FedRAMP 20x on Kubernetes
Kubernetes offerings still owe KSI coverage for identity to the API, admission, workload identity, logging, and encrypted secrets. A 'hardened cluster' blog post is not the catalog.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
Technical detail
Admission webhooks, Pod Security, and GitOps reconcilers can be automated methods when they fail closed and cover every in-scope namespace. Sampled namespaces are sampled evidence — label them.
How to implement
List control-plane vs data-plane in the SDR. Pair this page with the CI/CD and encryption guides. Confirm current class expectations on FedRAMP.gov; this page does not invent a Kubernetes-specific class.
Common mistakes
- A kube-bench HTML file with no timestamp or cluster id. - Claiming cluster-wide MFA because kubectl uses your laptop password.
Related hub pages
Primary sources
- FedRAMP 20x overview & Core Principles (retrieved 2026-09-27)
- FedRAMP 20x Key Security Indicators (CR26) (retrieved 2026-09-27)
- Security Decision Record (retrieved 2026-09-27)
- FedRAMP Certification reference (retrieved 2026-09-27)
Last verified 2026-09-27. FedRAMP.gov is authoritative.