117TH CONGRESS 

1ST SESSION H. R. 21 

AN ACT 

To enhance the innovation, security, and availability of cloud 

computing products and services used in the Federal 

Government by establishing the Federal Risk and Authorization Management Program within the General 

Services Administration and by establishing a risk management, authorization, and continuous monitoring process to enable the Federal Government to leverage cloud 

computing products and services using a risk-based approach consistent with the Federal Information Security 

Modernization Act of 2014 and cloud-based operations, 

and for other purposes. 
2 

•HR 21 EH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Risk and Au5 thorization Management Program Authorization Act of 

6 2021’’ or the ‘‘FedRAMP Authorization Act’’. 

7 SEC. 2. CODIFICATION OF THE FEDRAMP PROGRAM. 

8 (a) AMENDMENT.—Chapter 36 of title 44, United 

9 States Code, is amended by adding at the end the fol10 lowing new sections: 

11 ‘‘§ 3607. Federal Risk and Authorization Management 

12 Program 

13 ‘‘(a) ESTABLISHMENT.—There is established within 

14 the General Services Administration the Federal Risk and 

15 Authorization Management Program. The Administrator 

16 of General Services, in accordance with section 3612, shall 

17 establish a governmentwide program that provides the au18 thoritative standardized approach to security assessment 

19 and authorization for cloud computing products and serv20 ices that process unclassified information used by agen21 cies. 

22 ‘‘(b) COMPONENTS OF FEDRAMP.—The Joint Au23 thorization Board and the FedRAMP Program Manage24 ment Office are established as components of FedRAMP. 
3 

•HR 21 EH

1 ‘‘§ 3608. FedRAMP Program Management Office 

2 ‘‘(a) GSA DUTIES.— 

3 ‘‘(1) ROLES AND RESPONSIBILITIES.—The Ad4 ministrator of General Services shall— 

5 ‘‘(A) determine the categories and charac6 teristics of cloud computing products and serv7 ices that are within the jurisdiction of 

8 FedRAMP and that require a FedRAMP au9 thorization or a FedRAMP provisional author10 ization; 

11 ‘‘(B) develop, coordinate, and implement a 

12 process for the FedRAMP Program Manage13 ment Office, the Joint Authorization Board, 

14 and agencies to review security assessments of 

15 cloud computing products and services pursuant 

16 to subsections (b) and (c) of section 3611, and 

17 appropriate oversight of continuous monitoring 

18 of cloud computing products and services; and 

19 ‘‘(C) ensure the continuous improvement of 

20 FedRAMP. 

21 ‘‘(2) IMPLEMENTATION.—The Administrator 

22 shall oversee the implementation of FedRAMP, in23 cluding— 

24 ‘‘(A) appointing a Program Director to 

25 oversee the FedRAMP Program Management 

26 Office; 
4 

•HR 21 EH

1 ‘‘(B) hiring professional staff as may be 

2 necessary for the effective operation of the 

3 FedRAMP Program Management Office, and 

4 such other activities as are essential to properly 

5 perform critical functions; 

6 ‘‘(C) entering into interagency agreements 

7 to detail personnel on a reimbursable or non-re8 imbursable basis to assist the FedRAMP Pro9 gram Management Office and the Joint Author10 ization Board in discharging the responsibilities 

11 of the Office under this section; and 

12 ‘‘(D) such other actions as the Adminis13 trator may determine necessary to carry out 

14 this section. 

15 ‘‘(b) DUTIES.—The FedRAMP Program Manage16 ment Office shall have the following duties: 

17 ‘‘(1) Provide guidance to independent assess18 ment organizations, validate the independent assess19 ments, and apply the requirements and guidelines 

20 adopted in section 3609(c)(5). 

21 ‘‘(2) Oversee and issue guidelines regarding the 

22 necessary requirements for accreditation of third23 party organizations seeking to be awarded accredita24 tion as independent assessment organizations, in-
5 

•HR 21 EH

1 cluding qualifications, roles, and responsibilities of 

2 independent assessment organizations. 

