Skip to main content
WhyHow It WorksFeaturesPricingBlog
Sign inRequest demo
SCN-CSO-MARMUSTAll frameworksImplementation guide coming soon

Maintain Audit Records

Significant Change Notifications (SCN) · General Provider Responsibilities

Applies to: Providers
Who this applies to
Providers
Service class
All service classes
Force
MUST
Timeframe
No fixed timeframe

Reviewed implementation guidance for SCN-CSO-MAR is not published yet. The official source below remains complete and authoritative.

Official FedRAMP source

Verbatim from FedRAMP/rules

Providers MUST maintain auditable records of the significant change evaluation activities required by SCN-CSO-EVA (Evaluate Changes) and make them available to FedRAMP.

Defined terms in this requirement

Certification PackageProviderSignificant Change

Notes

  • These audit records must be available to FedRAMP on request; these records do not need to be included in the FedRAMP Certification package by default.

Change history

  • 2026-05-04Initial reset for the Consolidated Rules for 2026 Public Preview.

Content provenance

Official requirement text is sourced from FedRAMP/rules . Boundera implementation guidance has not been fully reviewed for this item.