KSI-IAM-SUS - Identity and Access Management
Responding to Suspicious Activity
Official statement
Accounts with privileged access are disabled or otherwise secured in response to suspicious activity.
The official reference cites no related SP 800-53 controls for this indicator.
Other Identity and Access Management indicators
- KSI-IAM-AAM - Automating Account Management
- KSI-IAM-APM - Adopting Passwordless Methods
- KSI-IAM-ELP - Ensuring Least Privilege
- KSI-IAM-JIT - Authorizing Just-in-Time
- KSI-IAM-SNU - Securing Non-User Authentication
Source: https://fedramp.gov/2026/reference/20x/c/key-security-indicators/. Pinned 2026-09-27 (catalog fedramp-20x-ksi/official-1.0.0-cr26). This page shows the list as pinned on that date. A weekly automated check flags any difference from the official page.