Skip to main content

KSI & rules validation

Show what works.
Know what needs work.

Connect your evidence to FedRAMP KSIs and consolidated rules. See the tests behind each result, resolve the gaps, and keep a record your reviewers can follow.

See validation in action Try the workspace
Validation workspaceIllustrative example

Identity & access management

Trace a result to its evidence.

Privileged access check

Needs attention

Identity configuration · 12 accounts reviewed

Access review record

Passed

Approved review · supporting document linked

What needs to change

One privileged account is missing the required access protection. Review the account, apply the fix, and rerun the check.

Source evidenceTest recordsReview context

Try it yourself

Explore the validation workspace.

Open a failed check. Follow it to the evidence. Simulate a fix and rerun the test to see what changes.

Boundera/Validation
Interactive demo · Sample data
KSI-IAM-APM1 sample check failed

Adopting Passwordless Methods

Inspect authentication methods and the evidence behind this sample provider's access checks.

Method
Compare the identity provider's authentication policy and enrolled methods for the selected administrator accounts.
Frequency
After the sample identity sync
Passes when
Each sampled administrator uses a passkey or strong password with phishing-resistant MFA.

Evidence from sample run 001

deploy-adminFailed

Identity provider · authentication snapshot

Password-only sign-in is still allowed.

Account
deploy-admin
Method
Password only
Phishing-resistant MFA
Not enforced
security-adminPassed

Identity provider · authentication snapshot

Account
security-admin
Method
FIDO2 security key
Phishing-resistant MFA
Enforced
operations-adminPassed

Identity provider · authentication snapshot

Account
operations-admin
Method
Passkey
Password fallback
Disabled

Try resolving this check

Require a FIDO2 security key for deploy-admin in the sample identity policy. Rerun the check to collect the changed evidence.

Sample checks support the wider requirement.Official requirement

Select a test, then open a resource to inspect its evidence.

Sample actions stay in this browser.

Illustrative checks and fictional evidence. Methods, frequencies, and coverage depend on your implementation. Independent assessment remains separate.

See how the workflow fits together

From evidence to an answer

A status is only useful
when you can explain it.

Your cloud configuration, policies, and operational records change. Boundera brings those inputs together so your team can inspect the result, find the affected resource, and decide what to do next.

  1. 01

    Connect the evidence

    Bring in signals from supported cloud, identity, and development integrations. Add policies, documents, and other evidence for the work that happens outside those systems.

    What you getSource records with resource and collection context.

  2. 02

    Inspect the validation

    Review the method, scope, and results behind a KSI or rule. See which resources pass, which fail, and where evidence or evaluation is still missing.

    What you getAn explainable result with supporting evidence.

  3. 03

    Resolve and check again

    Use the failed checks to focus remediation. Refresh the evidence and rerun supported evaluations, keeping the test records available for follow-up.

    What you getUpdated results and a record of the work.

Two connected views

Security outcomes.
The rules that support them.

Validate your KSIs

See how your implementation supports each security outcome. Move from the KSI summary into the tests and individual resources behind it.

  • Current results, gaps, and checks that have not been evaluated.
  • Test methods, pass and fail criteria, and supporting source evidence.
  • Implementation details and test records for review over time.
Browse the KSI requirements

Maintain your rules evidence

Keep implementation and validation attached to the applicable rule. Use available automated checks alongside the validations your organization performs.

  • Rule tests linked to the records and documents they checked.
  • Organization validations with a method, frequency, and evidence.
  • Implementation status and independent assessment information kept distinct.
Find the rules that apply to you

Automation expectations vary by certification class and requirement. Your team supplies the implementation context and evidence; Boundera makes the checks and remaining work visible.

Built for the next review

Keep the evidence
with the answer.

The output is more than a status on a dashboard. It is the supporting record your security team, assessor, and agency reviewers need to understand the result.

Validation records

The test method, scope, result, and evidence behind the checks you run.

Use your AI agent to explore the evidence
Security Decision Record

Maintained implementation and validation information for the applicable requirements, available with your certification package.

Explore certification package outputs
Reviewer access

Share the appropriate records through your Trust Center and assessor workspace, with supporting evidence close to the requirement.

Explore evidence sharing

KSI & rules validation, explained

How are KSI validation and rules validation different?
KSIs describe security outcomes, such as how you manage identity, detect changes, or recover your service. The consolidated rules also cover how you operate your program, maintain records, communicate, and share evidence. Boundera connects each to its supporting tests, implementation details, and evidence.
Does every requirement have an automated check?
No. Coverage depends on the requirement, the available checks, and the evidence you connect. Boundera shows test results where checks exist and lets your team document organization validations with methods, frequency, and supporting evidence. Missing evidence and checks that have not run remain visible.
Is this only for FedRAMP 20x?
KSI validation supports the 20x path. Consolidated rules workflows also support existing Rev5 programs according to their applicable requirements. Your certification type and class determine the scope. For a Rev5 transition, start with our VDR, VER, and consolidated rules overview.
What can our team give reviewers?
Supporting test records, source evidence, implementation details, and documented validations. Carry maintained records into your Security Decision Record and certification package, then share the appropriate information through your Trust Center and assessor workspace. Independent assessment remains a separate step where required.

Official FedRAMP references · Reviewed October 15, 2026

See the workflow on your requirements

Make your next review easier to explain.

Walk through KSI validation, rules evidence, and the work your team needs to complete.

Walk through your requirements Already on Rev5? Explore your transition