2026/providers/rev5/rules/significant-change-notification/

[giscus[bot]]

2026/providers/rev5/rules/significant-change-notification/

This site contains FedRAMP's Consolidated Rules for 2026.

https://www.fedramp.gov/2026/providers/rev5/rules/significant-change-notification/

[DB-360]

Hi FedRAMP team! It's not clear to me what the role of an independent assessor is for transformative changes. It looks like it may be situational and up to the provider to determine since SCN-TRF-TPR is a "should" rule. I also see that a security assessment report is needed (if applicable) per rule SCN-TRF-NAV. What would need to go into this report and is this generated by the provider or independent assessor? I would think some form of verification/validation of the impacted KSIs (if 20x) or controls (if rev 5).

[pete-gov]

It looks like it may be situational and up to the provider to determine since SCN-TRF-TPR is a "should" rule.

That's correct.

Transformative changes can vary wildly in how they actually impact security and risk. A modern service with independent assessed and certified automation systems may be able to make transformative changes without any need for independent assessment.

For example, let's say a cloud service operates 3 physical datacenters and has a complex automated control plane to enforce physical and environmental controls across those facilities. The automated control plane has already already been assessed and certified and its operation enforces all applicable controls. If a 4th datacenter is added, that is most likely a transformative change - but if the same automated control plane is extended to that facility and the cloud service provider determines there is no additional risk introduced because it has been proven to work across the first 3 facilities, then independent assessment of that significant change is likely unnecessary.

On the other hand, in that same situation with 3 physical datacenters without an automated control plane, where everything is done by hand managing things like physical thermostats and site-specific access control methods, then adding a 4th datacenter would absolutely require an independent assessment because it's all new control implementations in an all new environment with no proven way to verify them.

What would need to go into this report and is this generated by the provider or independent assessor? I would think some form of verification/validation of the impacted KSIs (if 20x) or controls (if rev 5)

It depends entirely on the situation and is up to the provider to determine. The important thing is to ensure that appropriate verifications and validations remain accurate and in place.

In the first example introduced above, the provider might engage an independent assessor to verify that the automated control plane is properly in place and configured out of an abundance of caution. The security assessment report would reflect that.

In the second example above, the provider might engage an independent assessor to review every single physical setting in that facility, and the security assessment report would reflect that or whatever other aspects that the provider determined needed to be reviewed.

[williamaolson-dev]

We are a Cloud Service Provider who has a system that is Authorized to Operate by DISA on the DISN Secure Cloud at an Impact Level (IL) 4. The system has just completed a second Full Assessment after making major architectural improvements and has been certified by a 3PAO that the system still meets the requirements. We would like to have this system listed in the FedRAMP Marketplace utilizing the FedRAMP 20x methodology. Do we still need a Government sponsor to request our system be listed in the Marketplace or can we get we make the request ourselves? We would like to reach FedRAMP Certification Class C.

[pete-gov]

You will need to meet all FedRAMP 20x requirements to obtain a FedRAMP 20x Class C Certification. That will require a very different package from your DISA IL4 package.

If you want to earn a FedRAMP Rev5 Class C Certification, which is very similar to DISA IL4, then DISA may be willing to sponsor you for a FedRAMP Rev5 Class C at the same time as an agency sponsor.

[r-kanm]

Hi FedRAMP team. We currently wrapped up an Annual FedRAMP assessment for our CSO and are about to pursue a FedRAMP Certification class change from legacy 'Moderate' to Class D. We need help with the following;

1. With this change being considered to "require a new assessment and cannot be done under the Significant Change Notification rules." Do we need a new marketplace listing or request update to our existing 'Moderate' listing?
2. We currently anticipate submitting our Class D Certification Data i.e., SAR, SDR and CPO etc. to the Sponsoring Agency by May 30th, 2027. If there's slippage on that date, should we be worried about the June 11, 202 | No new applications for FedRAMP Rev5 Certification will be accepted. deadline notice?

Any advice on interpretation and how we could potentially proceed?

[r-kanm]

thank you for the prompt response.

[r-kanm]

Hi Pete and team, a few follow-ups to get clarity on point #1.

Would this new CR26 Rev5 Class D Certification (CR26 Class D Cert.) package application lead to a net new FR# or would the FR# used to identify the previously certified Class C CSO (formerly Moderate Authorized CSO) be reused, especially if the Class Upgrade is for the "same" CSO (not a separately deployed system/offering)?

(This has implications to what is expected to be stated in the new Class D CPO under the required serviceIdentification.fedRampPackageIdproperty.)

Related, please confirm or correct that the MKT JSON, etc. can re-use the existing FR# (Package ID) when that is the "same" CSO.

Additionally, on the subject of scoping the C/CE applicabilty and expectations for this new CR26 Class D Cert. package application, please confirm or correct that, unlike the old SCR process (where a Mod->High SCR may have just covered a delta for the ~87 C/CEs under what is now the Class D Baseline (FRC-CSF-BSL)), a Class C -> Class D Upgrade under CR26 (and as implied by the new SCN process--"new assessment") would require a "fresh initial FedRAMP independent assessment" (under FRC-APP-FIA).

[pete-gov]

Would this new CR26 Rev5 Class D Certification (CR26 Class D Cert.) package application lead to a net new FR# or would the FR# used to identify the previously certified Class C CSO (formerly Moderate Authorized CSO) be reused, especially if the Class Upgrade is for the "same" CSO (not a separately deployed system/offering)?

In most cases we reuse the FRID, but there's been some talk about assigning a temporary one during the recertification. The package ID property in the CPO is really not something to be too worried about though, we'll make sure you know what it should be.

Additionally, on the subject of scoping the C/CE applicabilty and expectations for this new CR26 Class D Cert. package application, please confirm or correct that, unlike the old SCR process (where a Mod->High SCR may have just covered a delta for the ~87 C/CEs under what is now the Class D Baseline (FRC-CSF-BSL)), a Class C -> Class D Upgrade under CR26 (and as implied by the new SCN process--"new assessment") would require a "fresh initial FedRAMP independent assessment" (under FRC-APP-FIA).

Yes - though in the case where you are building from a previous assessment, the "fresh" assessment is likely to simply do a lot of confirmation that things haven't changed since the last assessment so that previous assessment can carry forward/etc. Everyone just needs to confirm that the entire package is still accurate. It does not mean you have to act like you've never been assessed before.

[tnnrjmsn-eit]

Please confirm or correct that the Obtain dates apply in this scenario.

My logic (and more or less corroborated by my PDA, Claude Sonnet 5.5 Extra):
FRC-CCL-UCC states "Providers MUST apply for a new FedRAMP Certification to upgrade their Certification Class; all applicable requirements MUST be met in advance." and FRC-APP-FIA, Class D calls for a "fresh initial FedRAMP independent assessment" [emphasis added].

In other words, this is the CSP opting into CR26 Class D as opposed to the Maintain deadlines their Class C is already subject to.

[pete-gov]

In other words, this is the CSP opting into CR26 Class D as opposed to the Maintain deadlines their Class C is already subject to.

Yes. To go from Class C to Class D requires implementing all the rules at the Obtain deadline, not the Maintain deadline. After January 1, 2027, this means you need to meet all CR26 requirements to "uplift" under Rev5, no grace period.

I will add a note to FRC-CCL-UCC to make this explicitly clear.