feat(compliance): add FedRAMP 20x KSI compliance framework

[ethanolivertroy]

Context

This PR adds support for FedRAMP 20x Key Security Indicators (KSIs) compliance framework to Prowler. FedRAMP 20x is a modernization initiative aimed at automating the FedRAMP authorization process, focusing on continuous monitoring and cloud-native security principles. The 10 KSIs represent core security areas that cloud service providers must address as part of the FedRAMP 20x Phase One pilot program.

This framework enables organizations pursuing FedRAMP authorization to assess their cloud environments against the FedRAMP 20x requirements using Prowler's existing security checks.

Description

This PR introduces FedRAMP 20x KSI compliance frameworks for AWS, Azure, and GCP providers. The implementation maps Prowler's existing security checks to the 10 Key Security Indicators defined by FedRAMP:

Changes included:

• Added 3 new compliance framework JSON files:

  • prowler/compliance/aws/fedramp_20x_ksi_aws.json - Maps 96 AWS checks to KSIs
  • prowler/compliance/azure/fedramp_20x_ksi_azure.json - Maps 73 Azure checks to KSIs
  • prowler/compliance/gcp/fedramp_20x_ksi_gcp.json - Maps 94 GCP checks to KSIs

• Added dashboard visualization modules:

  • dashboard/compliance/fedramp_20x_ksi_aws.py
  • dashboard/compliance/fedramp_20x_ksi_azure.py
  • dashboard/compliance/fedramp_20x_ksi_gcp.py

• Updated documentation:

  • Updated framework counts in docs/tutorials/compliance.md

The 10 KSIs covered:

1. KSI-CED: Cybersecurity Education
2. KSI-CMT: Change Management
3. KSI-CNA: Cloud Native Architecture
4. KSI-IAM: Identity and Access Management
5. KSI-INR: Incident Reporting
6. KSI-MLA: Monitoring, Logging, and Auditing
7. KSI-PIY: Policy and Inventory
8. KSI-RPL: Recovery Planning
9. KSI-SVC: Service Configuration
10. KSI-TPR: Third-Party Information Resources

Each KSI is mapped to relevant NIST 800-53 controls and existing Prowler checks, following the official FedRAMP 20x documentation structure.

Checklist

• Are there new checks included in this PR? No - This PR only adds compliance frameworks that map to existing checks
  • If so, do we need to update permissions for the provider? N/A
• Review if the code is being covered by tests. (Compliance frameworks follow existing patterns)
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.
• Review if is needed to change the Readme.md
• Ensure new entries are added to CHANGELOG.md, if applicable.

API

• Verify if API specs need to be regenerated.
• Check if version updates are required (e.g., specs, Poetry, etc.).
• Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

---

Additional Notes for Reviewers:

• Framework structure follows existing Prowler compliance framework patterns
• Check mappings are based on official FedRAMP 20x KSI documentation: https://github.com/FedRAMP/docs
• Tested locally with GCP provider, achieving expected compliance results
• Dashboard modules handle long KSI descriptions appropriately to prevent UI overlap issues

[ethanolivertroy]

[MrCloudSec]

Thank you for the PR @ethanolivertroy , we will review it soon and get back to you.

[MrCloudSec]

@ethanolivertroy can you add the tests for the new checks? You can find the guide here.

[ethanolivertroy]

Tests added @MrCloudSec 👍

[MrCloudSec]

Tests added @MrCloudSec 👍

Thanks, please add the corresponding tests for the checks too. Also, add the changelog and run our pre-commit.

[ethanolivertroy]

Tests added @MrCloudSec 👍

Thanks, please add the corresponding tests for the checks too. Also, add the changelog and run our pre-commit.

All done. Removed the RCP stuff because that from another branch.

This functionality will really help out orgs working toward https://www.fedramp.gov/20x/goals/

[Copilot]

Pull Request Overview

This PR adds support for FedRAMP 20x Key Security Indicators (KSI) compliance framework to Prowler, enabling organizations pursuing FedRAMP authorization to assess their cloud environments against FedRAMP 20x requirements using existing security checks.

