A Key Security Indicator (KSI) is a one-sentence security outcome that a cloud provider working toward FedRAMP 20x shows it meets, for example "Modifications to the cloud service offering are logged and monitored." FedRAMP's KSI reference page lists 46 KSIs in 10 themes (the total is our own count of that page), and its changelog shows an update dated October 13, 2026. Not every KSI applies to every class.
What is a FedRAMP 20x KSI?
Each KSI has an ID in the form KSI-THEME-KEY, a short name and a one-sentence outcome. KSI-CMT-LMC, "Logging Changes", reads: "Modifications to the cloud service offering are logged and monitored." Each KSI page also lists the related NIST SP 800-53 controls, so a team that knows Rev 5 can see where an indicator came from (Class A KSI page).
FedRAMP's definitions page says its practices are expressed in "FedRAMP 20x Key Security Indicators or FedRAMP Rev5 Controls" (definitions). We couldn't find a one-line definition of "KSI" on the pages we opened, so the description above comes from how the pages present them.
How many KSIs are there, and what themes do they cover?
46, in 10 themes, on the FedRAMP KSI reference page as we read it on November 2, 2026. The page never states a total, so 46 is our count. FedRAMP launched the Consolidated Rules for 2026 on June 24, 2026, and its changelog shows control-mapping updates on October 13, 2026.
| Theme | KSIs | Example from fedramp.gov |
|---|---|---|
| Cybersecurity Education (CED) | 1 | KSI-CED-RAT, Reviewing All Training |
| Change Management (CMT) | 4 | KSI-CMT-LMC, Logging Changes |
| Cloud Native Architecture (CNA) | 8 | KSI-CNA-RNT, Restricting Network Traffic |
| Identity and Access Management (IAM) | 6 | KSI-IAM-APM, Adopting Passwordless Methods |
| Incident Response (INR) | 3 | KSI-INR-RIR, Reviewing Incident Response Procedures |
| Monitoring, Logging, and Auditing (MLA) | 5 | KSI-MLA-RVL, Reviewing Logs |
| Policy and Inventory (PIY) | 5 | KSI-PIY-GIV, Generating Inventories |
| Recovery Planning (RPL) | 4 | KSI-RPL-TRC, Testing Recovery Capabilities |
| Supply Chain Risk (SCR) | 2 | KSI-SCR-MON, Monitoring Supply Chain Risk |
| Service Configuration (SVC) | 8 | KSI-SVC-VRI, Validating Resource Integrity |
Counts add up to 46. Not every KSI applies to every class: the page marks five (KSI-CNA-EIS, KSI-MLA-ALA, KSI-SVC-PRR, KSI-SVC-RUD, KSI-SVC-VCM) as optional for Class B and Class C. Always check the KSI page for the current list, because FedRAMP revises the rules by dated releases.
Which KSIs does Class A use?
FedRAMP's Class A reference page lists 7 KSIs: KSI-CED-RAT, KSI-CMT-LMC, KSI-CNA-RNT, KSI-IAM-AAM, KSI-IAM-APM, KSI-INR-RIR and KSI-SVC-SIN. That page doesn't say which KSIs are required for which class, and the Class B page we read gave no KSI count. We didn't confirm how many KSIs apply to Class B or Class C, so read each class's reference page before you scope work (Class A, Class B, Class C).
Where does FedRAMP 20x stand today?
On its 20x page, FedRAMP lists Phase 3, wide-scale adoption, as active. Classes A, B and C are shown as available now, and Class D (High) as not yet available (fedramp.gov/20x, read November 2, 2026).
| Date | What FedRAMP's timeline says |
|---|---|
| July 4, 2026 | Optional early adoption of the Consolidated Rules for 2026 |
| August 3, 2026 | Applications open for 20x Class A |
| August 31, 2026 | Applications open for 20x Class B and C |
| January 1, 2027 | The Consolidated Rules for 2026 take mandatory effect for all stakeholders, subject to specific applicability and effective dates within certain areas |
Source: FedRAMP timeline. Dates can move, so check it before you plan.
How are KSIs checked?
The KSI pages give outcomes, not a test script. How often you must check your systems comes from other rules. For example, in the Vulnerability Detection and Response ruleset, providers of 20x Class C offerings must verify and validate the status of machine-based information resources at least once every 3 days (VDR-TFR-MVX). A separate rule, VDR-TFR-NMV, says providers must do the same for non-machine-based resources at least once every 3 months; the page shows no class label on it (Class C VDR rules). That is a vulnerability rule, not a KSI rule, so don't read it as the check cycle for every KSI.
What should a provider do first?
- Pick your class and read that class's reference page on fedramp.gov.
- List the KSIs it names, grouped by theme.
- For each KSI, write down the system, owner and evidence that shows the outcome today.
- Mark the KSIs you can't show yet and give each an owner and a date.
- Recheck fedramp.gov for changes before each submission step.
Frequently asked questions
What does KSI stand for?
Key Security Indicator. FedRAMP says its 20x practices are expressed as Key Security Indicators.
How many KSIs are in FedRAMP 20x?
46, in 10 themes, on the FedRAMP KSI reference page as read on November 2, 2026. The page gives no total, so 46 is our count. The Class A page lists 7, and the page marks five as optional for Class B and C.
Do KSIs replace NIST 800-53 controls?
Not on the pages we read. Each KSI lists related SP 800-53 controls, which shows how the two connect. FedRAMP's definitions page still describes Rev5 as a separate Certification Type, alongside 20x.
Is FedRAMP 20x still a pilot?
FedRAMP's 20x page shows Phases 1 and 2 as completed pilots and Phase 3, wide-scale adoption, as active (November 2, 2026). It shows a Class D (High) pilot as a later, estimated phase.
Is a KSI the same as a control?
No. A KSI is an outcome statement tied to related controls. The pages we read don't say a KSI replaces a control.
Next step
Pursuing FedRAMP 20x Class C. Listed on the FedRAMP Marketplace (FR2700754082), Initial Implementation phase. We use ComplianceONE on our own environment. Its integrations run daily read-only checks, and each check maps to FedRAMP 20x KSIs and shows on the matching control, so you can see the result next to the requirement it supports.
Book a demo and we will walk you through it.
This post explains public FedRAMP material and is not legal advice. ComplianceONE does not certify, authorize or assess anyone, and no software makes an organization certified or authorized.