Encryption
CR26 has no separate encryption family. Encryption and cryptographic integrity live in Service Configuration (KSI-SVC): securing information (SIN), automated secret/key rotation (ASM), resource integrity (VRI), and validating communications (VCM).
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
KSI-SVC-SIN: information is encrypted or otherwise secured. KSI-SVC-VRI: cryptographic methods validate integrity. KSI-SVC-VCM is Class C with official related SC-23 and SI-07 (01). KSI-SVC-PRR/RUD/VCM stay unverified in product until a real stored source exists. Catalog family title: Configurations, secrets, encryption, and resource integrity are automated and validated.. Indicators on this page: KSI-SVC-ACM, KSI-SVC-ASM, KSI-SVC-EIS, KSI-SVC-PRR, KSI-SVC-RUD, KSI-SVC-SIN, KSI-SVC-VCM, KSI-SVC-VRI.
How to implement
Document where data is encrypted, how keys rotate, and how communications are authenticated. Use KSI-SVC indicator pages for verbatim statements. Do not invent a KSI-ENC id.
Common mistakes
- Inventing an official encryption KSI family. - Mapping one TLS cert onto both SIN and VCM as if they were the same indicator.
Related Key Security Indicators
Primary family KSI-SVC. Statements on the indicator pages are verbatim CR26 text.
- KSI-SVC-ACM — Automating Configuration Management
- KSI-SVC-ASM — Automating Secret Management
- KSI-SVC-EIS — Evaluating and Improving Security
- KSI-SVC-PRR — Preventing Residual Risk
- KSI-SVC-RUD — Removing Unwanted Data
- KSI-SVC-SIN — Securing Information
- KSI-SVC-VCM — Validating Communications
- KSI-SVC-VRI — Validating Resource Integrity
Questions teams ask
- Which KSI family owns Encryption?
- KSI-SVC (Service Configuration). Indicator statements are verbatim on the family and indicator pages.
- Are these pages a substitute for the catalog?
- No. FedRAMP.gov and the pinned CR26 KSI catalog are authoritative.
Related hub pages
Primary sources
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- NIST SP 800-53 Rev 5 (security & privacy controls) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.