KSI-IAM-APM - Identity and Access Management
Adopting Passwordless Methods
Official statement
Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used.
The official reference cites no related SP 800-53 controls for this indicator.
Other Identity and Access Management indicators
- KSI-IAM-AAM - Automating Account Management
- KSI-IAM-ELP - Ensuring Least Privilege
- KSI-IAM-JIT - Authorizing Just-in-Time
- KSI-IAM-SNU - Securing Non-User Authentication
- KSI-IAM-SUS - Responding to Suspicious Activity
Source: https://fedramp.gov/2026/reference/20x/c/key-security-indicators/. Pinned 2026-09-27 (catalog fedramp-20x-ksi/official-1.0.0-cr26). This page shows the list as pinned on that date. A weekly automated check flags any difference from the official page.