800-53 Rev5 controls, and FedRAMP added an eleventh theme, Authorization by FedRAMP (KSI-AFR), on November 18, 2025.

1. Cloud Native Architecture (KSI-CNA)

KSI-CNA requires cloud-native design principles that enforce confidentiality, integrity, and availability across the service. These principles include a minimized attack surface, logical traffic controls between components, and distributed denial-of-service (DDoS) protection at the edge. KSI-CNA-04 goes further and requires immutable infrastructure with tightly scoped default functionality and privileges, so that rebuilding a workload from code is the standard path to remediation rather than in-place change.

2. Service Configuration (KSI-SVC)

KSI-SVC covers encryption at rest and in transit, cryptographic key management, configuration automation, and integrity validation for the workloads that deliver the service. It expects configuration drift to be detectable and reversible without manual intervention. KSI-SVC-07 requires a consistent, risk-informed patching approach, meaning that vulnerability severity, exposure, and exploitability drive patch cadence rather than an arbitrary calendar.

3. Identity and Access Management (KSI-IAM)

KSI-IAM requires providers to protect user data, control access to system resources, and implement zero trust practices across human and machine identities. KSI-IAM-01 mandates phishing-resistant multi-factor authentication (MFA) for all user authentication, ruling out SMS and push-only factors. The theme also expects least privilege, just-in-time authorization for elevated access, and automated management of the full account lifecycle.

4. Monitoring, Logging, and Auditing (KSI-MLA)

KSI-MLA requires continuous monitoring, logging, and auditing of all important events and changes. KSI-MLA-01 requires operating a Security Information and Event Management (SIEM) capability with centralized, tamper-resistant logging so that evidence cannot be modified after the fact. Related indicators require authenticated vulnerability scanning and a maintained list of monitored resources and event types.

5. Change Management (KSI-CMT)

KSI-CMT requires logging service modifications, automatically testing changes before deployment, and documenting procedures for human reviewers. KSI-CMT-03 requires persistent automated testing and validation of changes, which in practice means a continuous integration pipeline that blocks noncompliant infrastructure or application changes from reaching production. Manual change reviews remain in scope but sit above automation.

6. Policy and Inventory (KSI-PIY)

KSI-PIY covers asset inventories, documented security objectives, security staffing and budget, and a privacy-integrated development lifecycle. KSI-PIY-06 requires staff and budget for security commensurate with the size, complexity, scope, and risk of the service offering, and the privacy-integrated lifecycle sits under KSI-PIY-04. The theme grounds the more technical KSIs in an organization resourced to sustain them.

7. Recovery Planning (KSI-RPL)

KSI-RPL covers contingency planning, backup, and recovery capabilities for the cloud service offering. KSI-RPL-01 maps to CP-2.3 and CP-10 from NIST SP 800-53 Rev5, tying recovery expectations to established federal contingency planning controls. Providers are expected to test recovery procedures, verify backup integrity, and demonstrate that restoration targets can be met under realistic failure conditions, not only in tabletop exercises.

8. Incident Response (KSI-INR)

KSI-INR covers incident detection, response, and post-incident review. KSI-INR-01 requires responding to incidents in accordance with FedRAMP security requirements and CSP policies, which includes federal reporting timelines and evidence preservation. The theme also expects ongoing review of documented incident response procedures so runbooks stay aligned with the current service architecture and threat model rather than drifting into shelfware.

9. Cybersecurity Education (KSI-CED)

KSI-CED requires continuous employee security education with regular testing, not a one-time annual module. Phase 2 adds KSI-CED-03, which calls for role-specific secure-software training for engineers who build or maintain the service. The intent is measurable competency: providers should be able to show which staff completed which training, when, and how they verified comprehension through phishing simulations, quizzes, or comparable assessments.

10. Third-Party Information Resources (KSI-TPR)

KSI-TPR covers supply chain risk from third-party resources. These resources include software bills of materials (SBOMs) for commercial components and confirmation that subservices storing federal information are themselves FedRAMP authorized. KSI-TPR-01 requires following the FedRAMP Minimum Assessment Standard for downstream providers, so that the boundary of trust is documented, prioritized by risk, and refreshed as dependencies change rather than left implicit in vendor contracts.

11. Authorization by FedRAMP (KSI-AFR)

KSI-AFR was added on November 18, 2025 and covers how a provider engages with FedRAMP throughout the authorization lifecycle. The theme addresses assessment scope, data sharing with the program, operation of a FedRAMP Security Inbox, and collaborative Continuous Monitoring (ConMon). It formalizes the working relationship between the CSP and FedRAMP so that scope changes, incidents, and evidence exchange follow a repeatable, documented process rather than ad hoc communication.

Each KSI Is Validated Through Automation, Documentation, or a Combination

RFC-0006 requires that authorization packages based on KSIs "must be machine-readable, supported by evidence, and should include automated technical validation whenever possible." FedRAMP distinguishes automated and manual validation in its own text, and the requirements support three practical evidence modes.

• Automated validation methods. Validation resolves to true or false directly from infrastructure state. The current KSI-IAM-AAM indicator, for example, requires automated management of account lifecycles and privileges.  
• Documented (human-attested). Validation rests on policies, procedures, and human review, as in the current KSI-INR-RIR indicator, which requires persistent review of documented incident response procedures.  
• Hybrid. Some themes require both. RFC-0006's change management KSI demands automated testing and validation of changes before deployment alongside a documented change management procedure.

Automation scales with certification class. Class C, typically elected by services categorized Moderate, requires at least two automated methods per KSI with six months of historical metrics; Class B should implement at least one and Class D requires at least four automated methods per KSI. All classes supply machine-readable JavaScript Object Notation (JSON) evidence valid against FedRAMP's schemas.

