II 

Calendar No. 383 

117TH CONGRESS 

2D SESSION S. 3099 

[Report No. 117–115] 

To amend title 44, United States Code, to establish the Federal Risk and 

Authorization Management Program within the General Services Administration, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 28, 2021 

Mr. PETERS (for himself, Ms. HASSAN, Mr. HAWLEY, and Mr. DAINES) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

MAY 24, 2022 

Reported by Mr. PETERS, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To amend title 44, United States Code, to establish the 

Federal Risk and Authorization Management Program 

within the General Services Administration, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 3099 RS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Federal Secure Cloud 

3 Improvement and Jobs Act of 2021’’. 

4 SEC. 2. FINDINGS. 

5 Congress finds the following: 

6 (1) Ensuring that the Federal Government can 

7 securely leverage cloud computing products and serv8 ices is key to expediting the modernization of legacy 

9 information technology systems, increasing cyberse10 curity within and across departments and agencies, 

11 and supporting the continued leadership of the 

12 United States in technology innovation and job cre13 ation. 

14 (2) According to independent analysis, as of 

15 calendar year 2019, the size of the cloud computing 

16 market had tripled since 2004, enabling more than 

17 2,000,000 jobs and adding more than 

18 $200,000,000,000 to the gross domestic product of 

19 the United States. 

20 (3) The Federal Government, across multiple 

21 presidential administrations and Congresses, has 

22 continued to support the ability of agencies to move 

23 to the cloud, including through— 

24 (A) President Barack Obama’s ‘‘Cloud 

25 First Strategy’’; 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 3099 RS

1 (B) President Donald Trump’s ‘‘Cloud 

2 Smart Strategy’’; 

3 (C) the prioritization of cloud security in 

4 Executive Order 14208 (86 Fed. Reg. 26633; 

5 relating to improving the Nation’s cybersecu6 rity), which was issued by President Joe Biden; 

7 and 

8 (D) more than a decade of appropriations 

9 and authorization legislation that provides 

10 agencies with relevant authorities and appro11 priations to modernize on-premises information 

12 technology systems and more readily adopt 

13 cloud computing products and services. 

14 (4) Since it was created in 2011, the Federal 

15 Risk and Authorization Management Program (re16 ferred to in this section as ‘‘FedRAMP’’) at the 

17 General Services Administration has made steady 

18 and sustained improvements in supporting the se19 cure authorization and reuse of cloud computing 

20 products and services within the Federal Govern21 ment, including by reducing the costs and burdens 

22 on both agencies and cloud companies to quickly and 

23 securely enter the Federal market. 

24 (5) According to data from the General Services 

25 Administration, as of the end of fiscal year 2021, 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 3099 RS

1 there were 239 cloud providers with FedRAMP au2 thorizations, and those authorizations had been re3 used more than 2,700 times across various agencies. 

4 (6) Providing a legislative framework for 

5 FedRAMP and new authorities to the General Serv6 ices Administration, the Office of Management and 

7 Budget, and Federal agencies will— 

8 (A) improve the speed at which new cloud 

9 computing products and services can be se10 curely authorized; 

11 (B) enhance the ability of agencies to ef12 fectively evaluate FedRAMP authorized pro13 viders for reuse; 

14 (C) reduce the costs and burdens to cloud 

15 providers seeking a FedRAMP authorization; 

16 and 

17 (D) provide for more robust transparency 

18 and dialogue between industry and the Federal 

19 Government to drive stronger adoption of se20 cure cloud capabilities, create jobs, and reduce 

21 wasteful legacy information technology. 

22 SEC. 3. TITLE 44 AMENDMENTS. 

23 (a) AMENDMENT.—Chapter 36 of title 44, United 

24 States Code, is amended by adding at the end the fol25 lowing: 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 3099 RS

1 ‘‘§ 3607. Definitions 

2 ‘‘(a) IN GENERAL.—Except as provided under sub3 section (b), the definitions under sections 3502 and 3552 

4 apply to this section through section 3616. 

