+SCN-CSO-INF Required Information

SCN-CSO-INF Required Information

Providers MUST include at least the following information in Significant Change Notifications:

  • Service Offering FedRAMP ID
  • Assessor Name (if applicable)
  • Related Vulnerability (if applicable)
  • Significant Change type and explanation of categorization
  • Short description of change
  • Reason for change
  • Summary of customer impact, including changes to services and customer configuration responsibilities
  • Plan and timeline for the change, including for the verification, assessment, and/or validation of impacted Key Security Indicators or Rev5 Controls
  • Copy of the business or security impact analysis
  • Name and title of approver

Note

Structure of the information may vary depending on how the provider tracks this internally.

Artifacts

  • A recent Significant Change Notification or sample Significant Change Notification

Schema: FedRAMP Significant Change Notification (SCN-CSO-INF)

Defined terms: Significant Change, Validation, Verification, Vulnerability

1. Áttekintés

1.1 Hivatkozások

1.2 Azonosított követelmények

1.3 Kapcsolódó szabályozások

2. Azonosított követelmények

Követelmények

3. Kapcsolódó szabályozások

Szabályozások
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.