• Introduces 3 new compliance framework JSON files mapping existing Prowler checks to 10 KSI requirements across AWS, Azure, and GCP
• Adds dashboard visualization modules for each provider to handle long KSI descriptions
• Updates documentation with new framework counts and changelog entry

Reviewed Changes

Copilot reviewed 12 out of 14 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
prowler/compliance/aws/fedramp_20x_ksi_aws.json	Maps 96 AWS checks to FedRAMP 20x KSI requirements
prowler/compliance/azure/fedramp_20x_ksi_azure.json	Maps 73 Azure checks to FedRAMP 20x KSI requirements
prowler/compliance/gcp/fedramp_20x_ksi_gcp.json	Maps 94 GCP checks to FedRAMP 20x KSI requirements
dashboard/compliance/fedramp_20x_ksi_*.py	Dashboard modules that shorten long KSI descriptions for UI display
tests/lib/compliance/test_fedramp_20x_ksi_frameworks.py	Framework validation tests
tests/dashboard/compliance/test_fedramp_20x_ksi_*.py	Dashboard module tests
docs/tutorials/compliance.md	Updated framework counts
prowler/CHANGELOG.md	Added changelog entry

Comments suppressed due to low confidence (2)

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 89.65%. Comparing base (dad100b) to head (f810bdb).
⚠️ Report is 64 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #8512       +/-   ##
===========================================
+ Coverage   71.53%   89.65%   +18.11%     
===========================================
  Files          80     1178     +1098     
  Lines        5653    32418    +26765     
===========================================
+ Hits         4044    29065    +25021     
- Misses       1609     3353     +1744     

Flag	Coverage Δ
prowler	?
prowler-py3.10-aws	90.54% <ø> (?)
prowler-py3.10-azure	89.77% <ø> (?)
prowler-py3.10-gcp	90.02% <ø> (?)
prowler-py3.10-kubernetes	89.65% <ø> (?)
prowler-py3.10-nhn	89.59% <ø> (?)
prowler-py3.11-aws	90.57% <ø> (?)
prowler-py3.11-azure	89.79% <ø> (?)
prowler-py3.11-gcp	90.04% <ø> (?)
prowler-py3.11-kubernetes	89.67% <ø> (?)
prowler-py3.12-aws	90.57% <ø> (?)
prowler-py3.12-azure	89.80% <ø> (?)
prowler-py3.12-gcp	90.04% <ø> (?)
prowler-py3.12-kubernetes	89.67% <ø> (?)
prowler-py3.12-nhn	89.61% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
prowler	89.65% <ø> (+18.11%)	⬆️
api	∅ <ø> (∅)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ethanolivertroy]

@pedrooot thanks for removing that CED Education check, I was trying to make it work but makes sense to just leave it out for now

I removed the unneeded changes inside of API, sorry think I got some branch work mixed up 😅

[ethanolivertroy]

Notes-

FedRAMP 20x KSI Low Compliance Framework - Limitations & Usage Guide

Overview

The FedRAMP 20x Key Security Indicators (KSI) Low Impact Level compliance frameworks provide automated security assessment for cloud service providers pursuing FedRAMP Low authorization. These frameworks implement RFC-0014 Phase Two requirements across AWS, Azure, and GCP.

