SCN-TRF Transformative Changes

Providers MUST notify all necessary parties of initial plans for transformative changes at least 30 business days before starting transformative changes, including a summary of any likely security impacts or changes in risk.

Timeframe: 30 business days

Notification

• All Necessary Parties via update – FedRAMP Certification Data

Artifacts

• At least the most recent initial SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required.

Defined terms: All Necessary Parties, Likely, Transformative Change

Providers MUST notify all necessary parties of final plans for transformative changes at least 10 business days before starting transformative changes, including updates to all previously sent information.

Timeframe: 10 business days

Notification

• All Necessary Parties via update – FedRAMP Certification Data

Artifacts

• At least the most recent final SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required.

Defined terms: All Necessary Parties, Transformative Change

Providers MUST notify all necessary parties within 5 business days after finishing transformative changes, including updates to all previously sent information.

Timeframe: 5 business days

Notification

• All Necessary Parties via update – FedRAMP Certification Data

Artifacts

• At least the most recent post deployment SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required.

Defined terms: All Necessary Parties, Transformative Change

Providers MUST notify all necessary parties within 5 business days after completing the verification, assessment, and/or validation of transformative changes, also including the following information:

• Updates to all previously sent information
• Summary of any new risks identified and/or vulnerabilities resulting from the change (if applicable)
• Copy of the security assessment report (if applicable)

Timeframe: 5 business days

Notification

• All Necessary Parties via update – FedRAMP Certification Data

Artifacts

• At least the most recent after verification SCN notification for a transformative change including the date it was sent and the date the change was applied. Additional examples may be provided. If no transformative SCN notifications have been sent then this artifact is not required.

Defined terms: All Necessary Parties, Transformative Change, Validation, Verification, Vulnerability

Providers MUST publish updated service documentation and other materials to reflect transformative changes within 30 business days after finishing transformative changes.

Note

This requirement is focused on service documentation like user guides, information listed in the marketplace, and other such materials; it does not require updating the system security plan or FedRAMP Certification Package.

Timeframe: 30 business days

Artifacts

• Date of the most recent transformative change and the date of the corresponding documentation update. If no documentation updates were required as the result of this change, explain how this was determined.

Defined terms: Certification Package, Transformative Change

Providers SHOULD engage a third-party assessor to review the scope and impact of the planned change before starting transformative changes if human validation is necessary; such reviews SHOULD be limited to security decisions that require human validation.

Note

Activities that match the transformative significant change type are rare for a cloud service offering, adjusted for the size, scale, and complexity of the service. Small cloud service offerings may go years without transformative changes, while hyperscale providers may release multiple transformative changes per year.

Examples

Tips on transformative changes

Key tests:

• Alters the service risk profile or require new or significantly different actions to address customer responsibilities
• Requires significant new design, development and testing with discrete associated project planning, budget, marketing, etc.
• Requires extensive updates to security assessments, documentation, and how a large number of security requirements are met and validated

• The addition, removal, or replacement of a critical third party service that handles a significant portion of information (e.g., IaaS change)
• Increasing the security categorization of a service within the offering that actively handles federal customer data (does NOT include impact change of entire offering - see FedRAMP Certification class change)
• Replacement of underlying management planes or paradigm shift in workload orchestration (e.g., bare-metal servers or virtual machines to containers, migration to kubernetes)
• Datacenter migration where large amounts of federal customer data is moved across boundaries different from normal day-to-day operations
• Adding a new AI-based capability that impacts federal customer data in a different way than existing services or capabilities (such as integrating a new third-party service or training on federal customer data)

Artifacts

• Third Party assesment report OR explanation why a third party assessor was not engaged

Defined terms: Cloud Service Offering, Significant Change, Transformative Change, Validation