Configuration Management
Change and configuration under 20x are primarily KSI-CMT: log changes, redeploy from version control instead of live edits, review change procedures, and automate validation through deployment. KSI-MLA-EVC and KSI-SVC-ACM add persistent evaluation of machine configuration and drift.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Official related controls on KSI-CMT include CM-3, CM-4, SI-2 (from KSI-CMT-VTD). Do not stack extra GitHub ruleset types onto KSI-CMT-RMV, KSI-CMT-VTD, or KSI-CMT-RVP for verification — those indicators already have automated methods in product. Catalog family title: Changes are logged, redeployed from version-controlled resources, and validated through deployment.. Indicators on this page: KSI-CMT-LMC, KSI-CMT-RMV, KSI-CMT-RVP, KSI-CMT-VTD, KSI-MLA-EVC, KSI-SVC-ACM.
How to implement
Redeploy from tagged artifacts. Automate tests in the pipeline. Point config-drift collectors at intended state. See implementation guides for GitHub, Terraform, and CI/CD when they ship.
Common mistakes
- Hot-patching production and calling it KSI-CMT-RMV. - Adding more GitHub org ruleset types onto CMT indicators that already have two automated methods.
Related Key Security Indicators
Primary family KSI-CMT. Statements on the indicator pages are verbatim CR26 text.
Questions teams ask
- Which KSI family owns Configuration Management?
- KSI-CMT (Change Management). Indicator statements are verbatim on the family and indicator pages.
- Are these pages a substitute for the catalog?
- No. FedRAMP.gov and the pinned CR26 KSI catalog are authoritative.
Related hub pages
Primary sources
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- NIST SP 800-53 Rev 5 (security & privacy controls) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.