Anyone have some plain language guidance for engineers who aren’t FedRAMP savvy? There is a lot of ambiguity when you try to apply their scr guidance on more granular things. Would additional on prem software - say a text editor on a vm inside the boundary constitute a sig change and if not when does it cross the line to sig?