5 ‘‘(b) ADDITIONAL DEFINITIONS.—In this section 

6 through section 3616: 

7 ‘‘(1) CLOUD COMPUTING.—The term ‘cloud 

8 computing’ has the meaning given the term in Spe9 cial Publication 800–145 of the National Institute of 

10 Standards and Technology. 

11 ‘‘(2) CLOUD SERVICE PROVIDER.—The term 

12 ‘cloud service provider’ means an entity offering 

13 cloud computing products or services to agencies. 

14 ‘‘(3) FEDRAMP.—The term ‘FedRAMP’ 

15 means the Federal Risk and Authorization Manage16 ment Program established under section 3608. 

17 ‘‘(4) FEDRAMP AUTHORIZATION.—The term 

18 ‘FedRAMP authorization’ means a certification that 

19 a cloud computing product or service has— 

20 ‘‘(A) completed a FedRAMP authorization 

21 process, as determined by the Administrator of 

22 General Services; or 

23 ‘‘(B) received a FedRAMP provisional au24 thorization to operate, as determined by the 

25 FedRAMP Board. 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 3099 RS

1 ‘‘(5) FEDRAMP AUTHORIZATION PACKAGE.— 

2 The term ‘FedRAMP authorization package’ means 

3 the essential information that can be used by an 

4 agency to determine whether to authorize the oper5 ation of an information system or the use of a des6 ignated set of common controls for all cloud com7 puting products and services authorized by 

8 FedRAMP. 

9 ‘‘(6) FEDRAMP BOARD.—The term ‘FedRAMP 

10 Board’ means the board established under section 

11 3610. 

12 ‘‘(7) INDEPENDENT ASSESSMENT ORGANIZA13 TION.—The term ‘independent assessment organiza14 tion’ means a third-party organization accredited by 

15 the Administrator of General Services to undertake 

16 conformity assessments of cloud service providers 

17 and their products or services. 

18 ‘‘(8) SECRETARY.—The term ‘Secretary’ means 

19 the Secretary of Homeland Security. 

20 ‘‘§ 3608. Federal Risk and Authorization Management 

21 Program 

22 ‘‘There is established within the General Services Ad23 ministration the Federal Risk and Authorization Manage24 ment Program. The Administrator of General Services, 

25 subject to section 3613, shall establish a Government-wide 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 3099 RS

1 program that provides a standardized, reusable approach 

2 to security assessment and authorization for cloud com3 puting products and services that process unclassified in4 formation used by agencies. 

5 ‘‘§ 3609. Roles and responsibilities of the General 

6 Services Administration 

7 ‘‘(a) ROLES AND RESPONSIBILITIES.—The Adminis8 trator of General Services shall— 

9 ‘‘(1) in consultation with the Secretary, develop, 

10 coordinate, and implement a process to support 

11 agency review, reuse, and standardization, where ap12 propriate, of security assessments of cloud com13 puting products and services, including, as appro14 priate, oversight of continuous monitoring of cloud 

15 computing products and services, pursuant to guid16 ance issued by the Director pursuant to section 

17 3613; 

18 ‘‘(2) establish processes and identify criteria 

19 consistent with guidance issued by the Director 

20 under section 3613 to make a cloud computing prod21 uct or service eligible for a FedRAMP authorization 

22 and validate whether a cloud computing product or 

23 service has a FedRAMP authorization; 

24 ‘‘(3) develop and publish templates, best prac25 tices, technical assistance, and other materials to 


pbinns on DSKJLVW7X2PROD with $$_JOB
8 

•S 3099 RS

1 support the authorization of cloud computing prod2 ucts and services and increase the speed, effective3 ness, and transparency of the authorization process, 

4 consistent with standards established by the Director 

5 of the National Institute of Standards and Tech6 nology and relevant statutes; 

7 ‘‘(4) grant FedRAMP authorizations to cloud 

8 computing products and services consistent with the 

9 guidance and direction of the FedRAMP Board; 

10 ‘‘(5) establish and maintain a public comment 

11 process for proposed guidance and other FedRAMP 

12 directives that may have a direct impact on cloud 

13 service providers and agencies before the issuance of 

14 such guidance or other FedRAMP directives; 

15 ‘‘(6) coordinate with the FedRAMP Board, the 

16 Director of the Cybersecurity and Infrastructure Se17 curity Agency, and other entities identified by the 

18 Administrator of General Services, with the concur19 rence of the Director and the Secretary, to establish 

20 and regularly update a framework for continuous 

21 monitoring under section 3553; 

