📢 New post: Is It Even in Your Boundary? CVE-2026-0257 and the Question a KEV Clock Asks First · 📝 Also fresh: 20x Is Permanent Now: The Rehearsal's Over, the Rules Land in June · 🚦 Beacon — the FedRAMP 20x KSI emitter — design partners open ✨ · 🆕 20x Hub: program reference, kept current · 🧪 Free tool: KSI Quick Check — paste, run, get the verdict

FedRAMP Controls / IA

IA-5(6) Protection of Authenticators

Family IA
Baselines moderate
Mapped KSIs 3

Control statement

Protect authenticators commensurate with the security category of the information to which use of the authenticator permits access.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators

KSITitleCategory
KSI-IAM-02Passwordless Authentication
Use secure passwordless methods for user authentication and authorization when feasible, otherwise enforce strong passwords with MFA.
Identity and Access Management
KSI-IAM-05Least Privilege
_Persistently_ ensure that identity and access management employs measures to ensure each user or device can only access the resources they need.
Identity and Access Management
KSI-SVC-06Secret Management
Automate management, protection, and regular rotation of digital keys, certificates, and other secrets.
Service Configuration