Skip to content

Commit bedfdc2

Browse files
pete-govpete-gov
committed
Update SCN, remove SCN-TRF-OPT, clarify optional BIRs
1 parent dabcc15 commit bedfdc2

File tree

2 files changed

+58
-31
lines changed

2 files changed

+58
-31
lines changed

‎FRMR.documentation.json‎

Lines changed: 52 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
"info": {
33
"title": "FedRAMP Machine-Readable Documentation",
44
"description": "This datafile contains FedRAMP documentation for cloud service providers seeking FedRAMP Authorization. This includes definitions, requirements, recommendations, and key security indicators.",
5-
"version": "0.9.2-beta",
6-
"last_updated": "2026-02-11"
5+
"version": "0.9.3-beta",
6+
"last_updated": "2026-02-20"
77
},
88
"FRD": {
99
"info": {
@@ -3074,11 +3074,11 @@
30743074
"end_date": "2027-12-22",
30753075
"comments": [
30763076
"Rev5 Authorized providers or those seeking FedRAMP authorization MAY adopt this process in place of the traditional FedRAMP Significant Change Request process after February 27, 2026.",
3077-
"Providers MUST address all requirements and recommendations in this process prior to full adoption.",
30783077
"Rev5 Authorized Providers who switch to the Significant Change Notification process MUST notify FedRAMP via the Sign-up Form.",
3078+
"Providers MUST address all requirements and recommendations in their authorization data - either in their System Security Plan with the appropriate controls or via an addendum.",
30793079
"It is up to providers to coordinate with their active agency customers to ensure agency customers will not be negatively impacted by the provider's adoption of this process.",
3080-
"Providers seeking FedRAMP authorization who plan to follow the Significant Change Notification process must clearly note this in their authorization package",
3081-
"The FedRAMP Marketplace will include a section that indicates if a cloud service offering is following this process."
3080+
"Providers seeking FedRAMP authorization who plan to follow the Significant Change Notification process must clearly note this in their authorization package.",
3081+
"The FedRAMP Marketplace will eventually include a section that indicates if a cloud service offering is following this process."
30823082
]
30833083
},
30843084
"20x": {
@@ -3152,6 +3152,7 @@
31523152
"comment": "Moved to FRP; removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes."
31533153
}
31543154
],
3155+
"note": "The circumstances and conditions of such a Corrective Action Plan will vary and be documented in the Correcive Action Plan.",
31553156
"terms": ["Significant change"]
31563157
}
31573158
},
@@ -3186,10 +3187,15 @@
31863187
"SCN-CSO-MAR": {
31873188
"fka": "FRR-SCN-04",
31883189
"name": "Maintain Audit Records",
3189-
"statement": "Providers MUST maintain auditable records of significant change evaluation activities and make them available to all necessary parties.",
3190+
"statement": "Providers MUST maintain auditable records of the significant change evaluation activities required by SCN-CSO-EVA (Evaluate Changes) and make them available to FedRAMP.",
31903191
"affects": ["Providers"],
31913192
"primary_key_word": "MUST",
3193+
"note": "These audit records must be available to FedRAMP on request; these records do not need to be included in the authorization package by default.",
31923194
"updated": [
3195+
{
3196+
"date": "2026-02-20",
3197+
"comment": "Clarified that this applies to SCN-CSO-EVA evaluation activities."
3198+
},
31933199
{
31943200
"date": "2026-02-04",
31953201
"comment": "Clarified wording; removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes."
@@ -3221,15 +3227,20 @@
32213227
"comment": "Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes."
32223228
}
32233229
],
3230+
"note": "Structure of the information may vary depending on how the provider tracks this internally.",
32243231
"terms": ["Persistent Validation", "Significant change"]
32253232
},
32263233
"SCN-CSO-HIS": {
32273234
"fka": "FRR-SCN-05",
32283235
"name": "Historical Notifications",
3229-
"statement": "Providers MUST keep historical Significant Change Notifications available to all necessary parties at least until the service completes its next annual assessment.",
3236+
"statement": "Providers MUST keep 12 months of historical Significant Change Notifications available with their authorization data.",
32303237
"affects": ["Providers"],
32313238
"primary_key_word": "MUST",
32323239
"updated": [
3240+
{
3241+
"date": "2026-02-20",
3242+
"comment": "Updated requirement to specify 12 months of retention to showcase historical performance."
3243+
},
32333244
{
32343245
"date": "2026-02-04",
32353246
"comment": "Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes."
@@ -3240,15 +3251,20 @@
32403251
"SCN-CSO-HRM": {
32413252
"fka": "FRR-SCN-08",
32423253
"name": "Human and Machine-Readable",
3243-
"statement": "Providers MUST make ALL Significant Change Notifications and related audit records available in similar human-readable and compatible machine-readable formats.",
3254+
"statement": "Providers MUST make ALL Significant Change Notifications and related audit records available in human-readable and machine-readable formats.",
32443255
"affects": ["Providers"],
32453256
"primary_key_word": "MUST",
32463257
"updated": [
3258+
{
3259+
"date": "2026-02-20",
3260+
"comment": "Clarified wording and added note."
3261+
},
32473262
{
32483263
"date": "2026-02-04",
32493264
"comment": "Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes."
32503265
}
32513266
],
3267+
"note": "During the SCN beta, many cloud service providers met this requirement by using carefully structured and organized csv files to meet human-readable and machine-readable requirements simultaneously.",