3 ‘‘(3) Develop templates and other materials to 

4 support the Joint Authorization Board and agencies 

5 in the authorization of cloud computing products 

6 and services to increase the speed, effectiveness, and 

7 transparency of the authorization process, consistent 

8 with standards defined by the National Institute of 

9 Standards and Technology. 

10 ‘‘(4) Establish and maintain a public comment 

11 process for proposed guidance before the issuance of 

12 such guidance by FedRAMP. 

13 ‘‘(5) Review any authorization to operate issued 

14 by an agency to determine if the authorization meets 

15 the requirements and guidelines adopted in section 

16 3609(c)(5). 

17 ‘‘(6) Establish frameworks for agencies to use 

18 authorization packages processed by the FedRAMP 

19 Program Management Office and Joint Authoriza20 tion Board. 

21 ‘‘(7) Coordinate with the Secretary of Defense 

22 and the Secretary of Homeland Security to establish 

23 a framework for continuous monitoring under sec24 tion 3553 and agency reports required under section 

25 3554. 
6 

•HR 21 EH

1 ‘‘(8) Establish a centralized and secure reposi2 tory to collect and share necessary data, including 

3 security authorization packages, from the Joint Au4 thorization Board and agencies to enable better 

5 sharing and reuse of such packages across agencies. 

6 ‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 

7 ‘‘(1) IN GENERAL.—The FedRAMP Program 

8 Management Office shall assess and evaluate avail9 able automation capabilities and procedures to im10 prove the efficiency and effectiveness of the issuance 

11 of FedRAMP authorizations and FedRAMP provi12 sional authorizations, including continuous moni13 toring of cloud computing products and services. 

14 ‘‘(2) MEANS FOR AUTOMATION.—Not later than 

15 1 year after the date of the enactment of this sec16 tion, and updated annually thereafter, the 

17 FedRAMP Program Management Office shall estab18 lish a means for the automation of security assess19 ments and reviews. 

20 ‘‘(d) METRICS FOR AUTHORIZATION.—The 

21 FedRAMP Program Management Office shall establish 

22 annual metrics regarding the time and quality of the as23 sessments necessary for completion of a FedRAMP au24 thorization process in a manner that can be consistently 

25 tracked over time in conjunction with the periodic testing 
7 

•HR 21 EH

1 and evaluation process pursuant to section 3554 in a man2 ner that minimizes the agency reporting burden. 

3 ‘‘§ 3609. Joint Authorization Board 

4 ‘‘(a) ESTABLISHMENT.—The Joint Authorization 

5 Board shall consist of cloud computing experts, appointed 

6 by the Director in consultation with the Administrator, 

7 from each of the following: 

8 ‘‘(1) The Department of Defense. 

9 ‘‘(2) The Department of Homeland Security. 

10 ‘‘(3) The General Services Administration. 

11 ‘‘(4) Such other agencies as determined by the 

12 Director, in consultation with the Administrator. 

13 ‘‘(b) ISSUANCE OF FEDRAMP PROVISIONAL AU14 THORIZATIONS.—The Joint Authorization Board shall 

15 conduct security assessments of cloud computing products 

16 and services and issue FedRAMP provisional authoriza17 tions to cloud service providers that meet the requirements 

18 and guidelines established in subsection (c)(5). 

