FedRAMP guide

FedRAMP 20x and Key Security Indicators

By the ShipReady Metrics research team. Published September 22, 2026. Sources are cited inline at the end of each page.

FedRAMP 20x is the program's rebuild around automation: security posture demonstrated through machine-validated Key Security Indicators (KSIs) instead of static documents reviewed once a year. Two pilot phases are complete. This guide summarizes what FedRAMP itself reported, and what it means for how you build evidence.

What the pilots actually did

Per FedRAMP's own 20x page (checked September 22, 2026):

• Phase 1 (April to September 2025, Low impact). A public pilot centered almost entirely on KSIs as a proof of concept for automation-based validation. FedRAMP received 26 complete packages between May 30 and August 18, 2025; the first cohorts received pilot authorizations in late July 2025.
• Phase 2 (November 18, 2025 to March 2026, Moderate impact). Tested the depth, breadth and burden of each KSI at Moderate. Participation was limited to passing Phase 1 providers, AI-prioritized offerings, and critical-need services. FedRAMP received 14 qualifying submissions; the first cohort was authorized March 6, 2026, with six more providers authorized by late April 2026.

What FedRAMP says it learned

FedRAMP's published lessons from the pilots, in plain terms:

• KSIs can demonstrate security posture in near real time, replacing static yearly manual assessments.
• The KSI approach adapts to higher impact levels; Phase 2 validated it at Moderate.
• Automated validations can integrate into providers' existing tools and processes.
• Assessment moves beyond control-by-control minimum-bar audits toward evaluating security decisions.
• Fast reviews shared traits: timely submission access, consistent machine-readable schemas, concise evidence context, clear failure criteria, and assessor review of the validation code itself.

What this means for your evidence pipeline

1. Evidence becomes data, not documents. A KSI is validated by machine-readable output. Screenshots and PDF binders do not feed that pipeline; API-sourced, structured evidence does.
2. Validation logic is itself reviewed. Phase 2 reviewers looked at the validation code. Your evidence automation needs to be inspectable: clear pass/fail criteria, no opaque transformations.
3. Continuous beats annual by design. If posture is demonstrable near real time, the monthly ConMon grind and the annual scramble both compress. The teams that already run continuous evidence collection are the ones 20x rewards.
4. Traditional ConMon still governs today. Until your authorization path is 20x, the monthly obligations stand. See ConMon requirements. Build the pipeline once; serve both.

The honest caveat

20x is a pilot program with a small number of authorized participants, and its requirements continue to evolve between phases. Treat KSI lists and submission mechanics as moving until FedRAMP finalizes them, and verify against the current 20x documentation before building compliance commitments on top of them.

Frequently asked questions

What is a FedRAMP Key Security Indicator?

A specific, machine-checkable statement about security posture, validated automatically rather than through annual document review. KSIs were the core mechanism tested in both 20x pilot phases.

Is FedRAMP 20x available to everyone?

Not yet. Phase 1 was a public Low-impact pilot; Phase 2 was limited to selected participants at Moderate. FedRAMP has described broader rollout as the goal, with requirements still evolving.

Does 20x replace NIST 800-53 controls?

No. KSIs express security outcomes that map back to the control baselines. The pilots tested KSI-based validation as the delivery mechanism, not a repeal of the control framework.