Identity & Access
Under FedRAMP 20x, identity and access sit in the KSI-IAM family: automated account lifecycle, passwordless or phishing-resistant MFA, least privilege, just-in-time authorization, non-user credentials, and response to suspicious privileged activity.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
KSI-IAM has no official related SP 800-53 citations in the CR26 catalog (mappingProvenance illustrative). Implementation still uses an IdP, MFA, and access reviews; those are evidence, not a hidden control mapping. Quote KSI statements; do not paraphrase them as extra requirements. Catalog family title: Access is least-privileged, automated, and phishing-resistant.. Indicators on this page: KSI-IAM-AAM, KSI-IAM-APM, KSI-IAM-ELP, KSI-IAM-JIT, KSI-IAM-SNU, KSI-IAM-SUS.
How to implement
Start at the KSI-IAM family page, then each indicator. Map stored artifacts (IdP exports, access-review dates) to indicators. Do not dual-map one artifact onto two indicators.
Common mistakes
- Calling a policy PDF 'least privilege' with no live role assignment. - Inventing related 800-53 controls for KSI-IAM when the catalog lists none.
Related Key Security Indicators
Primary family KSI-IAM. Statements on the indicator pages are verbatim CR26 text.
Questions teams ask
- Which KSI family owns Identity & Access?
- KSI-IAM (Identity and Access Management). Indicator statements are verbatim on the family and indicator pages.
- Are these pages a substitute for the catalog?
- No. FedRAMP.gov and the pinned CR26 KSI catalog are authoritative.
Related hub pages
Primary sources
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- NIST SP 800-53 Rev 5 (security & privacy controls) (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.