- Home
- FedRAMP 20x
- KSI validation
Key Security Indicators, validated continuously
Key Security Indicators summarize the security capabilities a cloud service must prove and measure to keep its FedRAMP Certification. NISTcompliance.ai maps each indicator to automated validation methods, records the result with a timestamp, and shows which indicators meet your Class threshold today.
Runs inside Quzara Cybertorch: FedRAMP Certified, Rev5 Class D (High)SOC 2 Type 2
The ten themes
Every KSI theme, in one view
The FedRAMP KSI reference organizes indicators into ten themes. Each indicator lists related NIST SP 800-53 controls.
Change Management
Cloud Native Architecture
Identity and Access Management
Incident Response
Monitoring, Logging, and Auditing
Policy and Inventory
Recovery Planning
Supply Chain Risk
Service Configuration
Sources: KSI reference. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
Class thresholds
How many automated methods your Class needs
Swipe to see every column
| Requirement | Class A | Class B | Class C | Class D |
|---|---|---|---|---|
| Automated validation methods per KSI | Optional (may), plus a Rev5, SOC 2 Type II or GovRAMP certification from the past 12 months | At least 1 (should) | At least 2 (must) | At least 4 (must) |
Sources: Certification rules, IVV rules. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules. 20x Class D is expected to pilot in late 2026.
What indicators look like
Indicators are written for automation
Examples from the FedRAMP KSI reference, summarized.
KSI-IAM-AAMINDICATOR
Automating Account Management
The lifecycle and privileges of all accounts, roles and groups are managed using automation. Related controls include AC-2(2), AC-2(3), AC-2(13) and IA-12.
KSI-SVC-ACMINDICATOR
Automating Configuration Management
Configuration of machine-based information resources is managed using automation and persistently reviewed for drift. Related controls include CM-2 and CM-6.
KSI-CMT-VTDINDICATOR
Validating Throughout Deployment
Persistent testing and validation of changes throughout deployment is automated.
KSI-SCR-MONINDICATOR
Monitoring Supply Chain Risk
Third-party software is automatically monitored for upstream vulnerabilities. Related controls include RA-5 and SI-5.
Sources: KSI reference. FedRAMP Consolidated Rules for 2026, checked Oct 23, 2026. Not a substitute for the official rules.
How it works
From evidence to passing indicator
Collect
Evidence is collected on a schedule from the systems you run.
Map
Each KSI is mapped to the automated methods that can prove it, with the related 800-53 controls.
Validate
Methods run on a schedule. Results, evidence and timestamps are kept as history.
Close gaps
Indicators below your Class threshold become owned tasks with dates, ready for your assessor.
Go deeper
KSI guide
Key Security Indicators (KSIs)
Every KSI theme and what it asks you to prove.
Read the guide →Questions
Common questions
How many KSI themes are there?
Ten: Cybersecurity Education, Change Management, Cloud Native Architecture, Identity and Access Management, Incident Response, Monitoring, Logging, and Auditing, Policy and Inventory, Recovery Planning, Supply Chain Risk, and Service Configuration.
How many automated methods does each KSI need?
It depends on your Certification Class: optional for Class A, at least one for Class B, at least two for Class C and at least four for Class D.
How often are KSIs assessed?
20x Class B, C and D providers must include all KSIs in a FedRAMP independent assessment at least once per year.
Book a demo
See which KSIs pass today
Bring your stack. We will show your KSI gap view against your target Class.