19 ‘‘(c) DUTIES.—The Joint Authorization Board 

20 shall— 

21 ‘‘(1) develop and make publicly available on a 

22 website, determined by the Administrator, criteria 

23 for prioritizing and selecting cloud computing prod24 ucts and services to be assessed by the Joint Author25 ization Board; 
8 

•HR 21 EH

1 ‘‘(2) provide regular updates to applicant cloud 

2 service providers on the status of any cloud com3 puting product or service during the assessment and 

4 authorization process of the Joint Authorization 

5 Board; 

6 ‘‘(3) review and validate cloud computing prod7 ucts and services and materials submitted by inde8 pendent assessment organizations or any documenta9 tion determined to be necessary by the Joint Author10 ization Board to evaluate the system security of a 

11 cloud computing product or service; 

12 ‘‘(4) in consultation with the FedRAMP Pro13 gram Management Office, serve as a resource for 

14 best practices to accelerate the process for obtaining 

15 a FedRAMP authorization or FedRAMP provisional 

16 authorization; 

17 ‘‘(5) establish requirements and guidelines for 

18 security assessments of cloud computing products 

19 and services, consistent with standards defined by 

20 the National Institute of Standards and Technology, 

21 to be used by the Joint Authorization Board and 

22 agencies; 

23 ‘‘(6) perform such other roles and responsibil24 ities as the Administrator may assign, in consulta25 tion with the FedRAMP Program Management Of-
9 

•HR 21 EH

1 fice and members of the Joint Authorization Board; 

2 and 

3 ‘‘(7) establish metrics and goals for reviews and 

4 activities associated with issuing FedRAMP provi5 sional authorizations and provide to the FedRAMP 

6 Program Management Office. 

7 ‘‘(d) DETERMINATIONS OF DEMAND FOR CLOUD

8 COMPUTING PRODUCTS AND SERVICES.—The Joint Au9 thorization Board shall consult with the Chief Information 

10 Officers Council established in section 3603 to establish 

11 a process, that shall be made available on a public website, 

12 for prioritizing and accepting the cloud computing prod13 ucts and services to be granted a FedRAMP provisional 

14 authorization. 

15 ‘‘(e) DETAIL OF PERSONNEL.—To assist the Joint 

16 Authorization Board in discharging the responsibilities 

17 under this section, personnel of agencies may be detailed 

18 to the Joint Authorization Board for the performance of 

19 duties described under subsection (c). 

20 ‘‘§ 3610. Independent assessment organizations 

21 ‘‘(a) REQUIREMENTS FOR ACCREDITATION.—The 

22 Joint Authorization Board shall determine the require23 ments for the accreditation of a third-party organization 

24 seeking to be accredited as an independent assessment or25 ganization, ensuring adequate implementation of section 
10 

•HR 21 EH

1 3609. Such requirements may include developing or re2 quiring certification programs for individuals employed by 

3 the third-party organization seeking accreditation. The 

4 Program Director of the FedRAMP Program Manage5 ment Office shall accredit any third-party organization 

6 that meets the requirements for accreditation. 

7 ‘‘(b) ASSESSMENT.—An independent assessment or8 ganization may assess, validate, and attest to the quality 

9 and compliance of security assessment materials provided 

10 by cloud service providers as part of the FedRAMP au11 thorization or the FedRAMP provisional authorization 

12 process. 

13 ‘‘§ 3611. Roles and responsibilities of agencies 

14 ‘‘(a) IN GENERAL.—In implementing the require15 ments of FedRAMP, the head of each agency shall, con16 sistent with guidance issued by the Director pursuant to 

17 section 3612— 

18 ‘‘(1) create policies to ensure cloud computing 

19 products and services used by the agency meet 

20 FedRAMP security requirements and other risk21 based performance requirements as defined by the 

22 Director; 

23 ‘‘(2) issue agency-specific authorizations to op24 erate for cloud computing services in compliance 

25 with section 3554; 
11 

•HR 21 EH

1 ‘‘(3) confirm whether there is a FedRAMP au2 thorization or FedRAMP provisional authorization 

3 in the cloud security repository established under 

4 section 3608(b)(8) before beginning the process to 

5 award a FedRAMP authorization or a FedRAMP 

6 provisional authorization for a cloud computing 

7 product or service; 

8 ‘‘(4) to the extent practicable, for any cloud 

9 computing product or service the agency seeks to au10 thorize that has received a FedRAMP authorization 

