KSI-IAM-SUS — Responding to Suspicious Activity
Official CR26 Key Security Indicator in the Identity and Access Management family (KSI-IAM). The statement below is verbatim from the catalog.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Official requirement
Accounts with privileged access are disabled or otherwise secured in response to suspicious activity.
Assessment considerations
Official related SP 800-53 controls: ac-2, ac-2.1, ac-2.11, ac-2.12, ac-2.13, ac-2.3, ac-7, au-6.5, cm-5.1, cm-6.2, ir-4.2, ir-4.6, ps-4, ps-8, si-4, si-4.1, si-4.19, si-4.20, si-4.22, si-4.4.
Interactive view: KSI Explorer (in progress).
Related
Primary sources
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.
Explore the knowledge hub
Learn
- What is 20x?
- Fundamentals
- 20x vs Rev5
- Classes A–D
- Class A
- Class B
- Class C
- Class D
- KSIs
- SDR
- Evidence
- Continuous Monitoring
- Vulnerability Mgmt
- Identity & Access
- Logging
- Config Management
- Encryption
- Incident Response
- Compliance as Code
- OSCAL
- Glossary
- Controls
- AC-17
- AC-2
- AC-6
- AU-12
- AU-2
- AU-6
- CA-7
- CM-2
- CM-6
- CP-9
- IA-2
- IA-4
- IA-5
- IR-4
- IR-8
- RA-3
- RA-5
- SC-13
- SC-7
- SI-2
- SI-4