Scope & Purpose

What This Framework Checks:

• Technical cloud infrastructure security controls
• Identity and access management configurations
• Encryption implementation (at rest and in transit)
• Network segmentation and traffic controls
• Logging, monitoring, and audit configurations
• Service configuration security settings
• Change management through automated tooling
• High availability and resilience architecture

What This Framework Does NOT Check:

• Organizational policies and procedures
• Employee training and awareness programs
• Physical security controls
• Manual documentation reviews
• Contractual agreements with third parties
• Business continuity plan documents
• Incident response runbooks (documents vs. technical controls)

Known Limitations

1. Organizational & Training KSIs Not Covered

The following RFC-0014 Phase Two KSIs are intentionally excluded because they require organizational policy validation rather than technical infrastructure checks:

• KSI-CED-01 (Security & Privacy Awareness Training): Requires evidence of employee training programs, completion rates, and testing results
• KSI-CED-03 (Role-Specific Security Training): Requires documentation of role-based training curricula and completion tracking

Rationale: Prowler focuses on automated technical security assessments of cloud infrastructure. These education requirements must be validated through policy document review, training management systems, and manual audits.

2. Technical Implementation Approach

This framework uses an umbrella category approach to organize checks:

Umbrella Category	RFC-0014 Phase Two Requirements Covered
KSI-CMT (Change Management)	CMT-01 (Service Modification Logging), CMT-04 (Change Management Compliance)
KSI-CNA (Cloud Native Architecture)	CNA-01 (Network Traffic Limitation)
KSI-IAM (Identity & Access Management)	IAM-05 (Zero Trust Design)
KSI-SVC (Service Configuration)	SVC-03 (Encryption at Rest)
KSI-IAM-07 (Account Lifecycle)	Explicitly implemented as dedicated requirement
KSI-MLA-07 (Monitoring Inventory)	Explicitly implemented as dedicated requirement

Benefits: Comprehensive multi-layered coverage, easier maintenance across 483+ checks, and practical CSP validation.

3. CI/CD Pipeline Security Gap

RFC-0014 Requirement: KSI-CMT-03 (Persistent Automated Testing)

Current Coverage: Partial

• Automated compliance monitoring (AWS Config, SSM)
• Automated patch management
• Gap: CI/CD pipeline security checks

Missing Technical Checks:

• CodeBuild project security configurations
• CodePipeline artifact encryption
• Build-time secret management
• Container image scanning in pipelines

Why This Gap Exists:

• Many CSPs use external CI/CD tools (Jenkins, GitLab CI, GitHub Actions) rather than AWS-native services
• The framework focuses on deployed infrastructure rather than build pipelines

Mitigation: Organizations using AWS CodeBuild/CodePipeline should manually validate artifact encryption, build logging, secret management, and least privilege IAM roles.

4. Subject to RFC-0014 Finalization

Current Implementation: Based on RFC-0014 Phase Two as published at https://www.fedramp.gov/rfcs/0014/

Notes:

• This framework implements RFC-0014 Phase Two as of November 2025
• Framework will be updated if FedRAMP publishes material changes
• Moderate impact level KSIs (CNA-08, MLA-08, SVC-08, SVC-09, SVC-10) are not included in this Low framework

Implementation Notes

What This Framework Implements

Original KSI Categories (9):

• KSI-CED (Cybersecurity Education), KSI-CMT (Change Management), KSI-CNA (Cloud Native Architecture), KSI-IAM (Identity & Access Management), KSI-INR (Incident Response), KSI-MLA (Monitoring, Logging, and Auditing), KSI-PIY (Policy and Inventory), KSI-RPL (Recovery Planning), KSI-SVC (Service Configuration), KSI-TPR (Third-Party Resources)

RFC-0014 Phase Two Additions for Low (3):

• KSI-CED-03: Role-Specific Training
• KSI-IAM-07: Account Lifecycle Management
• KSI-MLA-07: Monitoring and Logging Inventory

Total: 12 KSI requirements with 184+ automated security checks

Evolution from Original KSI to RFC-0014 Phase Two

Retired KSIs (consolidated into other requirements):

• KSI-MLA-04 (authenticated vulnerability scanning) - merged into MLA-03
• KSI-MLA-06 (centralized vulnerability tracking) - merged into MLA-03
• KSI-TPR-02 (third-party authorization confirmation) - merged into TPR-01

Enhanced Requirements:

