Skip to main content
WhyHow It WorksFeaturesPricingBlog
Sign inRequest demo
SCN-RTR-NNRSHOULD NOTAll frameworksImplementation guide coming soon

No Notification Requirements

Significant Change Notifications (SCN) · Routine Recurring Changes

Applies to: Providers
Who this applies to
Providers
Service class
All service classes
Force
SHOULD NOT
Timeframe
No fixed timeframe

Reviewed implementation guidance for SCN-RTR-NNR is not published yet. The official source below remains complete and authoritative.

Examples

Tips on ongoing operations

  • Routine care and feeding by staff during normal duties
  • No major impact to service availability
  • Does not require executive approval

Tips on vulnerability management

  • Minor, incremental patching or updates
  • Significant refactoring or migration process NOT required
  • No breaking changes

Official FedRAMP source

Verbatim from FedRAMP/rules

Providers SHOULD NOT make formal Significant Change Notifications for routine recurring changes; this type of change is exempted from notification requirements.

Defined terms in this requirement

IncidentProviderRegularlyRoutine Recurring ChangeSignificant ChangeVulnerability

Notes

  • Activities that match the routine recurring significant change type are performed regularly and routinely by cloud service providers to address flaws or vulnerabilities, address incidents, and generally perform the typical maintenance and service delivery changes expected during day-to-day operations.
  • These changes leverage mature processes and capabilities to identify, mitigate, and remediate risks as part of the change. They are often entirely automated and may occur without human intervention, even though they have an impact on security of the service.
  • If the activity does not occur regularly and routinely then it cannot be a significant change of this type (e.g., replacing all physical firewalls to remediate a vulnerability is obviously not regular or routine).

Change history

  • 2026-05-04Initial reset for the Consolidated Rules for 2026 Public Preview.

Content provenance

Official requirement text is sourced from FedRAMP/rules . Boundera implementation guidance has not been fully reviewed for this item.