SCN-CSO General Provider Responsibilities

Providers MUST evaluate all potential significant changes to determine the type of significant change and follow the appropriate Significant Change Notification rules.

• Is it a significant change? --> Continue evaluation and follow the Significant Change Notification rules.
• If it is, is it an FedRAMP Certification class change? --> This requires a new assessment and cannot be done under the Significant Change Notification rules.
• If it is not, is it a routine recurring change? --> Follow the Routine Recurring Change rules (SCN-RTR Routine Recurring Changes).
• If it is not, is it a transformative change? --> Follow the Transformative Change rules (SCN-TRF Transformative Changes).
• If it is not, then it is an adaptive change --> Follow the Adaptive Change rules (SCN-ADP Adaptive Changes).

Artifacts

• Evidence of significant change evaluation including a description fo the change, the determined type, and an explanation for the decision. At least one example must be provided for each type of change. Real examples are prefered but the provider may use fictitious examples as long as the example provides evidence of the decision making process.

Schema: FedRAMP Significant Change Notification (SCN-CSO-INF)

NIST SP 800-53 Rev. 5 controls: CM-4

Defined terms: Adaptive Change, Certification Class, Certification Class Change, Routine Recurring Change, Significant Change, Transformative Change

Providers MUST maintain auditable records of the significant change evaluation activities required by SCN-CSO-EVA (Evaluate Changes) and make them available to FedRAMP as requested.

Note

These audit records must be available to FedRAMP on request; these records do not need to be included in the FedRAMP Certification Package by default and do not need to be emailed to FedRAMP continuously.

Artifacts

• Explanation of how FedRAMP can obtain this information.

Related rules: SCN-CSO-EVA

Defined terms: Certification Package, Significant Change

Providers MUST include at least the following information in Significant Change Notifications:

• Service Offering FedRAMP ID
• Assessor Name (if applicable)
• Related Vulnerability (if applicable)
• Significant Change type and explanation of categorization
• Short description of change
• Reason for change
• Summary of customer impact, including changes to services and customer configuration responsibilities
• Plan and timeline for the change, including for the verification, assessment, and/or validation of impacted Key Security Indicators or Rev5 Controls
• Copy of the business or security impact analysis
• Name and title of approver

Note

Structure of the information may vary depending on how the provider tracks this internally.

Artifacts

• A recent Significant Change Notification or sample Significant Change Notification

Schema: FedRAMP Significant Change Notification (SCN-CSO-INF)

Defined terms: Significant Change, Validation, Verification, Vulnerability

Providers MUST keep 12 months of historical Significant Change Notifications available with their FedRAMP Certification Data.

Artifacts

• Explanation of how FedRAMP can obtain this information.

Defined terms: Certification Data, Significant Change

Providers MUST make ALL Significant Change Notifications and related audit records available in human-readable and JSON formats.

Artifacts

• URL or explanation of how to request these materials.
• Explanation of how the provider decides whether or not to share these materials or other related policies.

Schema: FedRAMP Significant Change Notifications Schema

Defined terms: Significant Change

Providers MAY include additional relevant information in Significant Change Notifications.

Note

This allows providers to convey whatever additional information they think is relevant without worrying about negative consequences from not following an exact template.

Defined terms: Significant Change

Providers MAY notify necessary parties in a variety of ways as long as the mechanism for notification is clearly documented in the FedRAMP Certification Package and easily accessible.

Notes

The sharing mechanism should be designed based on the needs of the provider and their customers and may vary between providers.

The default sharing mechanism for most providers during the SCN beta was to send an email to agency customers and upload a copy of the notification to the provider's secure sharing location.

Artifacts

• Current list of available notification mechanisms

Defined terms: Certification Package

Providers MAY execute significant changes (including transformative changes) during an emergency or incident without following the Significant Change Notification rules in advance. In such emergencies, providers MUST follow all relevant procedures, notify all necessary parties, retroactively provide all Significant Change Notification materials, and complete appropriate assessment after the incident.

Note

Procedures for emergency changes should be documented in the FedRAMP Certification Package.

NIST SP 800-53 Rev. 5 controls: IR-4(2)

Defined terms: All Necessary Parties, Certification Package, Incident, Significant Change, Transformative Change