• KSI-INR: Renamed from "Incident Reporting" to "Incident Response" (reactive to proactive)
• KSI-CMT-03: Changed from "pre-deployment" to "persistent" automated testing
• KSI-SVC-03: Encryption now required "by default" (expanded scope)
• 19 additional KSIs enhanced with stronger validation requirements

Philosophical Shift:

• Phase One: Written attestation acceptable for Low impact level
• Phase Two: Automated, evidence-based validation with continuous monitoring

What's Excluded

Moderate-Only KSIs (not applicable to Low):

• KSI-CNA-08 (automated security posture assessment), KSI-MLA-08 (least-privilege log access), KSI-SVC-08 (change validation), KSI-SVC-09 (communication integrity), KSI-SVC-10 (data removal)

Retired KSIs (superseded by Phase Two consolidation):

• KSI-MLA-04, KSI-MLA-06, KSI-TPR-02

Coverage Analysis

RFC-0014 Phase Two Low Impact Level Requirements

Requirement	Coverage	Check Count	Status
KSI-CMT-01 (Service Modification Logging)	Excellent	15	PASS
KSI-CMT-03 (Persistent Automated Testing)	Partial	2-3	PARTIAL
KSI-CMT-04 (Change Management Compliance)	Good	6	PASS
KSI-CNA-01 (Network Traffic Limitation)	Excellent	9	PASS
KSI-IAM-05 (Zero Trust Design)	Excellent	12	PASS
KSI-IAM-07 (Account Lifecycle Management)	Explicit	6	PASS
KSI-MLA-07 (Monitoring & Logging Inventory)	Explicit	5	PASS
KSI-SVC-03 (Encryption at Rest)	Excellent	23	PASS
Total Technical Coverage	87.5%	78-79	PASS

Framework Statistics

Provider	Total Checks	KSI Categories	Status
AWS	175	13	Validated
Azure	186	13	Validated
GCP	122	13	Validated

Usage Guidance

Running FedRAMP 20x KSI Low Scans

# AWS
prowler aws --compliance fedramp_20x_ksi_low_aws

# Azure
prowler azure --compliance fedramp_20x_ksi_low_azure

# GCP
prowler gcp --compliance fedramp_20x_ksi_low_gcp

Interpreting Results

PASS Results:

• Technical control is properly implemented
• Configuration meets FedRAMP KSI requirement
• No additional action needed for this specific check

FAIL Results:

• Technical control is missing or misconfigured
• Remediation required to meet FedRAMP KSI requirement
• Review check documentation for remediation guidance

Important: A complete FedRAMP Low authorization requires both:

1. Passing technical checks (automated via Prowler)
2. Organizational controls and documentation (manual validation)

What Additional Validation Is Required

Organizations must manually validate:

1. Training & Education (KSI-CED-01, KSI-CED-03) - Security awareness and role-specific training programs
2. CI/CD Pipeline Security (KSI-CMT-03 gap) - Build pipeline security if using AWS CodeBuild/CodePipeline
3. Policy Documentation - Incident response, change management, access control policies
4. Third-Party Management (KSI-TPR) - Vendor assessments and supply chain risk management

References

• Original KSI Document: https://github.com/FedRAMP/docs/blob/main/markdown/FRMR.KSI.key-security-indicators.md (Base requirements)
• RFC-0014 Phase Two: https://www.fedramp.gov/rfcs/0014/ (Updates and enhancements)
• Prowler Documentation: https://docs.prowler.com/

---

Summary

The FedRAMP 20x KSI Low frameworks provide 87.5% automated coverage of RFC-0014 Phase Two technical requirements across 483+ checks for AWS, Azure, and GCP. The frameworks excel at validating cloud infrastructure security but require complementary organizational policies and manual validation for training/education KSIs and CI/CD pipeline security to achieve complete FedRAMP Low compliance.

[ethanolivertroy]

Closing this to clean it up after talking with @pedrooot