SCN-ADP Adaptive Changes

Providers MUST notify all necessary parties within 10 business days after finishing adaptive changes, also including the following information:

• Summary of any new risks identified and/or vulnerabilities resulting from the change (if applicable)

Notes

Activities that match the adaptive significant change type are a frequent and normal part of iteratively improving a service by deploying new functionality or modifying existing functionality in a way that is typically transparent to customers and does not introduce significant new security risks.

In general, most changes that do not happen regularly will be adaptive changes. This change type deliberately covers a wide range of activities in a way that requires assessment and consideration.

Timeframe: 10 business days

Examples

Tips on adaptive changes

Key tests:

• Requires minimal changes to security plans or procedures
• Requires some careful planning and project management to implement, but does not rise to the level of planning required for transformative changes
• Requires verification of existing functionality and secure configuration after implementation

• Updates to operating systems, containers, virtual machines, software or libraries with known breaking changes, complex steps, or service disruption
• Deploying larger than normal incremental feature improvements in code or libraries that are the work of multiple weeks of development efforts but are not considered a major new service
• Changing cryptographic modules where the new module meets the same standards and characteristics of the former
• Replacing a like-for-like component where some security plan or procedure adjustments are required (e.g., scanning tool or managed database swap)
• Adding models to existing approved AI services without exposing federal customer data to new services

Notification

• All Necessary Parties via update – FedRAMP Certification Data

Artifacts

• At least the most recent SCN notification including the date it was sent and the date the change was applied. Additional examples may be provided. If no SCN notifications have been sent then this artifact is not required.

Defined terms: Adaptive Change, All Necessary Parties, Regularly, Significant Change, Vulnerability