---
tags:
  - 20x
  - Cloud Service Providers
  - Key Security Indicators
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Identity and Access Management






### Automating Account Management

??? abstract "KSI-IAM-AAM"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    The lifecycle and privileges of all accounts, roles, and groups are securely managed using automation.



    **Related SP 800-53 Controls:** [AC-02 (02)](../../../reference/controls/access-control.md#ac-02-02){ data-preview }, [AC-02 (03)](../../../reference/controls/access-control.md#ac-02-03){ data-preview }, [AC-02 (13)](../../../reference/controls/access-control.md#ac-02-13){ data-preview }, [AC-06 (07)](../../../reference/controls/access-control.md#ac-06-07){ data-preview }, [IA-04 (04)](../../../reference/controls/identification-and-authentication.md#ia-04-04){ data-preview }, [IA-12](../../../reference/controls/identification-and-authentication.md#ia-12){ data-preview }, [IA-12 (02)](../../../reference/controls/identification-and-authentication.md#ia-12-02){ data-preview }, [IA-12 (03)](../../../reference/controls/identification-and-authentication.md#ia-12-03){ data-preview }, [IA-12 (05)](../../../reference/controls/identification-and-authentication.md#ia-12-05){ data-preview }

### Adopting Passwordless Methods

??? abstract "KSI-IAM-APM"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used.



    **Related SP 800-53 Controls:** [AC-03](../../../reference/controls/access-control.md#ac-03){ data-preview }, [IA-05 (01)](../../../reference/controls/identification-and-authentication.md#ia-05-01){ data-preview }, [IA-05 (02)](../../../reference/controls/identification-and-authentication.md#ia-05-02){ data-preview }, [IA-05 (06)](../../../reference/controls/identification-and-authentication.md#ia-05-06){ data-preview }, [IA-06](../../../reference/controls/identification-and-authentication.md#ia-06){ data-preview }, [AC-02](../../../reference/controls/access-control.md#ac-02){ data-preview }, [IA-02](../../../reference/controls/identification-and-authentication.md#ia-02){ data-preview }, [IA-02 (01)](../../../reference/controls/identification-and-authentication.md#ia-02-01){ data-preview }, [IA-02 (02)](../../../reference/controls/identification-and-authentication.md#ia-02-02){ data-preview }, [IA-02 (08)](../../../reference/controls/identification-and-authentication.md#ia-02-08){ data-preview }, [IA-05](../../../reference/controls/identification-and-authentication.md#ia-05){ data-preview }, [IA-08](../../../reference/controls/identification-and-authentication.md#ia-08){ data-preview }, [SC-23](../../../reference/controls/system-and-communications-protection.md#sc-23){ data-preview }

### Ensuring Least Privilege

??? abstract "KSI-IAM-ELP"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need.