22 ‘‘(7) provide a secure mechanism for storing 

23 and sharing necessary data, including FedRAMP 

24 authorization packages, to enable better reuse of 

25 such packages across agencies, including making 


pbinns on DSKJLVW7X2PROD with $$_JOB
9 

•S 3099 RS

1 available any information and data necessary for 

2 agencies to fulfill the requirements of section 3612; 

3 ‘‘(8) provide regular updates to applicant cloud 

4 service providers on the status of any cloud com5 puting product or service during an assessment 

6 process; 

7 ‘‘(9) regularly review, in consultation with the 

8 FedRAMP Board, the costs associated with the 

9 independent assessment services of the third-party 

10 organizations described in section 3611; 

11 ‘‘(10) support the Federal Secure Cloud Advi12 sory Committee established pursuant to section 

13 3616; and 

14 ‘‘(11) take such other actions as the Adminis15 trator of General Services may determine necessary 

16 to carry out FedRAMP. 

17 ‘‘(b) WEBSITE.— 

18 ‘‘(1) IN GENERAL.—The Administrator of Gen19 eral Services shall maintain a public website to serve 

20 as the authoritative repository for FedRAMP, in21 cluding the timely publication and updates for all 

22 relevant information, guidance, determinations, and 

23 other materials required under subsection (a). 

24 ‘‘(2) CRITERIA AND PROCESS FOR FEDRAMP

25 AUTHORIZATION PRIORITIES.—The Administrator of 


pbinns on DSKJLVW7X2PROD with $$_JOB
10 

•S 3099 RS

1 General Services shall develop and make publicly 

2 available on the website described in paragraph (1) 

3 the criteria and process for prioritizing and selecting 

4 cloud computing products and services that will re5 ceive a FedRAMP authorization, in consultation 

6 with the FedRAMP Board and the Chief Informa7 tion Officers Council. 

8 ‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 

9 ‘‘(1) IN GENERAL.—The Administrator of Gen10 eral Services, in coordination with the Secretary, 

11 shall assess and evaluate available automation capa12 bilities and procedures to improve the efficiency and 

13 effectiveness of the issuance of FedRAMP authoriza14 tions, including continuous monitoring of cloud com15 puting products and services. 

16 ‘‘(2) MEANS FOR AUTOMATION.—Not later than 

17 1 year after the date of enactment of this section, 

18 and updated regularly thereafter, the Administrator 

19 of General Services shall establish a means for the 

20 automation of security assessments and reviews. 

21 ‘‘(d) METRICS FOR AUTHORIZATION.—The Adminis22 trator of General Services shall establish annual metrics 

23 regarding the time and quality of the assessments nec24 essary for completion of a FedRAMP authorization proc25 ess in a manner that can be consistently tracked over time 


pbinns on DSKJLVW7X2PROD with $$_JOB
11 

•S 3099 RS

1 in conjunction with the periodic testing and evaluation 

2 process pursuant to section 3554 in a manner that mini3 mizes the agency reporting burden. 

4 ‘‘§ 3610. FedRAMP Board 

5 ‘‘(a) ESTABLISHMENT.—There is established a 

6 FedRAMP Board to provide input and recommendations 

7 to the Administrator of General Services regarding the re8 quirements and guidelines for, and the prioritization of, 

9 security assessments of cloud computing products and 

10 services. 

11 ‘‘(b) MEMBERSHIP.—The FedRAMP Board shall 

12 consist of not more than 7 senior officials or experts from 

13 agencies appointed by the Director, in consultation with 

14 the Administrator of General Services, from each of the 

15 following: 

16 ‘‘(1) The Department of Defense. 

17 ‘‘(2) The Department of Homeland Security. 

18 ‘‘(3) The General Services Administration. 

