The cloud service provider MUST inform cloud service customers 90 days in advance of any actual changes affecting the cloud service provider's control that could undermine or affect the C3A controls associated with the cloud service, including significant changes to ownership, shareholding, or governance relationships of the cloud service provider.