Implementation guides
These pages map official FedRAMP 20x Key Security Indicators onto common clouds, IaC, and VCS tools. They are educational starting points. FedRAMP does not certify a Terraform module or a GitHub Action by name. Quote the KSI statement; do not treat a vendor checkbox as the requirement.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Each child page names the KSI families that usually show up on that platform (IAM, CMT, MLA, SVC, INR) and the kind of replayable artifact a reviewer can ask for. None of this is an official FedRAMP architecture. scm.cc ConMon connectors are one way to collect facts; they are not the assessment.
How to implement
Pick the platform you actually run. Open the matching KSI family on the hub. Write the validation process into the Security Decision Record. Then look at the assessor-skills labs if you need to practice grading labeled test data.
Common mistakes
- Copying an AWS guide onto Azure and calling the KSI met. - Treating an scm.cc connector as a FedRAMP authorization.
Questions teams ask
- Does FedRAMP certify my Terraform / AWS architecture?
- No. FedRAMP certifies cloud service offerings against published rules. These guides are educational mappings. Confirm current rules on FedRAMP.gov.
- Is an scm.cc connector the same as an assessment?
- No. Connectors collect working facts for the provider. scm.cc is not a Recognized Independent Assessor.
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- Security Decision Record (retrieved 2026-09-27)
- FedRAMP Certification reference (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.