    **Related SP 800-53 Controls:** [AC-02 (05)](../../../reference/controls/access-control.md#ac-02-05){ data-preview }, [AC-02 (06)](../../../reference/controls/access-control.md#ac-02-06){ data-preview }, [AC-03](../../../reference/controls/access-control.md#ac-03){ data-preview }, [AC-04](../../../reference/controls/access-control.md#ac-04){ data-preview }, [AC-06](../../../reference/controls/access-control.md#ac-06){ data-preview }, [AC-12](../../../reference/controls/access-control.md#ac-12){ data-preview }, [AC-14](../../../reference/controls/access-control.md#ac-14){ data-preview }, [AC-17](../../../reference/controls/access-control.md#ac-17){ data-preview }, [AC-17 (01)](../../../reference/controls/access-control.md#ac-17-01){ data-preview }, [AC-17 (02)](../../../reference/controls/access-control.md#ac-17-02){ data-preview }, [AC-17 (03)](../../../reference/controls/access-control.md#ac-17-03){ data-preview }, [AC-20](../../../reference/controls/access-control.md#ac-20){ data-preview }, [AC-20 (01)](../../../reference/controls/access-control.md#ac-20-01){ data-preview }, [CM-02 (07)](../../../reference/controls/configuration-management.md#cm-02-07){ data-preview }, [CM-09](../../../reference/controls/configuration-management.md#cm-09){ data-preview }, [IA-02](../../../reference/controls/identification-and-authentication.md#ia-02){ data-preview }, [IA-03](../../../reference/controls/identification-and-authentication.md#ia-03){ data-preview }, [IA-04](../../../reference/controls/identification-and-authentication.md#ia-04){ data-preview }, [IA-04 (04)](../../../reference/controls/identification-and-authentication.md#ia-04-04){ data-preview }, [IA-05 (02)](../../../reference/controls/identification-and-authentication.md#ia-05-02){ data-preview }, [IA-05 (06)](../../../reference/controls/identification-and-authentication.md#ia-05-06){ data-preview }, [IA-11](../../../reference/controls/identification-and-authentication.md#ia-11){ data-preview }, [PS-02](../../../reference/controls/personnel-security.md#ps-02){ data-preview }, [PS-03](../../../reference/controls/personnel-security.md#ps-03){ data-preview }, [PS-04](../../../reference/controls/personnel-security.md#ps-04){ data-preview }, [PS-05](../../../reference/controls/personnel-security.md#ps-05){ data-preview }, [PS-06](../../../reference/controls/personnel-security.md#ps-06){ data-preview }, [SC-04](../../../reference/controls/system-and-communications-protection.md#sc-04){ data-preview }, [SC-20](../../../reference/controls/system-and-communications-protection.md#sc-20){ data-preview }, [SC-21](../../../reference/controls/system-and-communications-protection.md#sc-21){ data-preview }, [SC-22](../../../reference/controls/system-and-communications-protection.md#sc-22){ data-preview }, [SC-23](../../../reference/controls/system-and-communications-protection.md#sc-23){ data-preview }, [SC-39](../../../reference/controls/system-and-communications-protection.md#sc-39){ data-preview }, [SI-03](../../../reference/controls/system-and-information-integrity.md#si-03){ data-preview }

    ---
    **Terms:** [Persistently](../../../definitions/#persistently){ data-preview }
### Authorizing Just-in-Time

??? abstract "KSI-IAM-JIT"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.



