Halfway through an r2 assessment, management asks to add six implemented systems to the scope...

If management decides to add new systems mid-assessment, the assessor must ensure the assessment scope and related requirement statements reflect the change. In MyCSF, this means two actions: first,reverting all completed Requirement Statementsso that the client can review and adjust responses for any new control impacts. Second, the assessor mustupdate the “Scope of the Assessment” tabto include the new systems. This ensures that MyCSF recalculates applicable requirements based on the expanded scope. Removing authoritative sources or requesting a Bridge Certificate would not address this situation, as authoritative sources are regulatory mappings and bridge certificates are only used to extend certifications temporarily.