This week, FedRAMP published two tips about significant change requests and POA&M items:
TIP: When submitting a Significant Change Request (SCR), always discuss the change with your reviewer prior to submitting the form.
A CSP is often inclined to err on the side of caution and evaluate a change as significant when it may not be (or vice versa), and the reviewer can assist in this decision. Additionally, the reviewer will be able to assist the CSP with wording on the form, as well as the timing of when it is submitted. As an example, the reviewer may advise that a changed deemed as “significant”, requiring more extensive testing, may be done in conjunction with an upcoming Annual Assessment.
TIP: CSPs should be sure to include closure dates for Plan of Action & Milestones (POA&M) items even if they have been moved to the closed tabs.
Please be sure to include these dates boldly in the comment section. This provides a clear picture of the status of POA&M items.
More Information
Read more about this week’s FedRAMP’s Tip and cues here.