11 or FedRAMP provisional authorization, use the ex12 isting assessments of security controls and materials 

13 within the authorization package; and 

14 ‘‘(5) provide data and information required to 

15 the Director pursuant to section 3612 to determine 

16 how agencies are meeting metrics as defined by the 

17 FedRAMP Program Management Office. 

18 ‘‘(b) SUBMISSION OF POLICIES REQUIRED.—Not 

19 later than 6 months after the date of the enactment of 

20 this section, the head of each agency shall submit to the 

21 Director the policies created pursuant to subsection (a)(1) 

22 for review and approval. 

23 ‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE

24 REQUIRED.—Upon issuance of an agency authorization to 

25 operate, the head of the agency shall provide a copy of 
12 

•HR 21 EH

1 the authorization to operate letter and any supplementary 

2 information required pursuant to section 3608(b) to the 

3 FedRAMP Program Management Office. 

4 ‘‘(d) PRESUMPTION OF ADEQUACY.— 

5 ‘‘(1) IN GENERAL.—The assessment of security 

6 controls and materials within the authorization 

7 package for a FedRAMP authorization or 

8 FedRAMP provisional authorization shall be pre9 sumed adequate for use in an agency authorization 

10 to operate cloud computing products and services. 

11 ‘‘(2) INFORMATION SECURITY REQUIRE12 MENTS.—The presumption under paragraph (1) 

13 does not modify or alter the responsibility of any 

14 agency to ensure compliance with subchapter II of 

15 chapter 35 for any cloud computing products or 

16 services used by the agency. 

17 ‘‘§ 3612. Roles and responsibilities of the Office of 

18 Management and Budget 

19 ‘‘The Director shall have the following duties: 

20 ‘‘(1) Issue guidance to ensure that an agency 

21 does not operate a Federal Government cloud com22 puting product or service using Government data 

23 without an authorization to operate issued by the 

24 agency that meets the requirements of subchapter II 
13 

•HR 21 EH

1 of chapter 35 and the FedRAMP authorization or 

2 FedRAMP provisional authorization. 

3 ‘‘(2) Ensure agencies are in compliance with 

4 any guidance or other requirements issued related to 

5 FedRAMP. 

6 ‘‘(3) Review, analyze, and update guidance on 

7 the adoption, security, and use of cloud computing 

8 services used by agencies. 

9 ‘‘(4) Ensure the Joint Authorization Board is 

10 in compliance with section 3609(c). 

11 ‘‘(5) Adjudicate disagreements between the 

12 Joint Authorization Board and cloud service pro13 viders seeking a FedRAMP provisional authoriza14 tion. 

15 ‘‘(6) Promulgate regulations on the role of 

16 FedRAMP authorizations and FedRAMP provisional 

17 authorizations in agency acquisition of cloud com18 puting products and services that process unclassi19 fied information. 

20 ‘‘§ 3613. Authorization of appropriations for 

21 FEDRAMP 

22 ‘‘There is authorized to be appropriated $20,000,000 

23 each year for the FedRAMP Program Management Office 

24 and the Joint Authorization Board. 
14 

•HR 21 EH

1 ‘‘§ 3614. Reports to Congress; GAO Report 

2 ‘‘(a) REPORTS TO CONGRESS.—Not later than 12 

3 months after the date of the enactment of this section, 

4 and annually thereafter, the Director shall submit to the 

5 Committee on Oversight and Reform of the House of Rep6 resentatives and the Committee on Homeland Security 

7 and Governmental Affairs of the Senate a report that in8 cludes the following: 

9 ‘‘(1) The status, efficiency, and effectiveness of 

10 FedRAMP Program Management Office and agen11 cies during the preceding year in supporting the 

12 speed, effectiveness, sharing, reuse, and security of 

13 authorizations to operate for cloud computing prod14 ucts and services, including progress towards meet15 ing the metrics adopted by the FedRAMP Program 

16 Management Office pursuant to section 3608(d) and 

17 the Joint Authorization Board pursuant to section 

18 3609(c)(5). 