19 ‘‘(4) Such other agencies as determined by the 

20 Director, in consultation with the Administrator of 

21 General Services. 

22 ‘‘(c) QUALIFICATIONS.—Members of the FedRAMP 

23 Board appointed under subsection (b) shall have technical 

24 expertise in domains relevant to FedRAMP, such as— 

25 ‘‘(1) cloud computing; 


pbinns on DSKJLVW7X2PROD with $$_JOB
12 

•S 3099 RS

1 ‘‘(2) cybersecurity; 

2 ‘‘(3) privacy; 

3 ‘‘(4) risk management; and 

4 ‘‘(5) other competencies identified by the Direc5 tor to support the secure authorization of cloud serv6 ices and products. 

7 ‘‘(d) DUTIES.—The FedRAMP Board shall— 

8 ‘‘(1) in consultation with the Administrator of 

9 General Services, serve as a resource for best prac10 tices to accelerate the process for obtaining a 

11 FedRAMP authorization; 

12 ‘‘(2) establish and regularly update require13 ments and guidelines for security authorizations of 

14 cloud computing products and services, consistent 

15 with standards established by the Director of the 

16 National Institute of Standards and Technology, to 

17 be used in the determination of FedRAMP author18 izations; 

19 ‘‘(3) monitor and oversee, to the greatest extent 

20 practicable, the processes and procedures by which 

21 agencies determine and validate requirements for a 

22 FedRAMP authorization, including periodic review 

23 of the agency determinations described in section 

24 3612(b); 


pbinns on DSKJLVW7X2PROD with $$_JOB
13 

•S 3099 RS

1 ‘‘(4) ensure consistency and transparency be2 tween agencies and cloud service providers in a man3 ner that minimizes confusion and engenders trust; 

4 and 

5 ‘‘(5) perform such other roles and responsibil6 ities as the Director may assign, with concurrence 

7 from the Administrator of General Services. 

8 ‘‘(e) DETERMINATIONS OF DEMAND FOR CLOUD

9 COMPUTING PRODUCTS AND SERVICES.—The FedRAMP 

10 Board may consult with the Chief Information Officers 

11 Council to establish a process, which may be made avail12 able on the website maintained under section 3609(b), for 

13 prioritizing and accepting the cloud computing products 

14 and services to be granted a FedRAMP authorization. 

15 ‘‘§ 3611. Independent assessment organizations 

16 ‘‘(a) REQUIREMENTS FOR ACCREDITATION.—The 

17 Administrator of General Services may, consistent with 

18 guidance issued by the Director, determine the require19 ments for accreditation of a third-party organization to 

20 perform independent assessments and other activities that 

21 will improve the overall performance of FedRAMP and re22 duce the cost of FedRAMP authorizations for cloud serv23 ice providers. Such requirements may include developing 

24 or requiring certification programs for individuals emVerDate Sep 11 2014 00:52 May 25, 2022 Jkt 029200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6401 E:\BILLS\S3099.RS S3099

pbinns on DSKJLVW7X2PROD with $$_JOB
14 

•S 3099 RS

1 ployed by the third-party organization seeking accredita2 tion. 

3 ‘‘(b) CERTIFICATION.—The Administrator of General 

4 Services may accredit any third-party organization that 

5 meets the requirements for accreditation determined 

6 under subsection (a). If accredited pursuant to the re7 quirements determined under subsection (a), a certified 

8 independent assessment organization may assess, validate, 

9 and attest to the quality and compliance of security assess10 ment materials provided by cloud service providers. 

11 ‘‘§ 3612. Roles and responsibilities of agencies 

12 ‘‘(a) IN GENERAL.—In implementing the require13 ments of FedRAMP, the head of each agency shall, con14 sistent with guidance issued by the Director pursuant to 

15 section 3613— 

16 ‘‘(1) promote the use of cloud computing prod17 ucts and services that meet FedRAMP security re18 quirements and other risk-based performance re19 quirements as determined by the Director, in con20 sultation with the Secretary; 

21 ‘‘(2) confirm whether there is a FedRAMP au22 thorization in the secure mechanism provided under 

23 section 3609(a)(7) before beginning the process of 

24 granting a FedRAMP authorization for a cloud com25 puting product or service; 


pbinns on DSKJLVW7X2PROD with $$_JOB
15 

•S 3099 RS

1 ‘‘(3) to the extent practicable, for any cloud 

2 computing product or service the agency seeks to au3 thorize that has received a FedRAMP authorization, 

