FRC-CSX-VVK - How does FedRAMP interpret "Automated Methods" for KSI Validation

[jdettweiler]

I was hoping to see if I could get some clarity around FRC-CSX-VVK, which requires automated methods to persistently verify and validate the accuracy and completeness of each Key Security Indicator. Current requirements are noted as:

Class A: MAY implement automated methods; no minimum.
Class B: SHOULD use at least 1 automated method per KSI.
Class C: MUST use at least 2 automated methods per KSI.
Class D: MUST use at least 4 automated methods per KSI.

Source: FRR.FRC.data.20x.CSX.FRC-CSX-VVK, dataset version 2026.09.13.02

Would it be possible for FedRAMP clarify how it determines whether two automated validations are distinct methods for this purpose? We are currently building out an automated assessment platform, so I want to provide a real world example of how we are validating/assessing KSI-CNA-EIS "Enforcing Intended State". The platform executes multiple deterministic checks and produces a single assessor-readable "assessment" report. The assessment currently evaluates:

Assessment area	Intended role
Persistent vulnerability and compliance scan telemetry	Recurring machine-resource security assessment
Organization Policy source-to-effective-state comparison	Validate that deployed effective policies match version-controlled intended state
Provider boundary source-to-live-membership comparison	Validate that provider boundary enforcement is active for the complete scoped population
OS policy source-to-live-assignment comparison	Validate that deployed OS policy assignments match the intended enforcement chain
Endpoint/host policy and agent telemetry	Validate bounded host anti-malware enforcement
GCP asset and enabled-service inventory coverage	Establish complete population coverage for the above validations
Finding/disposition tracking	Confirm that detected drift and findings are tracked
Process documentation	Establish the documented assessment and lifecycle process

The automated assessment platform produces machine-readable results/evidence, operates on defined in-scope populations, has distinct logic and failure conditions, and is designed to run repeatedly.

Since this is all occurring in a single assessment platform, ultimately the question is does this count as a single "automated method" or does the table above represent multiple "automated methods" since deterministic telemetry is being retrieved and correlated from multiple security mechanisms within the environment (e.g., vulnerability scanner, endpoint manager, document repository that contains policy and procedures, ITSM, etc.)?

[pete-gov]

Would it be possible for FedRAMP clarify how it determines whether two automated validations are distinct methods for this purpose?

This is up to the cloud service provider. You are making a choice that is designed to assure customers of your security posture and coverage of the KSI. If you make poor choices, potential customers are less likely to find your assurance adequate. If you make good choices, potential customers are more likely to find your assurance adequate.

Don't think of this as "what do I need to do to get a FedRAMP Certification" - think of it as "what do I need to do to assurance customers that I protect their information?"

During FedRAMP Certification we will include our own report on how usefully assuring and diverse we think the methods used are.