32523268
"terms": ["Machine-Readable", "Significant change"]
32533269
},
32543270
"SCN-CSO-ARI": {
@@ -3258,33 +3274,50 @@
32583274
"affects": ["Providers"],
32593275
"primary_key_word": "MAY",
32603276
"updated": [
3277+
{
3278+
"date": "2026-02-20",
3279+
"comment": "Added note."
3280+
},
32613281
{
32623282
"date": "2026-02-04",
32633283
"comment": "Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes."
32643284
}
32653285
],
3286+
"note": "This allows providers to convey whatever additional information they think is relevant without worrying about negative consequences from not following an exact template.",
32663287
"terms": ["Significant change"]
32673288
},
32683289
"SCN-CSO-NOM": {
32693290
"fka": "FRR-SCN-07",
32703291
"name": "Notification Mechanisms",
3271-
"statement": "Providers MAY notify necessary parties in a variety of ways as long as the mechanism for notification is clearly documented and easily accessible.",
3292+
"statement": "Providers MAY notify necessary parties in a variety of ways as long as the mechanism for notification is clearly documented in the authorization package and easily accessible.",
32723293
"affects": ["Providers"],
32733294
"primary_key_word": "MAY",
32743295
"updated": [
3296+
{
3297+
"date": "2026-02-20",
3298+
"comment": "Clarified wording and added notes."
3299+
},
32753300
{
32763301
"date": "2026-02-04",
32773302
"comment": "Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes."
32783303
}
3304+
],
3305+
"notes": [
3306+
"The sharing mechanism should be designed based on the needs of the provider and their customers and may vary between providers.",
3307+
"The default sharing mechanism for most providers during the SCN beta was to send an email to agency customers and upload a copy of the notification to the provider's secure sharing location."
32793308
]
32803309
},
32813310
"SCN-CSO-EMG": {
32823311
"fka": "FRR-SCN-EX-02",
32833312
"name": "Emergency Changes",
3284-
"statement": "Providers MAY execute significant changes (including transformative changes) during an emergency or incident without meeting Significant Change Notification requirements in advance ONLY if absolutely necessary. In such emergencies, providers MUST follow all relevant procedures, notify all necessary parties, retroactively provide all Significant Change Notification materials, and complete appropriate assessment after the incident.",
3313+
"statement": "Providers MAY execute significant changes (including transformative changes) during an emergency or incident without meeting Significant Change Notification requirements in advance. In such emergencies, providers MUST follow all relevant procedures, notify all necessary parties, retroactively provide all Significant Change Notification materials, and complete appropriate assessment after the incident.",
32853314
"affects": ["Providers"],
32863315
"primary_key_word": "MAY",
32873316
"updated": [
3317+
{
3318+
"date": "2026-02-20",
3319+
"comment": "Clarified wording and added note."
3320+
},
32883321
{
32893322
"date": "2026-02-04",
32903323
"comment": "Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes."
@@ -3295,7 +3328,8 @@
32953328
"Incident",
32963329
"Significant change",
32973330
"Transformative"
3298-
]
3331+
],
3332+
"note": "Procedures for emergency changes should be documented in the authorization package."
32993333
}
33003334
},
33013335
"RTR": {
@@ -3399,20 +3433,6 @@
33993433
}
34003434
},
34013435
"TRF": {
3402-
"SCN-TRF-OPT": {
3403-
"fka": "FRR-SCN-TR-07",
3404-
"name": "Option to Opt Out",
3405-
"statement": "Providers MUST allow agency customers to OPT OUT of transformative changes whenever feasible.",
3406-
"affects": ["Providers"],
3407-
"primary_key_word": "MUST",
3408-
"updated": [
3409-
{
3410-
"date": "2026-02-04",
3411-
"comment": "Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes."
3412-
}
3413-
],
3414-
"terms": ["Agency", "Transformative"]
3415-
},
34163436
"SCN-TRF-NIP": {
34173437
"fka": "FRR-SCN-TR-02",
34183438
"name": "Notification of Initial Plans",
@@ -3526,12 +3546,17 @@
35263546
"timeframe_num": 30,
35273547
"primary_key_word": "MUST",
35283548
"updated": [
3549+
{
3550+
"date": "2026-02-20",
3551+
"comment": "Added note."
3552+
},
35293553
{
35303554
"date": "2026-02-04",
35313555
"comment": "Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes."
35323556
}
35333557
],
3534-
"terms": ["Transformative"]
3558+
"terms": ["Transformative"],
3559+
"note": "This requirement is focused on service documentation like user guides, information listed in the marketplace, and other such materials; it does not require updating the system security plan or authorization package."
35353560
},
35363561
"SCN-TRF-TPR": {
35373562
"fka": "FRR-SCN-TR-01",
@@ -3677,7 +3702,7 @@
36773702
"Rev5 Authorized providers MAY adopt this process beginning February 2, 2026 as part of the Open Beta.",
36783703
"Providers MUST plan to address all requirements and recommendations in this process by the end of the Open Beta on May 22, 2026.",
36793704
"It is up to providers to coordinate with their active agency customers to ensure agency customers will not be negatively impacted by the provider's participation in this beta.",
3680-
"FedRAMP recommends that participants in the Vulnerability Detection and Response beta also adopt the Authorization Data Sharing process and the Significant Change Notifications process."
3705+
"FedRAMP recommends that participants in the Vulnerability Detection and Response beta also adopt the Collaborative Continuous Monitoring process and the Significant Change Notifications process."
36813706
]
36823707
},
36833708
"20x": {