19 ‘‘(2) Data on FedRAMP authorizations and 

20 FedRAMP provisional authorizations. 

21 ‘‘(3) The average length of time for the Joint 

22 Authorization Board to review applications for and 

23 issue FedRAMP provisional authorizations. 

24 ‘‘(4) The average length of time for the 

25 FedRAMP Program Management Office to review 

26 authorizations to operate. 
15 

•HR 21 EH

1 ‘‘(5) The number of FedRAMP authorizations 

2 and FedRAMP provisional authorizations issued for 

3 the previous year. 

4 ‘‘(6) A review of progress made during the pre5 ceding year in advancing automation techniques to 

6 securely automate FedRAMP processes and to accel7 erate reporting as described in this section. 

8 ‘‘(7) The number and characteristics of author9 ized cloud computing products and services in use at 

10 each agency consistent with guidance provided by 

11 the Director in section 3612. 

12 ‘‘(8) The cost incurred by agencies and cloud 

13 service providers related to the issuance of 

14 FedRAMP authorizations and FedRAMP provisional 

15 authorizations, including information responsive to 

16 the report required in subsection (b). 

17 ‘‘(b) GAO REPORT.—Not later than 6 months after 

18 the date of the enactment of this section, the Comptroller 

19 General of the United States shall publish a report that 

20 includes an assessment of the cost incurred by agencies 

21 and cloud service providers related to the issuance of 

22 FedRAMP authorizations and FedRAMP provisional au23 thorizations. 

24 ‘‘§ 3615. Federal Secure Cloud Advisory Committee 

25 ‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 
16 

•HR 21 EH

1 ‘‘(1) ESTABLISHMENT.—There is established a 

2 Federal Secure Cloud Advisory Committee (referred 

3 to in this section as the ‘Committee’) to ensure ef4 fective and ongoing coordination of agency adoption, 

5 use, authorization, monitoring, acquisition, and secu6 rity of cloud computing products and services to en7 able agency mission and administrative priorities. 

8 ‘‘(2) PURPOSES.—The purposes of the Com9 mittee are the following: 

10 ‘‘(A) To examine the operations of 

11 FedRAMP and determine ways that authoriza12 tion processes can continuously be improved, in13 cluding the following: 

14 ‘‘(i) Measures to increase agency re15 use of FedRAMP provisional authoriza16 tions. 

17 ‘‘(ii) Proposed actions that can be 

18 adopted to reduce the cost of FedRAMP 

19 authorizations and FedRAMP provisional 

20 authorizations for cloud service providers. 

21 ‘‘(iii) Measures to increase the num22 ber of FedRAMP authorizations and 

23 FedRAMP provisional authorizations for 

24 cloud computing services offered by small 

25 businesses (as defined by section 3(a) of 
17 

•HR 21 EH

1 the Small Business Act (15 U.S.C. 

2 632(a)). 

3 ‘‘(B) Collect information and feedback on 

4 agency compliance with and implementation of 

5 FedRAMP requirements. 

6 ‘‘(C) Serve as a forum that facilitates com7 munication and collaboration among the 

8 FedRAMP stakeholder community. 

9 ‘‘(3) DUTIES.—The duties of the Committee 

10 are, at a minimum, to provide advice and rec11 ommendations to the Administrator, the Joint Au12 thorization Board, and to agencies on technical, fi13 nancial, programmatic, and operational matters re14 garding secure adoption of cloud computing products 

15 and services. 

