FedRAMP Key Security Indicators
Every KSI, its NIST control mapping, and whether a machine can verify it continuously or it needs an uploaded artifact.
Key Security Indicators are FedRAMP 20x's replacement for reciting control implementations in prose. Each one states an outcome, maps to the NIST 800-53 controls it subsumes, and is meant to be demonstrated with evidence rather than described. That is what makes them automatable. The green tag marks indicators Zenibit has an automated check implemented for; the rest are satisfied by evidence you provide.
Cybersecurity Education · CED
1 requirements, 0 verifiable by automated check.
Reviewing All Training
The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery.
Change Management · CMT
4 requirements, 0 verifiable by automated check.
Redeploying vs Modifying
Changes to machine-based information resources are executed through the redeployment of version controlled resources rather than direct modification wherever reasonable.
Reviewing Change Procedures
The effectiveness of documented change management procedures is persistently reviewed.
Validating Throughout Deployment
Persistent testing and validation of changes throughout deployment is automated.
Cloud Native Architecture · CNA
8 requirements, 0 verifiable by automated check.
Defining Functionality and Privileges
The functionality and privileges for infrastructure and services are strictly defined.
Enforcing Intended State
Class B
Optional: Automated services are used to persistently assess the security of all machine-based information resources and automatically enforce their intended operational state.
Class C
Automated services are used to persistently assess the security of all machine-based information resources and automatically enforce their intended operational state.
Implementing Best Practices
The use and configuration of third-party machine-based information resources is persistently compared against the original provider's best practices and guidance.
Minimizing Attack Surface
Machine-based information resources are persistently reviewed to ensure they have a minimal attack surface and that lateral movement is minimized if compromised.
Optimizing for Availability
Machine-based information resources are persistently reviewed to ensure they are appropriately optimized for high availability and rapid recovery.
Restricting Network Traffic
Machine-based information resources are persistently reviewed to ensure they are appropriately configured to limit inbound and outbound network traffic.
Reviewing Protections
The effectiveness of protection against denial of service attacks and other unwanted activity for machine-based information resources is persistently reviewed.
Using Logical Networking
Logical networking and related capabilities are used and persistently reviewed to enforce traffic flow controls.
Identity and Access Management · IAM
6 requirements, 1 verifiable by automated check.
Automating Account Management
The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation.
Adopting Passwordless Methods
Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used.
Ensuring Least Privilege
Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need.
Authorizing Just-in-Time
A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.
Securing Non-User Authentication
Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services.
Responding to Suspicious Activity
Accounts with privileged access are disabled or otherwise secured in response to suspicious activity.
Incident Response · INR
3 requirements, 0 verifiable by automated check.
Generating After Action Reports
Incident after action reports are generated and lessons learned are persistently incorporated.
Reviewing Incident Response Procedures
The effectiveness of documented incident response procedures is persistently reviewed.
Reviewing Past Incidents
Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified.
Monitoring, Logging, and Auditing · MLA
5 requirements, 1 verifiable by automated check.
Authorizing Log Access
Class B
Optional: A least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity.
Class C
A least-privileged, role and attribute-based, and just-in-time access authorization model is used and persistently reviewed for access to log data based on organizationally defined data sensitivity.
Evaluating Configurations
The configuration of machine-based information resources, especially infrastructure as code, is persistently evaluated and tested.
Logging Event Types
A list of information resources and event types that will be logged, monitored, and audited is maintained and persistently reviewed to ensure these activities occur.
Operating SIEM Capability
A Security Information and Event Management (SIEM) or similar system(s) is used and persistently reviewed for centralized, tamper-resistant logging of events, activities, and changes.
Policy and Inventory · PIY
5 requirements, 0 verifiable by automated check.
Generating Inventories
Authoritative sources are used to automatically generate real-time inventories of all information resources when needed.
Reviewing Executive Support
Executive support for achieving the provider's security goals is persistently reviewed and demonstrated.
Reviewing Investments in Security
The effectiveness of the provider's investments in achieving security goals is persistently reviewed.
Reviewing Security in the SDLC
The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed.
Reviewing Vulnerability Disclosures
The effectiveness of the provider's vulnerability disclosure program is persistently reviewed.
Recovery Planning · RPL
4 requirements, 0 verifiable by automated check.
Aligning Backups with Objectives
The alignment of machine-based information resource backups with defined recovery objectives is persistently reviewed.
Aligning Recovery Plan
The alignment of recovery plans with defined recovery objectives is persistently reviewed.
Reviewing Recovery Objectives
The desired Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) are defined and persistently reviewed for alignment with the provider's business needs and capabilities.
Testing Recovery Capabilities
The capability to recover from incidents and contingencies aligned with defined recovery objectives is persistently tested.
Supply Chain Risk · SCR
2 requirements, 0 verifiable by automated check.
Mitigating Supply Chain Risk
Persistently identify, review, and mitigate potential supply chain risks.
Monitoring Supply Chain Risk
Third party software information resources are automatically monitored for upstream vulnerabilities using mechanisms that may include contractual notification requirements or active monitoring services.
Service Configuration · SVC
8 requirements, 1 verifiable by automated check.
Automating Configuration Management
The configuration of machine-based information resources is managed using automation and persistently reviewed for drift.
Automating Secret Management
Management, protection, and regular rotation of digital keys, certificates, and other secrets is automated and persistently reviewed.
Evaluating and Improving Security
Information resources are persistently evaluated for opportunities to improve security and those improvements are persistently made.
Preventing Residual Risk
Class B
Optional: Plans, procedures, and the state of information resources are persistently reviewed after making changes to limit and remove unwanted residual elements that would likely negatively affect the confidentiality, integrity, or availability of federal customer data.
Class C
Plans, procedures, and the state of information resources are persistently reviewed after making changes to limit and remove unwanted residual elements that would likely negatively affect the confidentiality, integrity, or availability of federal customer data.
Removing Unwanted Data
Class B
Optional: Unwanted federal customer data is removed promptly when requested by an agency in alignment with customer agreements, including from backups if appropriate; this typically applies when a customer spills information or when a customer seeks to remove information from a service due to a change in usage.
Class C
Unwanted federal customer data is removed promptly when requested by an agency in alignment with customer agreements, including from backups if appropriate; this typically applies when a customer spills information or when a customer seeks to remove information from a service due to a change in usage.
Securing Information
Information is encrypted or otherwise secured from unwanted access or modification.
Validating Communications
Class B
Optional: The authenticity and integrity of communications between machine-based information resources is persistently validated using automation.
Class C
The authenticity and integrity of communications between machine-based information resources is persistently validated using automation.
Validating Resource Integrity
Use cryptographic methods to validate the integrity of machine-based information resources.
Stop assembling this by hand.
Zenibit tracks these requirements against your live infrastructure and publishes a trust center agencies can verify themselves. Get in touch.