    **Related SP 800-53 Controls:** [AC-02](../../../reference/controls/access-control.md#ac-02){ data-preview }, [AC-02 (01)](../../../reference/controls/access-control.md#ac-02-01){ data-preview }, [AC-02 (02)](../../../reference/controls/access-control.md#ac-02-02){ data-preview }, [AC-02 (03)](../../../reference/controls/access-control.md#ac-02-03){ data-preview }, [AC-02 (04)](../../../reference/controls/access-control.md#ac-02-04){ data-preview }, [AC-02 (06)](../../../reference/controls/access-control.md#ac-02-06){ data-preview }, [AC-03](../../../reference/controls/access-control.md#ac-03){ data-preview }, [AC-04](../../../reference/controls/access-control.md#ac-04){ data-preview }, [AC-05](../../../reference/controls/access-control.md#ac-05){ data-preview }, [AC-06](../../../reference/controls/access-control.md#ac-06){ data-preview }, [AC-06 (01)](../../../reference/controls/access-control.md#ac-06-01){ data-preview }, [AC-06 (02)](../../../reference/controls/access-control.md#ac-06-02){ data-preview }, [AC-06 (05)](../../../reference/controls/access-control.md#ac-06-05){ data-preview }, [AC-06 (07)](../../../reference/controls/access-control.md#ac-06-07){ data-preview }, [AC-06 (09)](../../../reference/controls/access-control.md#ac-06-09){ data-preview }, [AC-06 (10)](../../../reference/controls/access-control.md#ac-06-10){ data-preview }, [AC-07](../../../reference/controls/access-control.md#ac-07){ data-preview }, [AC-20 (01)](../../../reference/controls/access-control.md#ac-20-01){ data-preview }, [AC-17](../../../reference/controls/access-control.md#ac-17){ data-preview }, [AU-09 (04)](../../../reference/controls/audit-and-accountability.md#au-09-04){ data-preview }, [CM-05](../../../reference/controls/configuration-management.md#cm-05){ data-preview }, [CM-07](../../../reference/controls/configuration-management.md#cm-07){ data-preview }, [CM-07 (02)](../../../reference/controls/configuration-management.md#cm-07-02){ data-preview }, [CM-07 (05)](../../../reference/controls/configuration-management.md#cm-07-05){ data-preview }, [CM-09](../../../reference/controls/configuration-management.md#cm-09){ data-preview }, [IA-04](../../../reference/controls/identification-and-authentication.md#ia-04){ data-preview }, [IA-04 (04)](../../../reference/controls/identification-and-authentication.md#ia-04-04){ data-preview }, [IA-07](../../../reference/controls/identification-and-authentication.md#ia-07){ data-preview }, [PS-02](../../../reference/controls/personnel-security.md#ps-02){ data-preview }, [PS-03](../../../reference/controls/personnel-security.md#ps-03){ data-preview }, [PS-04](../../../reference/controls/personnel-security.md#ps-04){ data-preview }, [PS-05](../../../reference/controls/personnel-security.md#ps-05){ data-preview }, [PS-06](../../../reference/controls/personnel-security.md#ps-06){ data-preview }, [PS-09](../../../reference/controls/personnel-security.md#ps-09){ data-preview }, [RA-05 (05)](../../../reference/controls/risk-assessment.md#ra-05-05){ data-preview }, [SC-02](../../../reference/controls/system-and-communications-protection.md#sc-02){ data-preview }, [SC-23](../../../reference/controls/system-and-communications-protection.md#sc-23){ data-preview }, [SC-39](../../../reference/controls/system-and-communications-protection.md#sc-39){ data-preview }

    ---
    **Terms:** [Persistently](../../../definitions/#persistently){ data-preview }
### Securing Non-User Authentication

??? abstract "KSI-IAM-SNU"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Appropriately secure authentication methods are used and persistently reviewed for non-user accounts and services.



    **Related SP 800-53 Controls:** [AC-02](../../../reference/controls/access-control.md#ac-02){ data-preview }, [AC-02 (02)](../../../reference/controls/access-control.md#ac-02-02){ data-preview }, [AC-04](../../../reference/controls/access-control.md#ac-04){ data-preview }, [AC-06 (05)](../../../reference/controls/access-control.md#ac-06-05){ data-preview }, [IA-03](../../../reference/controls/identification-and-authentication.md#ia-03){ data-preview }, [IA-05 (02)](../../../reference/controls/identification-and-authentication.md#ia-05-02){ data-preview }, [RA-05 (05)](../../../reference/controls/risk-assessment.md#ra-05-05){ data-preview }

    ---
    **Terms:** [Persistently](../../../definitions/#persistently){ data-preview }
### Responding to Suspicious Activity

??? abstract "KSI-IAM-SUS"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Accounts with privileged access are disabled or otherwise secured in response to suspicious activity.



    **Related SP 800-53 Controls:** [AC-02](../../../reference/controls/access-control.md#ac-02){ data-preview }, [AC-02 (01)](../../../reference/controls/access-control.md#ac-02-01){ data-preview }, [AC-02 (03)](../../../reference/controls/access-control.md#ac-02-03){ data-preview }, [AC-02 (13)](../../../reference/controls/access-control.md#ac-02-13){ data-preview }, [AC-07](../../../reference/controls/access-control.md#ac-07){ data-preview }, [PS-04](../../../reference/controls/personnel-security.md#ps-04){ data-preview }, [PS-08](../../../reference/controls/personnel-security.md#ps-08){ data-preview }

    ---
    **Terms:** [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