4 use the existing assessments of security controls and 

5 materials within the FedRAMP authorization pack6 age; and 

7 ‘‘(4) provide data and information required to 

8 the Director pursuant to section 3613 to determine 

9 how agencies are meeting metrics established by the 

10 Administrator of General Services. 

11 ‘‘(b) ATTESTATION.—Upon completing an assess12 ment or authorization activity with respect to a particular 

13 cloud computing product or service, if an agency deter14 mines that the information and data the agency has re15 viewed under paragraph (2) or (3) of subsection (a) is 

16 wholly or substantially deficient for the purposes of per17 forming an authorization of the cloud computing product 

18 or service, the head of the agency shall document as part 

19 of the resulting FedRAMP authorization package the rea20 sons for this determination. 

21 ‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE

22 REQUIRED.—Upon issuance of an agency authorization to 

23 operate based on a FedRAMP authorization, the head of 

24 the agency shall provide a copy of its authorization to op25 erate letter and any supplementary information required 


pbinns on DSKJLVW7X2PROD with $$_JOB
16 

•S 3099 RS

1 pursuant to section 3609(a) to the Administrator of Gen2 eral Services. 

3 ‘‘(d) SUBMISSION OF POLICIES REQUIRED.—Not 

4 later than 180 days after the date on which the Director 

5 issues guidance in accordance with section 3613, the head 

6 of each agency, acting through the agency chief informa7 tion officer of the agency, shall submit to the Director all 

8 agency policies relating to the authorization of cloud com9 puting products and services. 

10 ‘‘(e) PRESUMPTION OF ADEQUACY.— 

11 ‘‘(1) IN GENERAL.—The assessment of security 

12 controls and materials within the authorization 

13 package for a FedRAMP authorization shall be pre14 sumed adequate for use in an agency authorization 

15 to operate cloud computing products and services. 

16 ‘‘(2) INFORMATION SECURITY REQUIRE17 MENTS.—The presumption under paragraph (1) 

18 does not modify or alter— 

19 ‘‘(A) the responsibility of any agency to en20 sure compliance with subchapter II of chapter 

21 35 for any cloud computing products or services 

22 used by the agency; or 

23 ‘‘(B) the authority of the head of any 

24 agency to make a determination that there is a 

25 demonstrable need for additional security reVerDate Sep 11 2014 00:52 May 25, 2022 Jkt 029200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6401 E:\BILLS\S3099.RS S3099

pbinns on DSKJLVW7X2PROD with $$_JOB
17 

•S 3099 RS

1 quirements beyond the security requirements 

2 included in a FedRAMP authorization for a 

3 particular control implementation. 

4 ‘‘§ 3613. Roles and responsibilities of the Office of 

5 Management and Budget 

6 ‘‘(a) ROLES AND RESPONSIBILITIES.—The Director 

7 shall— 

8 ‘‘(1) in consultation with the Administrator of 

9 General Services and the Secretary, issue guidance 

10 that— 

11 ‘‘(A) specifies the categories or characteris12 tics of cloud computing products and services 

13 that are within the scope of FedRAMP; 

14 ‘‘(B) includes requirements for agencies to 

15 obtain a FedRAMP authorization when oper16 ating a cloud computing product or service de17 scribed in subparagraph (A) as a Federal infor18 mation system; and 

19 ‘‘(C) encompasses, to the greatest extent 

20 practicable, all necessary and appropriate cloud 

21 computing products and services; 

22 ‘‘(2) issue guidance describing additional re23 sponsibilities of FedRAMP and the FedRAMP 

24 Board to accelerate the adoption of secure cloud 

25 computing services by the Federal Government; 


pbinns on DSKJLVW7X2PROD with $$_JOB
18 

•S 3099 RS

1 ‘‘(3) oversee the effectiveness of FedRAMP and 

2 the FedRAMP Board, including the compliance by 

3 the FedRAMP Board with the duties described in 

4 section 3610(d); and 

5 ‘‘(4) to the greatest extent practicable, encour6 age and promote consistency of the assessment, au7 thorization, adoption, and use of cloud computing 

8 products and services within and across agencies. 

