# 9line: Key Security Indicators (20x Class C)

46 indicators: 0 implemented, 5 partially implemented, 41 not implemented. FedRAMP Consolidated Rules 2026.10.13.01; SDR updated 2026-10-21T17:50:14+00:00.

At least two automated validation methods per KSI (FRC-CSX-VVK); 30 days of daily data (SDR-CSX-KMT).

## Cybersecurity Education (CED)

| KSI | Name | Status | Automated methods (operating / total) | Daily validation, 30 days |
|---|---|---|---|---|
| KSI-CED-RAT | Reviewing All Training | Not Implemented | 0 / 2 | not running yet |

## Change Management (CMT)

| KSI | Name | Status | Automated methods (operating / total) | Daily validation, 30 days |
|---|---|---|---|---|
| KSI-CMT-LMC | Logging Changes | Partially Implemented | 1 / 3 | not running yet |
| KSI-CMT-RMV | Redeploying vs Modifying | Not Implemented | 0 / 3 | not running yet |
| KSI-CMT-RVP | Reviewing Change Procedures | Not Implemented | 0 / 2 | not running yet |
| KSI-CMT-VTD | Validating Throughout Deployment | Partially Implemented | 2 / 4 | not running yet |

## Cloud Native Architecture (CNA)

| KSI | Name | Status | Automated methods (operating / total) | Daily validation, 30 days |
|---|---|---|---|---|
| KSI-CNA-DFP | Defining Functionality and Privileges | Not Implemented | 0 / 2 | not running yet |
| KSI-CNA-EIS | Enforcing Intended State | Not Implemented | 0 / 2 | not running yet |
| KSI-CNA-IBP | Implementing Best Practices | Not Implemented | 0 / 2 | not running yet |
| KSI-CNA-MAT | Minimizing Attack Surface | Not Implemented | 0 / 3 | not running yet |
| KSI-CNA-OFA | Optimizing for Availability | Not Implemented | 0 / 2 | not running yet |
| KSI-CNA-RNT | Restricting Network Traffic | Not Implemented | 0 / 3 | not running yet |
| KSI-CNA-RVP | Reviewing Protections | Not Implemented | 0 / 2 | not running yet |
| KSI-CNA-ULN | Using Logical Networking | Not Implemented | 0 / 2 | not running yet |

## Identity and Access Management (IAM)

| KSI | Name | Status | Automated methods (operating / total) | Daily validation, 30 days |
|---|---|---|---|---|
| KSI-IAM-AAM | Automating Account Management | Not Implemented | 0 / 2 | not running yet |
| KSI-IAM-APM | Adopting Passwordless Methods | Not Implemented | 0 / 3 | not running yet |
| KSI-IAM-ELP | Ensuring Least Privilege | Not Implemented | 0 / 2 | not running yet |
| KSI-IAM-JIT | Authorizing Just-in-Time | Not Implemented | 0 / 2 | not running yet |
| KSI-IAM-SNU | Securing Non-User Authentication | Not Implemented | 1 / 3 | not running yet |
| KSI-IAM-SUS | Responding to Suspicious Activity | Not Implemented | 0 / 2 | not running yet |

## Incident Response (INR)

| KSI | Name | Status | Automated methods (operating / total) | Daily validation, 30 days |
|---|---|---|---|---|
| KSI-INR-AAR | Generating After Action Reports | Not Implemented | 0 / 2 | not running yet |
| KSI-INR-RIR | Reviewing Incident Response Procedures | Not Implemented | 0 / 2 | not running yet |
| KSI-INR-RPI | Reviewing Past Incidents | Not Implemented | 0 / 2 | not running yet |

## Monitoring, Logging, and Auditing (MLA)

| KSI | Name | Status | Automated methods (operating / total) | Daily validation, 30 days |
|---|---|---|---|---|
| KSI-MLA-ALA | Authorizing Log Access | Not Implemented | 0 / 2 | not running yet |
| KSI-MLA-EVC | Evaluating Configurations | Not Implemented | 0 / 2 | not running yet |
| KSI-MLA-LET | Logging Event Types | Not Implemented | 0 / 2 | not running yet |
| KSI-MLA-OSM | Operating SIEM Capability | Not Implemented | 0 / 3 | not running yet |
| KSI-MLA-RVL | Reviewing Logs | Not Implemented | 0 / 2 | not running yet |

## Policy and Inventory (PIY)

| KSI | Name | Status | Automated methods (operating / total) | Daily validation, 30 days |
|---|---|---|---|---|
| KSI-PIY-GIV | Generating Inventories | Not Implemented | 0 / 2 | not running yet |
| KSI-PIY-RES | Reviewing Executive Support | Not Implemented | 0 / 2 | not running yet |
| KSI-PIY-RIS | Reviewing Investments in Security | Not Implemented | 0 / 2 | not running yet |
| KSI-PIY-RSD | Reviewing Security in the SDLC | Partially Implemented | 2 / 2 | not running yet |
| KSI-PIY-RVD | Reviewing Vulnerability Disclosures | Not Implemented | 0 / 2 | not running yet |

## Recovery Planning (RPL)

| KSI | Name | Status | Automated methods (operating / total) | Daily validation, 30 days |
|---|---|---|---|---|
| KSI-RPL-ABO | Aligning Backups with Objectives | Not Implemented | 0 / 2 | not running yet |
| KSI-RPL-ARP | Aligning Recovery Plan | Not Implemented | 0 / 2 | not running yet |
| KSI-RPL-RRO | Reviewing Recovery Objectives | Partially Implemented | 0 / 2 | not running yet |
| KSI-RPL-TRC | Testing Recovery Capabilities | Not Implemented | 0 / 2 | not running yet |

## Supply Chain Risk (SCR)

| KSI | Name | Status | Automated methods (operating / total) | Daily validation, 30 days |
|---|---|---|---|---|
| KSI-SCR-MIT | Mitigating Supply Chain Risk | Partially Implemented | 0 / 2 | not running yet |
| KSI-SCR-MON | Monitoring Supply Chain Risk | Not Implemented | 0 / 2 | not running yet |

## Service Configuration (SVC)

| KSI | Name | Status | Automated methods (operating / total) | Daily validation, 30 days |
|---|---|---|---|---|
| KSI-SVC-ACM | Automating Configuration Management | Not Implemented | 0 / 2 | not running yet |
| KSI-SVC-ASM | Automating Secret Management | Not Implemented | 1 / 2 | not running yet |
| KSI-SVC-EIS | Evaluating and Improving Security | Not Implemented | 0 / 2 | not running yet |
| KSI-SVC-PRR | Preventing Residual Risk | Not Implemented | 0 / 2 | not running yet |
| KSI-SVC-RUD | Removing Unwanted Data | Not Implemented | 0 / 2 | not running yet |
| KSI-SVC-SIN | Securing Information | Not Implemented | 0 / 2 | not running yet |
| KSI-SVC-VCM | Validating Communications | Not Implemented | 0 / 2 | not running yet |
| KSI-SVC-VRI | Validating Resource Integrity | Not Implemented | 0 / 2 | not running yet |

Generated 2026-10-21T17:50:14+00:00. Machine-readable: ksi-status.json.