Key Security Indicators (KSIs) are the security outcomes a FedRAMP 20x provider must show, and keep showing, to agencies. FedRAMP.gov does not give a one-line definition, but each KSI states an outcome the provider must meet and verify.
How a KSI is written
Each KSI has an ID, such as KSI-CED-RAT, and a short statement of the expected security outcome. It also lists related controls from NIST SP 800-53, the federal catalog of security controls. Most KSIs use the word "persistently," meaning the outcome must be reviewed, tested or automated on an ongoing basis.
The themes
FedRAMP.gov groups the KSIs into themes, including:
- Cybersecurity Education
- Change Management
- Cloud Native Architecture
- Identity and Access Management
- Incident Response
- Monitoring, Logging, and Auditing
- Policy and Inventory
- Recovery Planning
- Supply Chain Risk
- Service Configuration
How KSIs differ by class
Class A providers must address seven specific KSIs, even if they plan to pursue Rev5 later. Providers should apply all KSIs across the full scope of the offering. Automated checking is optional for Class A, recommended for Class B, and required for Classes C (two methods per KSI) and D (four methods per KSI).
Why they matter
FedRAMP.gov says KSIs can show security posture "in near real time." Lessons from the 20x pilots suggest KSIs can replace static, yearly manual assessments. Class B, C and D providers must also include all KSIs in an independent assessment at least once a year.
Sources
Related Articles
- What is FedRAMP 20X, and how is it different from Rev5?
- Does my SaaS company need FedRAMP to sell to federal agencies?
- What are FedRAMP 20X Classes A, B, C and D?
- Which FedRAMP 20X class does my product need?
- What are the FedRAMP 2026 Consolidated Rules?
- What does continuous validation mean in FedRAMP 20X?
- What's the difference between FedRAMP and SOC 2?
- Does our SOC 2 or ISO 27001 work count toward FedRAMP?
- Do I need an agency sponsor for FedRAMP 20X?