9 ‘‘§ 3614. Authorization of appropriations for 

10 FedRAMP 

11 ‘‘There is authorized to be appropriated to the Ad12 ministrator of General Services $20,000,000 for each fis13 cal year for FedRAMP and the FedRAMP Board. 

14 ‘‘§ 3615. Reports to congress; GAO report 

15 ‘‘(a) REPORTS TO CONGRESS.—Not later than 1 year 

16 after the date of enactment of this section, and annually 

17 thereafter, the Director shall submit to the Committee on 

18 Oversight and Reform of the House of Representatives 

19 and the Committee on Homeland Security and Govern20 mental Affairs of the Senate a report that includes the 

21 following: 

22 ‘‘(1) During the preceding year, the status, effi23 ciency, and effectiveness of the General Services Ad24 ministration under section 3609 and agencies under 

25 section 3612 and in supporting the speed, effectiveVerDate Sep 11 2014 00:52 May 25, 2022 Jkt 029200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6401 E:\BILLS\S3099.RS S3099

pbinns on DSKJLVW7X2PROD with $$_JOB
19 

•S 3099 RS

1 ness, sharing, reuse, and security of authorizations 

2 to operate for cloud computing products and serv3 ices. 

4 ‘‘(2) Progress towards meeting the metrics re5 quired under section 3609(d). 

6 ‘‘(3) Data on FedRAMP authorizations. 

7 ‘‘(4) The average length of time to issue 

8 FedRAMP authorizations. 

9 ‘‘(5) The number of FedRAMP authorizations 

10 submitted, issued, and denied for the preceding year. 

11 ‘‘(6) A review of progress made during the pre12 ceding year in advancing automation techniques to 

13 securely automate FedRAMP processes and to accel14 erate reporting under this section. 

15 ‘‘(7) The number and characteristics of author16 ized cloud computing products and services in use at 

17 each agency consistent with guidance provided by 

18 the Director under section 3613. 

19 ‘‘(b) GAO REPORT.—Not later than 180 days after 

20 the date of enactment of this section, the Comptroller 

21 General of the United States shall publish a report that 

22 includes an assessment of the following: 

23 ‘‘(1) The costs incurred by agencies and cloud 

24 service providers relating to the issuance of 

25 FedRAMP authorizations. 


pbinns on DSKJLVW7X2PROD with $$_JOB
20 

•S 3099 RS

1 ‘‘(2) The extent to which agencies have proc2 esses in place to continuously monitor cloud com3 puting products and services operating as Federal 

4 information systems. 

5 ‘‘(3) How often and for which categories of 

6 products agencies use FedRAMP authorizations. 

7 ‘‘(4) The unique costs and potential burdens in8 curred by cloud computing companies that are small 

9 business concerns (as defined in section 3(a) of the 

10 Small Business Act (15 U.S.C. 632(a))) as a part 

11 of the FedRAMP authorization process. 

12 ‘‘§ 3616. Federal Secure Cloud Advisory Committee 

13 ‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 

14 ‘‘(1) ESTABLISHMENT.—There is established a 

15 Federal Secure Cloud Advisory Committee (referred 

16 to in this section as the ‘Committee’) to ensure ef17 fective and ongoing coordination of agency adoption, 

18 use, authorization, monitoring, acquisition, and secu19 rity of cloud computing products and services to en20 able agency mission and administrative priorities. 

21 ‘‘(2) PURPOSES.—The purposes of the Com22 mittee are the following: 

23 ‘‘(A) To examine the operations of 

24 FedRAMP and determine ways that authorizaVerDate Sep 11 2014 00:52 May 25, 2022 Jkt 029200 PO 00000 Frm 00020 Fmt 6652 Sfmt 6401 E:\BILLS\S3099.RS S3099

pbinns on DSKJLVW7X2PROD with $$_JOB
21 

•S 3099 RS

1 tion processes can continuously be improved, in2 cluding the following: 

3 ‘‘(i) Measures to increase agency 

4 reuse of FedRAMP authorizations. 

5 ‘‘(ii) Proposed actions that can be 

6 adopted to reduce the burden, confusion, 

7 and cost associated with FedRAMP au8 thorizations for cloud service providers. 

