---
tags:
  - 20x
  - Cloud Service Providers
  - Key Security Indicators
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Policy and Inventory






### Generating Inventories

??? abstract "KSI-PIY-GIV"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Authoritative sources are used to automatically generate real-time inventories of all information resources when needed.



    **Related SP 800-53 Controls:** [CM-02 (02)](../../../reference/controls/configuration-management.md#cm-02-02){ data-preview }, [CM-07 (05)](../../../reference/controls/configuration-management.md#cm-07-05){ data-preview }, [CM-08](../../../reference/controls/configuration-management.md#cm-08){ data-preview }, [CM-08 (01)](../../../reference/controls/configuration-management.md#cm-08-01){ data-preview }, [CM-12](../../../reference/controls/configuration-management.md#cm-12){ data-preview }, [CM-12 (01)](../../../reference/controls/configuration-management.md#cm-12-01){ data-preview }, [CP-02 (08)](../../../reference/controls/contingency-planning.md#cp-02-08){ data-preview }

    ---
    **Terms:** [Information Resource](../../../definitions/#information-resource){ data-preview }
### Reviewing Executive Support

??? abstract "KSI-PIY-RES"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Executive support for achieving the provider's security goals is persistently reviewed and demonstrated.


    ---
    **Terms:** [Persistently](../../../definitions/#persistently){ data-preview }
### Reviewing Investments in Security

??? abstract "KSI-PIY-RIS"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    The effectiveness of the provider's investments in achieving security goals is persistently reviewed.



    **Related SP 800-53 Controls:** [AC-05](../../../reference/controls/access-control.md#ac-05){ data-preview }, [CA-02](../../../reference/controls/assessment-authorization-and-monitoring.md#ca-02){ data-preview }, [CP-02 (01)](../../../reference/controls/contingency-planning.md#cp-02-01){ data-preview }, [CP-04 (01)](../../../reference/controls/contingency-planning.md#cp-04-01){ data-preview }, [IR-03 (02)](../../../reference/controls/incident-response.md#ir-03-02){ data-preview }, [PM-03](../../../reference/controls/program-management.md#pm-03){ data-preview }, [SA-02](../../../reference/controls/system-and-services-acquisition.md#sa-02){ data-preview }, [SA-03](../../../reference/controls/system-and-services-acquisition.md#sa-03){ data-preview }, [SR-02 (01)](../../../reference/controls/supply-chain-risk-management.md#sr-02-01){ data-preview }

    ---
    **Terms:** [Persistently](../../../definitions/#persistently){ data-preview }
### Reviewing Security in the SDLC

??? abstract "KSI-PIY-RSD"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    The effectiveness of building security and privacy considerations into the Software Development Lifecycle and aligning with CISA Secure By Design principles is persistently reviewed.



    **Related SP 800-53 Controls:** [AC-05](../../../reference/controls/access-control.md#ac-05){ data-preview }, [AU-03 (03)](../../../reference/controls/audit-and-accountability.md#au-03-03){ data-preview }, [CM-03 (04)](../../../reference/controls/configuration-management.md#cm-03-04){ data-preview }, [PL-08](../../../reference/controls/planning.md#pl-08){ data-preview }, [PM-07](../../../reference/controls/program-management.md#pm-07){ data-preview }, [SA-03](../../../reference/controls/system-and-services-acquisition.md#sa-03){ data-preview }, [SA-08](../../../reference/controls/system-and-services-acquisition.md#sa-08){ data-preview }, [SC-04](../../../reference/controls/system-and-communications-protection.md#sc-04){ data-preview }, [SC-18](../../../reference/controls/system-and-communications-protection.md#sc-18){ data-preview }, [SI-10](../../../reference/controls/system-and-information-integrity.md#si-10){ data-preview }, [SI-11](../../../reference/controls/system-and-information-integrity.md#si-11){ data-preview }, [SI-16](../../../reference/controls/system-and-information-integrity.md#si-16){ data-preview }

    ---
    **Terms:** [Persistently](../../../definitions/#persistently){ data-preview }
### Reviewing Vulnerability Disclosures

??? abstract "KSI-PIY-RVD"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    The effectiveness of the provider's vulnerability disclosure program is persistently reviewed.



    **Related SP 800-53 Controls:** [RA-05 (11)](../../../reference/controls/risk-assessment.md#ra-05-11){ data-preview }

    ---
    **Terms:** [Persistently](../../../definitions/#persistently){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
