FedRAMP Rev 5 C.7: C.7 Significant changes: types and process

A significant change is one likely to substantively affect the security or privacy posture; FedRAMP defines routine recurring changes (regular operational and vulnerability management activity such as capacity changes, firewall rule updates, token refreshes and routine patching that needs no AO approval), transformative changes (rare changes altering the risk profile or customer responsibilities, such as replacing a critical third-party service, raising the categorization, replacing management planes or orchestration paradigms, data center migrations of federal data or adding AI capabilities that handle federal data differently) and adaptive changes (frequent iterative changes needing some planning and post-implementation verification, such as updates with breaking changes, larger feature increments, like-for-like cryptographic module swaps, component replacements needing plan adjustments or adding models to approved AI services), the latter two requiring review and approval. The process: the provider meets the AO with a security impact analysis (CM-4); if transformative or adaptive the provider documents a significant change request holding at least the FedRAMP ID, assessor name, related POA&M, change type and rationale, description, reason, customer impact including configuration responsibilities, plan and timeline for verification and assessment, the impact analysis and the approving system owner; the assessor reviews it and develops a SAP; the SCR and SAP go to the AO for approval; the provider implements; the assessor tests, produces a SAR package and briefs; the AO accepts or requires remediation or rollback; the provider updates the POA&M with conditions and all documentation by the next annual assessment. An assessor attestation may replace the SAP and SAR for small adaptive changes with AO agreement, changes may be scheduled with the annual assessment under one SAP and SAR, and control assessment results from an approved out-of-cycle change may be reused in the annual assessment when the change fell in the period, was AO-approved and was not documented by attestation.