‎tools/site/content/rev5/balance/index.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,14 +19,16 @@ These policies apply directly to Rev5 cloud service offerings and are **mandator
1919

2020
These policies may be adopted by Rev5 cloud service offerings following the Rev5-specific process outlined in the policy.
2121

22-
!!! warning "Do not adopt these policies without FedRAMP review!"
23-
Providers MUST work with FedRAMP while adopting these policies, following all relevant instructions. Providers MUST NOT adopt any optional policy without a plan to address all requirements and obtain concurrence from all active agency customers.
22+
!!! warning "Optional Implementation"
23+
All requirements in optional Balance Improvement Releases **only apply to providers that are adopting the Balance Improvement Release.**
2424

25+
Providers MUST notify FedRAMP via the appropriate mechanism documented in the Balance Improvement Release **prior** to adopting optional Balance Improvement Releases.
26+
2527
### Wide Releases
2628

2729
| Process | Overall Balance Status |
2830
| -- | -- |
29-
| [Minimum Assessment Scope](minimum-assessment-scope) | Optional Wide Release begins January 12, 2026|
31+
| [Minimum Assessment Scope](minimum-assessment-scope) | Optional Wide Release began January 12, 2026|
3032
| [Significant Change Notifications](significant-change-notifications) | Optional Wide Release begins February 27, 2026 (tentative)|
3133

3234
### Betas
@@ -35,7 +37,7 @@ These policies may be adopted by Rev5 cloud service offerings following the Rev5
3537
| -- | -- |
3638
| [Authorization Data Sharing](authorization-data-sharing) | Open Beta will run from February 2 to May 22, 2026|
3739
| [Vulnerability Detection and Response](vulnerability-detection-and-response) | Open Beta will run from February 2 to May 22, 2026|
38-
| [Collaborative Continuous Monitoring](collaborative-continuous-monitoring) | Closed Beta will run from February 2 to May 22, 2026|
40+
| [Collaborative Continuous Monitoring](collaborative-continuous-monitoring) | Open Beta will run from February 2 to May 22, 2026|
3941

4042
---
4143

0 commit comments

Comments
 (0)