Halfway through an r2 assessment, management asks to add six implemented systems to the scope...

If management decides to add new systems mid-assessment, the assessor must ensure the assessment scope and related requirement statements reflect the change. In MyCSF, this means two actions: first, reverting all completed Requirement Statements so that the client can review and adjust responses for any new control impacts. Second, the assessor must update the “Scope of the Assessment” tab to include the new systems. This ensures that MyCSF recalculates applicable requirements based on the expanded scope. Removing authoritative sources or requesting a Bridge Certificate would not address this situation, as authoritative sources are regulatory mappings and bridge certificates are only used to extend certifications temporarily.