Start Here
A versioned scope note, operating instructions, explicit boundaries, and formula-driven readiness counts.
Free XLSX sample 2026 rules · AWS focus
FedRAMP 20x KSI
Evidence Kit.
Turn five current Key Security Indicators into testable AWS measures, traceable evidence, accountable owners, and a collection plan you can inspect before sharing your email.
.xlsx · 5 worksheets · 5 KSIs · 15 measures · no email required
Why now
The evidence model is becoming concrete.
FedRAMP launched the Consolidated Rules for 2026 on June 24, 2026. The current Security Decision Record rules require short KSI summaries covering measures and objectives, persistent cycles, verification, automation accuracy, and validation.
The 20x roadmap says the submission pipeline is planned for FY26 Q4—July through September 2026. That creates a useful product window for cloud teams that need an evidence operating structure before they need another generic compliance document.
Inside the free sample
Five working sheets. No empty early-access gate.
Download the actual workbook, inspect the logic, and decide whether the structure is useful. All AWS examples are editable and clearly separated from claims about your service.
KSI Evidence Map
Five current KSI outcomes with objectives, resource populations, machine and manual validation cycles, pass/fail criteria, ownership, evidence IDs, and official sources.
Validation Measures
Fifteen editable machine and manual measures with AWS examples, query logic, cadence, thresholds, owners, results, and exception references.
Evidence Inventory
Twenty traceable evidence records with source, collection method, period, approved location, integrity field, owner, review state, notes, and sensitivity.
AWS Collector Plan
Twelve collection candidates covering identity, configuration, secrets, logging, and networking—designed to avoid plaintext secret collection and excess permissions.
Selected KSI scope
Five outcomes close to infrastructure work.
- 01 KSI-IAM-AAM Automating account managementIdentity lifecycle, roles, groups, privilege, and authoritative ownership.
- 02 KSI-SVC-ACM Automating configuration managementVersion-controlled desired state, drift detection, inventory, and deviations.
- 03 KSI-SVC-ASM Automating secret managementSecret inventory, protection, rotation, exposure, and exception review.
- 04 KSI-MLA-OSM Operating SIEM capabilityCentralized, tamper-resistant logging, source health, retention, and review.
- 05 KSI-CNA-RNT Restricting network trafficInbound and outbound paths, reachability, rule scope, and approved exceptions.
Full-kit direction
Built after the sample proves demand.
- Current applicable KSI catalog and class notes
- Expanded implementation and verification prompts
- Measure library with AWS and cloud-native examples
- Evidence schemas, traceability, and package checklists
- Security Decision Record and JSON field mapping
- Optional collector-query and automation add-on
No checkout today. Scope and availability are handled directly by email.
Not positioned as
A shortcut to certification.
- Not an official FedRAMP product or template
- Not a complete authorization or certification package
- Not an independent assessment or assessor opinion
- Not a guarantee of compliance, certification, authorization, or ATO
- Not legal, regulatory, contracting, or procurement advice
- Not a replacement for current rules and schemas
Questions
Clear boundaries before the download.
Is this an official FedRAMP template?
No. It is an independent tcinfra.dev implementation aid. It is not affiliated with, certified by, or endorsed by FedRAMP or the U.S. government.
Does completing it make a service FedRAMP certified or authorized?
No. The workbook does not establish compliance, certification, authorization, assessment readiness, or an ATO. Current official rules, schemas, and applicable assessor or agency direction control.
Why is the sample limited to five KSIs?
It is large enough to test the evidence model on real infrastructure work without pretending that an unfinished full kit is already available. The full version is being scoped from actual demand.
Do I need to provide an email to download it?
No. The XLSX is a direct download. Email is only used if you want the full-kit scope and availability.
Inspect the file before you trust the offer.
Download the workbook directly. If its evidence model fits your team, email for the full-kit scope and availability. No payment integration and no email wall.
Direct download · No email required · No payment · [email protected]