Persistent Validation Means Continuous Evidence, Not a Point-in-Time Assessment

FedRAMP defines "persistently" as "occurring in a firm, steady way that is repeated over a long period of time in spite of obstacles or difficulties." RFC-0017 (Persistent Validation and Assessment Standard) builds the program on the assumption that providers validate their security implementations continuously and automatically inside their cloud service offering.

Operationally, the SIEM required by KSI-MLA runs as always-on infrastructure with regular log review and authenticated vulnerability scanning, and change pipelines satisfy KSI-CMT-03's persistent automated testing through Infrastructure as Code (IaC) validation.

Independent assessors, historically known as Third-Party Assessment Organizations (3PAOs), verify that automated validation processes run continuously, turning post-ATO monitoring into a daily operating discipline.

Phase 2 Refines the KSI Set and Adds Validations for Moderate Systems

RFC-0014 is a delta document that retires, updates, and adds KSIs relative to Phase 1, extends the model to the FedRAMP Moderate baseline, and appends Moderate control mappings built for automated comparison.

The most significant changes:

• Retired: KSI-MLA-04 and KSI-MLA-06 (both superseded by an updated KSI-MLA-03), KSI-TPR-02, and KSI-PIY-02.  
• Updated: KSI-IAM-05 now reads "Design identity and access management systems that assume resources will be compromised," replacing its earlier zero trust phrasing. KSI-SVC-01 now calls for continuous evaluation of machine-based resources for security improvements, and KSI-SVC-04 was rewritten to require managing configuration using automation.  
• New for Low and Moderate: KSI-CED-03 (role-specific secure-software training for engineers), KSI-IAM-07 (account lifecycle and privilege management), and KSI-MLA-07 (a maintained list of monitored resources and event types).  
• New for Moderate only: KSI-CNA-08, KSI-MLA-08, and KSI-SVC-08 through KSI-SVC-10. These KSIs cover automated posture assessment, just-in-time access to log data, and prompt data removal.  
• After the comment period closed, FedRAMP added the KSI-AFR theme described above.

RFC-0014 also states the automation shift plainly: "During Phase One, FedRAMP would accept written attestation that some Key Security Indicators were met for a Low authorization. During Phase Two, FedRAMP will expect truly automated and opinionated validation of Key Security Indicators for a Moderate authorization."

SaaS Vendors Should Start Their KSI Gap Analysis Before Entering the 20x Pipeline

FedRAMP opens public FedRAMP submission pipelines for Class B and Class C certifications on August 31, 2026, and FedRAMP KSI guidance states: "Do not attempt to approach Key Security Indicators from a traditional compliance standpoint!" With those pipelines opening, readiness work converts directly into federal pipeline, and a structured gap analysis is the practical starting point.

• Map current controls to KSI themes. Take existing NIST SP 800-53 or System and Organization Controls (SOC) 2 work and align it to the eleven themes to expose coverage gaps.  
• Audit automation capabilities. For each KSI, ask whether validation can be generated automatically from the production environment in machine-readable JSON. Any KSI that cannot produce automated, machine-readable evidence requires readiness work.  
• Harden identity and access management. Phishing-resistant MFA, least privilege, just-in-time authorization, and automated account lifecycle management address the KSI-IAM indicators.  
• Stand up SIEM and continuous log review. KSI-MLA requires centralized, tamper-resistant logging and persistent infrastructure and configuration scanning to support continuous evidence production.  
• Document third-party dependencies. KSI-TPR requires SBOMs for commercial components, prioritized supply chain risks, and confirmation that subservices handling federal information hold FedRAMP authorization.

A gap analysis will typically surface the same conclusion: building every KSI from scratch is expensive, and much of the work sits below the application layer. That is why more SaaS teams are evaluating a pre-authorized boundary, where infrastructure, platform, and shared service KSIs are already validated by the host provider and inherited by the tenant. Inheritance narrows the vendor's scope to the application-specific KSIs, shortens the evidence backlog, and lets engineering teams focus their automation investment where it actually differentiates the product.

Start Your FedRAMP 20x Authorization With an Inherited, Continuously Validated Boundary

The most successful FedRAMP 20x pilot organizations were led entirely by experienced engineering and product teams that approached certification like any other product. KSIs reward that mindset because they demand running, machine-readable proof rather than after-the-fact narratives, and vendors that invest early in inheritance, automation, and continuous evidence can spend engineering time on the KSIs unique to their service instead of rebuilding foundational ones.

Knox Systems is built for that model. Its pre-authorized FedRAMP boundary lets SaaS vendors inherit controls within the boundary and pairs that with an automated continuous monitoring platform mapped to KSI themes, so evidence is generated and refreshed continuously rather than assembled for each audit. Knox currently supports FedRAMP Moderate, FedRAMP High, and Defense Information Systems Agency Impact Level 4 (DISA IL-4); IL-5 authorization is in process, with estimated completion in December 2026.

Book a demo to walk through your KSI gap analysis and see how much of your 20x scope can be inherited on day one.

FAQs about FedRAMP 20x KSIs

Does FedRAMP 20x Require an Agency Sponsor?

No. Program Certification comes directly from FedRAMP rather than through an agency sponsor. Under the old model, sponsors accepted limited service risk; a sponsor was never a government-wide authorizing official.

What Happens to Existing Rev5 Certifications?

Existing Rev5 certifications remain subject to the certification sunset schedule. Their certification sunset deadline is December 31, 2028.

How Much Historical Evidence Does Class C Require?

Class C requires six months of historical metrics. It also requires at least two automated validation methods per KSI and machine-readable JSON evidence that validates against FedRAMP schemas.

‍