16 ‘‘(b) MEMBERS.— 

17 ‘‘(1) COMPOSITION.—The Committee shall be 

18 comprised of not more than 15 members who are 

19 qualified representatives from the public and private 

20 sectors, appointed by the Administrator, in consulta21 tion with the Administrator of the Office of Elec22 tronic Government, as follows: 

23 ‘‘(A) The Administrator or the Administra24 tor’s designee, who shall be the Chair of the 

25 Committee. 
18 

•HR 21 EH

1 ‘‘(B) At least one representative each from 

2 the Cybersecurity and Infrastructure Security 

3 Agency and the National Institute of Standards 

4 and Technology. 

5 ‘‘(C) At least two officials who serve as the 

6 Chief Information Security Officer within an 

7 agency, who shall be required to maintain such 

8 a position throughout the duration of their serv9 ice on the Committee. 

10 ‘‘(D) At least one official serving as Chief 

11 Procurement Officer (or equivalent) in an agen12 cy, who shall be required to maintain such a po13 sition throughout the duration of their service 

14 on the Committee. 

15 ‘‘(E) At least one individual representing 

16 an independent assessment organization. 

17 ‘‘(F) No fewer than five representatives 

18 from unique businesses that primarily provide 

19 cloud computing services or products, including 

20 at least two representatives from a small busi21 ness (as defined by section 3(a) of the Small 

22 Business Act (15 U.S.C. 632(a))). 

23 ‘‘(G) At least two other Government rep24 resentatives as the Administrator determines to 
19 

•HR 21 EH

1 be necessary to provide sufficient balance, in2 sights, or expertise to the Committee. 

3 ‘‘(2) DEADLINE FOR APPOINTMENT.—Each 

4 member of the Committee shall be appointed not 

5 later than 30 days after the date of the enactment 

6 of this section. 

7 ‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 

8 ‘‘(A) IN GENERAL.—Each non-Federal 

9 member of the Committee shall be appointed 

10 for a term of 3 years, except that the initial 

11 terms for members may be staggered 1-, 2-, or 

12 3-year terms to establish a rotation in which 

13 one-third of the members are selected each 

14 year. Any such member may be appointed for 

15 not more than 2 consecutive terms. 

16 ‘‘(B) VACANCIES.—Any vacancy in the 

17 Committee shall not affect its powers, but shall 

18 be filled in the same manner in which the origi19 nal appointment was made. Any member ap20 pointed to fill a vacancy occurring before the 

21 expiration of the term for which the member’s 

22 predecessor was appointed shall be appointed 

23 only for the remainder of that term. A member 

24 may serve after the expiration of that member’s 

25 term until a successor has taken office. 
20 

•HR 21 EH

1 ‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 

2 ‘‘(1) MEETINGS.—The Committee shall hold 

3 not fewer than three meetings in a calendar year, at 

4 such time and place as determined by the Chair. 

5 ‘‘(2) INITIAL MEETING.—Not later than 120 

6 days after the date of the enactment of this section, 

7 the Committee shall meet and begin the operations 

8 of the Committee. 

9 ‘‘(3) RULES OF PROCEDURE.—The Committee 

10 may establish rules for the conduct of the business 

11 of the Committee, if such rules are not inconsistent 

12 with this section or other applicable law. 

13 ‘‘(d) EMPLOYEE STATUS.— 

14 ‘‘(1) IN GENERAL.—A member of the Com15 mittee (other than a member who is appointed to the 

16 Committee in connection with another Federal ap17 pointment) shall not be considered an employee of 

18 the Federal Government by reason of any service as 

19 such a member, except for the purposes of section 

20 5703 of title 5, relating to travel expenses. 

21 ‘‘(2) PAY NOT PERMITTED.—A member of the 

22 Committee covered by paragraph (1) may not receive 

23 pay by reason of service on the Committee. 

24 ‘‘(e) APPLICABILITY TO THE FEDERAL ADVISORY

25 COMMITTEE ACT.—Section 14 of the Federal Advisory 
21 

•HR 21 EH

1 Committee Act (5 U.S.C. App.) shall not apply to the 

2 Committee. 

3 ‘‘(f) HEARINGS AND EVIDENCE.—The Committee, or 

4 on the authority of the Committee, any subcommittee, 

5 may, for the purposes of carrying out this section, hold 

6 hearings, sit and act at such times and places, take testi7 mony, receive evidence, and administer oaths. 

