Sign in Request demo

FedRAMP 20x for cloud service providers

Know what is required. Build it. Prove it.

Search every KSI and the 168 rules addressed to providers. See the requirement, implementation guidance, and evidence context without sorting through obligations owned by agencies, assessors, or FedRAMP. Not sure where you stand? Take the free FedRAMP 20x gap assessment to find your certification class and KSI readiness first.

Understand the 46 KSIs Browse CSP rules Find implementation guidance Find automated checks

Based on FedRAMP/rules 2026.07.06.01, updated 2026-07-06

CSP implementation explorer

Showing 46 of 284 CSP resources

Reviewing All Training

All service classesOfficial source

Logging Changes

All service classesImplementation guidance

Redeploying vs Modifying

All service classesImplementation guidance

Reviewing Change Procedures

All service classesImplementation guidance

Validating Throughout Deployment

All service classesImplementation guidance

Defining Functionality and Privileges

All service classesImplementation guidance

Enforcing Intended State

Classes B, CImplementation guidance

Implementing Best Practices

All service classesImplementation guidance

Minimizing Attack Surface

All service classesImplementation guidance

Optimizing for Availability

All service classesImplementation guidance

Restricting Network Traffic

All service classesImplementation guidance

Reviewing Protections

All service classesImplementation guidance

Using Logical Networking

All service classesImplementation guidance

Automating Account Management

All service classesImplementation guidance

Adopting Passwordless Methods

All service classesImplementation guidance

Ensuring Least Privilege

All service classesImplementation guidance

Authorizing Just-in-Time

All service classesImplementation guidance

Securing Non-User Authentication

All service classesImplementation guidance

Responding to Suspicious Activity

All service classesImplementation guidance

Generating After Action Reports

All service classesOfficial source

Reviewing Incident Response Procedures

All service classesOfficial source

Reviewing Past Incidents

All service classesOfficial source

Authorizing Log Access

Classes B, CImplementation guidance

Evaluating Configurations

All service classesImplementation guidance Automated check

Logging Event Types

All service classesImplementation guidance

Operating SIEM Capability

All service classesImplementation guidance

Reviewing Logs

All service classesImplementation guidance

Generating Inventories

All service classesImplementation guidance

Reviewing Executive Support

All service classesOfficial source

Reviewing Investments in Security

All service classesOfficial source

Reviewing Security in the SDLC

All service classesOfficial source

Reviewing Vulnerability Disclosures

All service classesOfficial source

Aligning Backups with Objectives

All service classesImplementation guidance

Aligning Recovery Plan

All service classesOfficial source

Reviewing Recovery Objectives

All service classesOfficial source

Testing Recovery Capabilities

All service classesImplementation guidance

Mitigating Supply Chain Risk

All service classesImplementation guidance

Monitoring Supply Chain Risk

All service classesImplementation guidance

Automating Configuration Management

All service classesImplementation guidance

Automating Secret Management

All service classesImplementation guidance

Evaluating and Improving Security

All service classesImplementation guidance

Preventing Residual Risk

Classes B, CImplementation guidance

Removing Unwanted Data

Classes B, COfficial source

Securing Information

All service classesImplementation guidance

Validating Communications

Classes B, CImplementation guidance

Validating Resource Integrity

All service classesImplementation guidance