KSI evidence evaluation
Practice reading the official CR26 KSI catalog (10 families, 46 indicators) and grading evidence quality without inventing requirements.
Educational resource only. scm.cc is not a FedRAMP Recognized Independent Assessor (3PAO) and is not FedRAMP-authorized; it grants no authorization, certification, or assessment outcome. FedRAMP.gov is the authoritative source. This is not legal advice.
This is scm.cc skills training. Completing a course or receiving an scm.cc training certificate does not make you a FedRAMP Recognized Independent Assessor, is not a FedRAMP credential, and is not government recognition. Official recognition requires A2LA accreditation (REC-IAS-ACC) and FedRAMP Recognition. FedRAMP.gov is the authoritative source. This is not legal advice.
Who it is for
Reviewers who will be asked to say whether a KSI validation process is actually running.
- Quote indicator statements from the catalog instead of paraphrasing new requirements.
- Separate strong (dated, replayable, independent) evidence from weak (policy PDF, screenshot-only) evidence.
- Use the synthetic offering to practice held / tampered / not-measured calls.
Lessons
- The 10 families and 46 indicators
The pinned CR26 KSI catalog on scm.cc is 10 families and 46 indicators, retrieved 2026-09-27 from the official Key Security Indicators reference. The statements are verbatim. Family titles on scm.cc are display summaries, not extra official text.
- Strong vs weak evidence
The hub's evidence page publishes scm.cc-authored strong/weak pairs labeled as illustrations. They are teaching examples, not an official FedRAMP checklist.
- Automated methods and independence
Class C materials on FedRAMP.gov discuss automated validation methods per KSI. Confirm the current method-count and independence wording on the Certification reference — this lesson does not invent a number.
- Grading a packet without inventing requirements
A packet is a set of facts plus the official statement. Your grade has to cite the statement. If the statement does not ask for a control, do not fail the provider for missing that control.
Labs (auto-graded)
- Grade KSI-IAM-APM on the synthetic offering
The fixture marks this indicator not held.
- Detect a tampered hash on KSI-CMT-RMV
Content hash and expected hash disagree.
- Find indicators with no facts
Most catalog indicators have no synthetic facts — that is not_measured, not a pass.
Enroll
Related
Questions
- Is this a FedRAMP or A2LA credential?
- No. Completing the course yields an scm.cc training certificate only. Official Recognition requires A2LA accreditation (REC-IAS-ACC).
- What is indexable before I pay?
- This landing page, the lesson previews, and the free intro lesson body. Paid lesson bodies are omitted from the public HTML — the same for humans and crawlers.