8 ‘‘(g) CONTRACTING.—The Committee, may, to such 

9 extent and in such amounts as are provided in appropria10 tion Acts, enter into contracts to enable the Committee 

11 to discharge its duties under this section. 

12 ‘‘(h) INFORMATION FROM FEDERAL AGENCIES.— 

13 ‘‘(1) IN GENERAL.—The Committee is author14 ized to secure directly from any executive depart15 ment, bureau, agency, board, commission, office, 

16 independent establishment, or instrumentality of the 

17 Government, information, suggestions, estimates, 

18 and statistics for the purposes of the Committee. 

19 Each department, bureau, agency, board, commis20 sion, office, independent establishment, or instru21 mentality shall, to the extent authorized by law, fur22 nish such information, suggestions, estimates, and 

23 statistics directly to the Committee, upon request 

24 made by the Chair, the Chair of any subcommittee 
22 

•HR 21 EH

1 created by a majority of the Committee, or any 

2 member designated by a majority of the Committee. 

3 ‘‘(2) RECEIPT, HANDLING, STORAGE, AND DIS4 SEMINATION.—Information may only be received, 

5 handled, stored, and disseminated by members of 

6 the Committee and its staff consistent with all appli7 cable statutes, regulations, and Executive orders. 

8 ‘‘(i) DETAIL OF EMPLOYEES.—Any Federal Govern9 ment employee may be detailed to the Committee without 

10 reimbursement from the Committee, and such detailee 

11 shall retain the rights, status, and privileges of his or her 

12 regular employment without interruption. 

13 ‘‘(j) POSTAL SERVICES.—The Committee may use 

14 the United States mails in the same manner and under 

15 the same conditions as agencies. 

16 ‘‘(k) EXPERT AND CONSULTANT SERVICES.—The 

17 Committee is authorized to procure the services of experts 

18 and consultants in accordance with section 3109 of title 

19 5, but at rates not to exceed the daily rate paid a person 

20 occupying a position at Level IV of the Executive Schedule 

21 under section 5315 of title 5. 

22 ‘‘(l) REPORTS.— 

23 ‘‘(1) INTERIM REPORTS.—The Committee may 

24 submit to the Administrator and Congress interim 

25 reports containing such findings, conclusions, and 
23 

•HR 21 EH

1 recommendations as have been agreed to by the 

2 Committee. 

3 ‘‘(2) ANNUAL REPORTS.—Not later than 18 

4 months after the date of the enactment of this sec5 tion, and annually thereafter, the Committee shall 

6 submit to the Administrator and Congress a final re7 port containing such findings, conclusions, and rec8 ommendations as have been agreed to by the Com9 mittee. 

10 ‘‘§ 3616. Definitions 

11 ‘‘(a) IN GENERAL.—Except as provided under sub12 section (b), the definitions under sections 3502 and 3552 

13 apply to sections 3607 through this section. 

14 ‘‘(b) ADDITIONAL DEFINITIONS.—In sections 3607 

15 through this section: 

16 ‘‘(1) ADMINISTRATOR.—The term ‘Adminis17 trator’ means the Administrator of General Services. 

18 ‘‘(2) AUTHORIZATION PACKAGE.—The term 

19 ‘authorization package’— 

20 ‘‘(A) means the essential information used 

21 to determine whether to authorize the operation 

22 of an information system or the use of a des23 ignated set of common controls; and 

24 ‘‘(B) at a minimum, includes the informa25 tion system security plan, privacy plan, security 
24 

•HR 21 EH

1 control assessment, privacy control assessment, 

2 and any relevant plans of action and milestones. 

