Significant Change Notification

FedRAMP MAY require providers to delay significant changes beyond the standard Significant Change Notification period and/or submit significant changes for approval in advance as a condition of a formal FedRAMP Corrective Action Plan or other agreement.

Providers MAY include additional relevant information in Significant Change Notifications.

Providers MAY execute significant changes (including transformative changes) during an emergency or incident without following the Significant Change Notification rules in advance. In such emergencies, providers MUST follow all relevant procedures, notify all necessary parties, retroactively provide all Significant Change Notification materials, and complete appropriate assessment after the incident.

Providers MUST evaluate all potential significant changes to determine the type of significant change and follow the appropriate Significant Change Notification rules.

• Is it a significant change? --> Continue evaluation and follow the Significant Change Notification rules.
• If it is, is it an FedRAMP Certification class change? --> This requires a new assessment and cannot be done under the Significant Change Notification rules.
• If it is not, is it a routine recurring change? --> Follow the Routine Recurring Change rules (SCN-RTR Routine Recurring Changes).
• If it is not, is it a transformative change? --> Follow the Transformative Change rules (SCN-TRF Transformative Changes).
• If it is not, then it is an adaptive change --> Follow the Adaptive Change rules (SCN-ADP Adaptive Changes).

Providers MUST keep 12 months of historical Significant Change Notifications available with their FedRAMP Certification Data.

Providers MUST make ALL Significant Change Notifications and related audit records available in human-readable and JSON formats.

Providers MUST include at least the following information in Significant Change Notifications:

• Service Offering FedRAMP ID
• Assessor Name (if applicable)
• Related Vulnerability (if applicable)
• Significant Change type and explanation of categorization
• Short description of change
• Reason for change
• Summary of customer impact, including changes to services and customer configuration responsibilities
• Plan and timeline for the change, including for the verification, assessment, and/or validation of impacted Key Security Indicators or Rev5 Controls
• Copy of the business or security impact analysis
• Name and title of approver

Providers MUST maintain auditable records of the significant change evaluation activities required by SCN-CSO-EVA (Evaluate Changes) and make them available to FedRAMP as requested.

Providers MAY notify necessary parties in a variety of ways as long as the mechanism for notification is clearly documented in the FedRAMP Certification Package and easily accessible.

Providers MUST notify all necessary parties within 10 business days after finishing adaptive changes, also including the following information:

• Summary of any new risks identified and/or vulnerabilities resulting from the change (if applicable)

Providers SHOULD NOT make formal Significant Change Notifications for routine recurring changes; this type of change is exempted from notification requirements.

Providers MUST notify all necessary parties within 5 business days after finishing transformative changes, including updates to all previously sent information.

Providers MUST notify all necessary parties within 5 business days after completing the verification, assessment, and/or validation of transformative changes, also including the following information:

• Updates to all previously sent information
• Summary of any new risks identified and/or vulnerabilities resulting from the change (if applicable)
• Copy of the security assessment report (if applicable)

Providers MUST notify all necessary parties of final plans for transformative changes at least 10 business days before starting transformative changes, including updates to all previously sent information.

Providers MUST notify all necessary parties of initial plans for transformative changes at least 30 business days before starting transformative changes, including a summary of any likely security impacts or changes in risk.

Providers SHOULD engage a third-party assessor to review the scope and impact of the planned change before starting transformative changes if human validation is necessary; such reviews SHOULD be limited to security decisions that require human validation.

Providers MUST publish updated service documentation and other materials to reflect transformative changes within 30 business days after finishing transformative changes.