Significant Change Request

No. An SCR is a mechanism within continuous monitoring to formally evaluate and, where warranted, approve a change to an authorized system; it does not automatically revoke the existing ATO. However, it is a mistake to treat an ATO as static or permanent. An ATO is time-bound and conditioned on the system remaining within its authorized configuration and risk posture. A significant change can alter that risk posture, and the authorizing official (AO) may require reassessment of affected controls before the change is accepted. In some cases the AO may determine the change is significant enough to warrant a reauthorization decision. The precise triggers and outcomes depend on agency-specific continuous monitoring policy and the AO's risk determination, which you should confirm against your program's governing documentation.

It is a common error to equate completing the SCR process with achieving security, or to assume the request itself is a formality. An SCR generally initiates an evaluation of how a proposed change affects the system's security posture, and where the change touches assessable controls, it typically drives a targeted assessment of the affected controls rather than a full system reassessment. Assessment and authorization are distinct activities: the assessment produces evidence about control effectiveness, while the authorizing official makes the risk-based decision to accept the change. The documentation is the record of that process, not a substitute for the underlying analysis and, where applicable, testing. Scope and rigor vary by the significance of the change and by agency tailoring.

Determinations are made case by case and against agency-specific criteria, so this description is illustrative rather than definitive. In most implementations, changes that could materially alter the system's risk posture, security boundary, or the effectiveness of implemented controls are candidates for an SCR. Examples often cited include changes to the authorization boundary, introduction of new components or services, changes affecting how Controlled Unclassified Information or other protected data is handled, or modifications that affect an assessed control. Routine patching within an established configuration management process is frequently handled through standard change control rather than an SCR. Because the threshold for 'significant' is defined by your continuous monitoring strategy and AO expectations, confirm the criteria in your applicable policy.

Roles are assigned by your organization's governance model, but generally the system owner or information system security manager (ISSM), in coordination with the ISSO where that role exists, identifies a candidate significant change and initiates the request. The request is typically evaluated with input from the security assessment function, and the authorizing official, or an AO-designated representative, makes the risk-based decision to approve, approve with conditions, or reject the change. The specific approval authority, delegation rules, and required concurrences differ across federal civilian, DoD, and national security system environments, and may be further tailored by the agency. Verify the assigned responsibilities in your program's roles-and-responsibilities documentation.

As a general practice, an SCR and its disposition are recorded so that the authorization package reflects the system's current, approved state. This commonly means updating affected artifacts such as the system security plan, the security assessment report where affected controls were reassessed, and the plan of action and milestones if the change introduces or resolves findings. The goal is to maintain an accurate, current record supporting the ongoing authorization decision under continuous monitoring. Exact documentation formats, retention requirements, and package components vary by agency and by the tooling or governance process in use, so align your documentation to the applicable authoritative guidance and internal procedures.

An SCR is generally one input to a continuous monitoring program rather than a separate lifecycle. Continuous monitoring is the ongoing activity that keeps the authorizing official informed of the system's security state; an SCR is the structured way significant changes enter that process for evaluation. Depending on the AO's risk determination, an approved change may be accepted within the existing authorization, may require targeted reassessment of affected controls, or may rise to the level of prompting a reauthorization decision. Because an authorization is time-bound and risk-based, an accumulation of changes, even individually minor ones, can also factor into when reauthorization is warranted. The specific relationship between SCRs, monitoring frequency, and reauthorization triggers is governed by your continuous monitoring strategy and applicable agency policy, which should be verified against current official sources.