3 ‘‘(3) CLOUD COMPUTING.—The term ‘cloud 

4 computing’ has the meaning given that term by the 

5 National Institutes of Standards and Technology in 

6 NIST Special Publication 800–145 and any amend7 atory or superseding document thereto. 

8 ‘‘(4) CLOUD SERVICE PROVIDER.—The term 

9 ‘cloud service provider’ means an entity offering 

10 cloud computing products or services to agencies. 

11 ‘‘(5) DIRECTOR.—The term ‘Director’ means 

12 the Director of the Office of Management and Budg13 et. 

14 ‘‘(6) FEDRAMP.—The term ‘FedRAMP’ 

15 means the Federal Risk and Authorization Manage16 ment Program established under section 3607(a). 

17 ‘‘(7) FEDRAMP AUTHORIZATION.—The term 

18 ‘FedRAMP authorization’ means a certification that 

19 a cloud computing product or service received from 

20 an agency that provides an authorization to operate 

21 and the FedRAMP Program Management Office has 

22 determined the product or service has completed the 

23 FedRAMP authorization process. 

24 ‘‘(8) FEDRAMP PROGRAM MANAGEMENT OF25 FICE.—The term ‘FedRAMP Program Management 
25 

•HR 21 EH

1 Office’ means the office that administers FedRAMP 

2 established under section 3607(b). 

3 ‘‘(9) FEDRAMP PROVISIONAL AUTHORIZA4 TION.—The term ‘FedRAMP provisional authoriza5 tion’ means a certification that a cloud computing 

6 product or service has received from the Joint Au7 thorization Board that approves a provisional au8 thorization to operate. 

9 ‘‘(10) INDEPENDENT ASSESSMENT ORGANIZA10 TION.—The term ‘independent assessment organiza11 tion’ means a third-party organization accredited by 

12 the Program Director of the FedRAMP Program 

13 Management Office to undertake conformity assess14 ments of cloud service providers and their products 

15 or services. 

16 ‘‘(11) JOINT AUTHORIZATION BOARD.—The 

17 term ‘Joint Authorization Board’ means the Joint 

18 Authorization Board established under section 

19 3607(b).’’. 

20 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

21 The table of sections for chapter 36 of title 44, United 

22 States Code, is amended by adding at the end the fol23 lowing new items: 

‘‘3607. Federal Risk and Authorization Management Program. 

‘‘3608. FedRAMP Program Management Office. 

‘‘3609. Joint Authorization Board. 

‘‘3610. Independent assessment organizations. 

‘‘3611. Roles and responsibilities of agencies. 
26 

•HR 21 EH

‘‘3612. Roles and responsibilities of the Office of Management and Budget. 

‘‘3613. Authorization of appropriations for FEDRAMP. 

‘‘3614. Reports to Congress. 

‘‘3615. Federal Secure Cloud Advisory Committee. 

‘‘3616. Definitions.’’. 

1 (c) SUNSET.—This Act and any amendment made by 

2 this Act shall be repealed on the date that is 10 years 

3 after the date of the enactment of this Act. 

4 (d) RULE OF CONSTRUCTION.—Nothing in this Act 

5 or any amendment made by this Act shall be construed 

6 as altering or impairing the authorities of the Director of 

7 the Office of Management and Budget or the Secretary 

8 of Homeland Security under subchapter II of chapter 35 

9 of title 44, United States Code. 

Passed the House of Representatives January 5, 

2021. 

Attest: 

Clerk. 

117TH CONGRESS 

1ST SESSION H. R. 21 

AN ACT 

To enhance the innovation, security, and availposes. and cloud-based operations, and for other pur- formation Security Modernization Act of 2014 based approach consistent with the Federal In- computing products and services using a risk- enable the Federal Government to leverage cloud thorization, and continuous monitoring process to tion and by establishing a risk management, au- Program within the General Services Administra- the Federal Risk and Authorization Management used in the Federal Government by establishing ability of cloud computing products and services