Generated from the official FedRAMP/rules GitHub repo. Source path: fedramp-consolidated-rules.json on main at blob 7d628b63fdd9. Consolidated Rules version: 2026.07.02.02 · upstream last_updated: 2026-07-02. Supporting narrative documentation is available from the official FedRAMP/2026-markdown repository.

Cybersecurity Education

Domain code: CED · Domain ID: KSI-CED · Web slug: cybersecurity-education

Indicators

KSI-CED-RAT — Reviewing All Training

The effectiveness of relevant cybersecurity education and training is persistently reviewed, including at least general training for all employees, role-specific training for employees in high risk roles, training for development and engineering staff on secure software delivery, and training for staff involved with incident response or disaster recovery.

Mapped Rev5 controls: cp-3, ir-2, ps-6, at-2, at-2.2, at-2.3, at-3.5, at-4, ir-2.3, at-3, sr-11.1

Terms: Incident, Persistently, Vulnerability Response

Recent update: 2026-06-24 — Official launch of the FedRAMP Consolidated Rules for 2026.