Forty-Five Days' Notice

It is significant. The determination is driven by the effect on the security posture and on the controls the authorization relies on - not by the change's label, its origin (vendor-initiated), or the absence of application code changes.

Two independent threads, each significant on its own:

Data location. The SSP names the region. A move changes data residency commitments, the legal exposure of the data, the key-management arrangement (provider-managed keys in a new region are a different control instance), and the accuracy of the boundary description itself.

Identity provider replacement. Authentication is the gate for 3,100 external users. The identification and authentication controls, account management, session handling, and the trust relationship all change implementation. Logging from a new IdP must be onboarded to monitoring, or audit evidence silently stops.

Marking it 'routine' means no security impact analysis is performed and the authorization statement goes stale. The change record is the artifact that proves the organization detected and evaluated the change; without it, the agency cannot show it was in control.

Before cutover:

• Security impact analysis recorded in the change record, covering both threads and the affected controls.
• Re-assessment of the controls touched: identification and authentication, account management, session and encryption in transit, audit logging, and cryptographic protection at rest in the new region.
• Updated SSP, boundary diagram, and data-flow diagram - drafted before cutover, not after, so the authorization reflects what is actually deployed.
• Confirmation that the new region satisfies residency and legal requirements, and that the provider's attestation covers the new service and location.
• Pilot authentication with a small caseworker cohort in a non-production tenant, including a rollback plan.
• Updated risk register and POA&M entries, and a request to the authorizing official for a decision on whether reauthorization or an amended authorization is required.

If the window is too tight: the answer is to renegotiate the cutover date with the provider, not to compress the analysis. Proceeding and documenting later means operating a system whose authorization no longer describes it. That is the condition that makes a finding inevitable at the next review, and it is unrecoverable if a breach occurs in the gap.

The evidence should let a reviewer confirm both that the change happened as described and that the relied-upon controls still operate:

• Authentication logging from the new identity provider flowing into the central monitoring platform, with a sample alert and its resolution - this proves the logging integration, not just the configuration.
• MFA and access enforcement reports covering the 3,100 external accounts, plus one completed access recertification cycle.
• Key management configuration for the new region, showing the encryption-at-rest arrangement and who can administer keys.
• Assessment record for the re-assessed controls, with date, assessor, and result, filed against the updated SSP.
• Change record and AO decision memo, tying the analysis, the approval, and the deployed state together.
• A dated SSP version matching the deployed architecture, which is the item most often missing.

Continuous monitoring closes the loop only if these are produced on schedule and reviewed. A monthly report nobody reads is not monitoring; the review signature is the control.