+SCN-RTR Routine Recurring Changes
---+SCN-RTR-NNR No Notification Requirements

SCN-RTR Routine Recurring Changes

These rules apply to all routine recurring significant changes.

  • Types: 20x, Rev5
  • Paths: Program, Agency
  • Classes: B, C, D
  • Affects: Providers

1. Overzicht

SCN-RTR-NNR No Notification Requirements

Providers SHOULD NOT make formal Significant Change Notifications for routine recurring changes; this type of change is exempted from notification requirements.

Notes

Activities that match the routine recurring significant change type are performed regularly and routinely by cloud service providers to address flaws or vulnerabilities, address incidents, and generally perform the typical maintenance and service delivery changes expected during day-to-day operations.

These changes leverage mature processes and capabilities to identify, mitigate, and remediate risks as part of the change. They are often entirely automated and may occur without human intervention, even though they have an impact on security of the service.

If the activity does not occur regularly and routinely then it cannot be a significant change of this type (e.g., replacing all physical firewalls to remediate a vulnerability is obviously not regular or routine).

Examples

Tips on ongoing operations

Key tests:

  • Routine care and feeding by staff during normal duties
  • No major impact to service availability
  • Does not require executive approval
  • Provisioning or deprovisioning capacity to support service elasticity
  • Changing or tuning performance configurations for instances or services
  • Updating and maintaining operational handling of information flows and protection across physical and logical networks (e.g., updating firewall rules)
  • Generating or refreshing API or access tokens

Tips on vulnerability management

Key tests:

  • Minor, incremental patching or updates
  • Significant refactoring or migration process NOT required
  • No breaking changes
  • Updating security service or endpoint signatures
  • Routine patching of devices, operating systems, software or libraries
  • Updating and deploying code that applies normal fixes and improvements as part of a regular development cycle
  • Vulnerability remediation activity that simply replaces a known-bad component(s) with a better version of the exact same thing, running in the exact same way with no changes to processes

Defined terms: Incident, Regularly, Routine Recurring Change, Significant Change, Vulnerability

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde regelingen

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde regelingen

Regelingen
  • FedRAMP Consolidated Rules -

    EN: FedRAMP® Consolidated Rules of the Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, from their machine-readable version (FedRAMP/rules). Works of the U.S. Government are not subject to copyright protection in the United States (17 U.S.C. § 105; GSA website policies); GSA dedicated its machine-readable FedRAMP content to the public domain worldwide (CC0 1.0). FedRAMP® is a registered trademark of GSA; GRCA is not affiliated with, nor endorsed by, GSA or FedRAMP. Divided into sections and converted into the GRCA format, the wording unchanged, linked to the NIST SP 800-53 controls they name. Only the version published by FedRAMP is authoritative.

    DE: FedRAMP® Consolidated Rules des Federal Risk and Authorization Management Program, U.S. General Services Administration (GSA), https://www.fedramp.gov/, aus ihrer maschinenlesbaren Fassung (FedRAMP/rules). Werke der US-Regierung sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105; Website-Richtlinien der GSA); die GSA hat ihre maschinenlesbaren FedRAMP-Inhalte weltweit gemeinfrei gestellt (CC0 1.0). FedRAMP® ist eine eingetragene Marke der GSA; GRCA steht in keiner Verbindung zur GSA oder zu FedRAMP und wird von ihnen nicht unterstützt. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert, mit den genannten Controls aus NIST SP 800-53 verknüpft. Maßgeblich ist allein die von FedRAMP veröffentlichte Fassung.