FedRAMP 20x and infrastructure as code
Infrastructure as code is how many 20x providers make change reviewable. The official requirement is still the KSI statement (especially KSI-CMT: log changes, redeploy from version control, review procedures, automate validation).
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
IaC is not limited to Terraform: Bicep, Pulumi, CloudFormation, and Kubernetes manifests are all generators. Independence comes from a second collector (policy engine, cloud config API), not from exporting the same graph twice.
How to implement
Write the generator and the verifier as separate SDR activities. Use the evidence page's strong/weak illustrations as teaching examples, not as an official checklist.
Common mistakes
- A README that says 'we use IaC' with no apply log. - Treating a module registry star count as evidence.
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- Security Decision Record (retrieved 2026-09-27)
- FedRAMP Certification reference (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.