KSI-IAM-JIT — Authorizing Just-in-Time
Official CR26 Key Security Indicator in the Identity and Access Management family (KSI-IAM). The statement below is verbatim from the catalog.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Official requirement
A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.
Assessment considerations
Official related SP 800-53 controls: ac-17, ac-17.4, ac-2, ac-2.1, ac-2.11, ac-2.2, ac-2.3, ac-2.4, ac-2.6, ac-2.7, ac-20.1, ac-21, ac-3, ac-4, ac-5, ac-6, ac-6.1, ac-6.10, ac-6.2, ac-6.3, ac-6.5, ac-6.7, ac-6.8, ac-6.9, ac-7, au-10, au-12.3, au-9.4, ca-3.6, cm-5, cm-5.1, cm-5.5, cm-7, cm-7.2, cm-7.5, cm-9, ia-4, ia-4.4, ia-7, ir-4.6, ps-2, ps-3, ps-4, ps-5, ps-6, ps-9, ra-5.5, sc-2, sc-23, sc-3, sc-39.
Interactive view: KSI Explorer (in progress).
Related
Primary sources
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.
Explore the knowledge hub
Learn
- What is 20x?
- Fundamentals
- 20x vs Rev5
- Classes A–D
- Class A
- Class B
- Class C
- Class D
- KSIs
- SDR
- Evidence
- Continuous Monitoring
- Vulnerability Mgmt
- Identity & Access
- Logging
- Config Management
- Encryption
- Incident Response
- Compliance as Code
- OSCAL
- Glossary
- Controls
- AC-17
- AC-2
- AC-6
- AU-12
- AU-2
- AU-6
- CA-7
- CM-2
- CM-6
- CP-9
- IA-2
- IA-4
- IA-5
- IR-4
- IR-8
- RA-3
- RA-5
- SC-13
- SC-7
- SI-2
- SI-4