Key Security Indicators (KSIs)
Key Security Indicators are the measurable 20x security capabilities. The pinned CR26 catalog has 10 families and 46 indicators. Every page in this section is generated from that catalog — statements are quoted, never re-keyed.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Class markers appear only where the catalog sets them (today, five Class C indicators). Empty class arrays stay unmarked. Related SP 800-53 controls are the official citations, including enhancements when FedRAMP listed them.
How to implement
Open a family, then an indicator. Legacy /ksi/{id}.html apex pages 301 to these hub pages, which are the Knowledge Authority copies. The KSI Explorer tool is a planned interactive view of the same catalog.
Assessor skills training
Self-serve scm.cc courses with labs on labeled test data, quizzes, an exam, and a shareable scm.cc training certificate. First fundamentals lesson is free. $299 per course; $799 full track.
This is scm.cc skills training. Completing a course or receiving an scm.cc training certificate does not make you a FedRAMP Recognized Independent Assessor, is not a FedRAMP credential, and is not government recognition. Official recognition requires A2LA accreditation (REC-IAS-ACC) and FedRAMP Recognition. FedRAMP.gov is the authoritative source. This is not legal advice.
Open the training catalogOfficial Recognition pathFramework quizConMon product pricing
Related
- FedRAMP 20x Knowledge Authority
- KSI-CED — Cybersecurity Education
- KSI-CMT — Change Management
- KSI-CNA — Cloud Native Architecture
- KSI-IAM — Identity and Access Management
- KSI-INR — Incident Response
- KSI-MLA — Monitoring, Logging, and Auditing
- KSI-PIY — Policy and Inventory
- KSI-RPL — Recovery Planning
- KSI-SCR — Supply Chain Risk
- KSI-SVC — Service Configuration
- KSI training
- KSI evidence evaluation
- KSI Explorer
Primary sources
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.
Explore the knowledge hub
Learn
- What is 20x?
- Fundamentals
- 20x vs Rev5
- Classes A–D
- Class A
- Class B
- Class C
- Class D
- KSIs
- SDR
- Evidence
- Continuous Monitoring
- Vulnerability Mgmt
- Identity & Access
- Logging
- Config Management
- Encryption
- Incident Response
- Compliance as Code
- OSCAL
- Glossary
- Controls
- AC-17
- AC-2
- AC-6
- AU-12
- AU-2
- AU-6
- CA-7
- CM-2
- CM-6
- CP-9
- IA-2
- IA-4
- IA-5
- IR-4
- IR-8
- RA-3
- RA-5
- SC-13
- SC-7
- SI-2
- SI-4