KSI-IAM — Identity and Access Management
Access is least-privileged, automated, and phishing-resistant.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
KSI-IAM (Identity and Access Management) has 6 official CR26 indicators: KSI-IAM-AAM (Automating Account Management); KSI-IAM-APM (Adopting Passwordless Methods); KSI-IAM-ELP (Ensuring Least Privilege); KSI-IAM-JIT (Authorizing Just-in-Time); KSI-IAM-SNU (Securing Non-User Authentication); KSI-IAM-SUS (Responding to Suspicious Activity). Each indicator page quotes the official statement. This family page only indexes them.
How to implement
Related SP 800-53 base controls cited by the catalog for this family: AC-12, AC-14, AC-17, AC-18, AC-2, AC-20, AC-21, AC-3, AC-4, AC-5, AC-6, AC-7, AU-10, AU-12, AU-6, AU-9, CA-3, CM-2, CM-5, CM-6, CM-7, CM-9, IA-11, IA-12, IA-2, IA-3, IA-4, IA-5, IA-6, IA-7, IA-8, IR-4, IR-9, PS-2, PS-3, PS-4, PS-5, PS-6, PS-8, PS-9, RA-5, SC-2, SC-20, SC-21, SC-22, SC-23, SC-3, SC-39, SC-4, SI-3, SI-4. Confirm the live related-control column on the KSI reference before you treat a mapping as complete.
Interactive view: KSI Explorer (in progress).
Related
- Key Security Indicators (KSIs)
- KSI-IAM-AAM — Automating Account Management
- KSI-IAM-APM — Adopting Passwordless Methods
- KSI-IAM-ELP — Ensuring Least Privilege
- KSI-IAM-JIT — Authorizing Just-in-Time
- KSI-IAM-SNU — Securing Non-User Authentication
- KSI-IAM-SUS — Responding to Suspicious Activity
- Free FedRAMP 20x tools
Primary sources
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.
Explore the knowledge hub
Learn
- What is 20x?
- Fundamentals
- 20x vs Rev5
- Classes A–D
- Class A
- Class B
- Class C
- Class D
- KSIs
- SDR
- Evidence
- Continuous Monitoring
- Vulnerability Mgmt
- Identity & Access
- Logging
- Config Management
- Encryption
- Incident Response
- Compliance as Code
- OSCAL
- Glossary
- Controls
- AC-17
- AC-2
- AC-6
- AU-12
- AU-2
- AU-6
- CA-7
- CM-2
- CM-6
- CP-9
- IA-2
- IA-4
- IA-5
- IR-4
- IR-8
- RA-3
- RA-5
- SC-13
- SC-7
- SI-2
- SI-4