9 ‘‘(iii) Measures to increase the num10 ber of FedRAMP authorizations for cloud 

11 computing services offered by small busi12 nesses concerns (as defined by section 3(a) 

13 of the Small Business Act (15 U.S.C. 

14 632(a))). 

15 ‘‘(iv) Proposed actions that can be 

16 adopted to reduce the burden and cost of 

17 FedRAMP authorizations for agencies. 

18 ‘‘(B) Collect information and feedback on 

19 agency compliance with and implementation of 

20 FedRAMP requirements. 

21 ‘‘(C) Serve as a forum that facilitates com22 munication and collaboration among the 

23 FedRAMP stakeholder community. 

24 ‘‘(3) DUTIES.—The duties of the Committee in25 clude providing advice and recommendations to the 


pbinns on DSKJLVW7X2PROD with $$_JOB
22 

•S 3099 RS

1 Administrator of General Services, the FedRAMP 

2 Board, and agencies on technical, financial, pro3 grammatic, and operational matters regarding se4 cure adoption of cloud computing products and serv5 ices. 

6 ‘‘(b) MEMBERS.— 

7 ‘‘(1) COMPOSITION.—The Committee shall be 

8 comprised of not more than 15 members who are 

9 qualified representatives from the public and private 

10 sectors, appointed by the Administrator of General 

11 Services, in consultation with the Director, as fol12 lows: 

13 ‘‘(A) The Administrator of General Serv14 ices or the Administrator of General Services’s 

15 designee, who shall be the Chair of the Com16 mittee. 

17 ‘‘(B) At least 1 representative each from 

18 the Cybersecurity and Infrastructure Security 

19 Agency and the National Institute of Standards 

20 and Technology. 

21 ‘‘(C) At least 2 officials who serve as the 

22 Chief Information Security Officer within an 

23 agency, who shall be required to maintain such 

24 a position throughout the duration of their serv25 ice on the Committee. 


pbinns on DSKJLVW7X2PROD with $$_JOB
23 

•S 3099 RS

1 ‘‘(D) At least 1 official serving as Chief 

2 Procurement Officer (or equivalent) in an agen3 cy, who shall be required to maintain such a po4 sition throughout the duration of their service 

5 on the Committee. 

6 ‘‘(E) At least 1 individual representing an 

7 independent assessment organization. 

8 ‘‘(F) No fewer than 5 representatives from 

9 unique businesses that primarily provide cloud 

10 computing services or products, including at 

11 least two representatives from a small business 

12 concern (as defined by section 3(a) of the Small 

13 Business Act (15 U.S.C. 632(a))). 

14 ‘‘(G) At least 2 other representatives of the 

15 Federal Government as the Administrator of 

16 General Services determines necessary to pro17 vide sufficient balance, insights, or expertise to 

18 the Committee. 

19 ‘‘(2) DEADLINE FOR APPOINTMENT.—Each 

20 member of the Committee shall be appointed not 

21 later than 90 days after the date of enactment of 

22 this section. 

23 ‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 

24 ‘‘(A) IN GENERAL.—Each non-Federal 

25 member of the Committee shall be appointed 


pbinns on DSKJLVW7X2PROD with $$_JOB
24 

•S 3099 RS

1 for a term of 3 years, except that the initial 

2 terms for members may be staggered 1-, 2-, or 

3 3-year terms to establish a rotation in which 

4 one-third of the members are selected each 

5 year. Any such member may be appointed for 

6 not more than 2 consecutive terms. 

7 ‘‘(B) VACANCIES.—Any vacancy in the 

8 Committee shall not affect its powers, but shall 

9 be filled in the same manner in which the origi10 nal appointment was made. Any member ap11 pointed to fill a vacancy occurring before the 

12 expiration of the term for which the member’s 

13 predecessor was appointed shall be appointed 

14 only for the remainder of that term. A member 

15 may serve after the expiration of that member’s 

16 term until a successor has taken office. 

17 ‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 

18 ‘‘(1) MEETINGS.—The Committee shall hold 

19 not fewer than 3 meetings in a calendar year, at 

20 such time and place as determined by the Chair. 

21 ‘‘(2) INITIAL MEETING.—Not later than 120 

22 days after the date of enactment of this section, the 

23 Committee shall meet and begin the operations of 

24 the Committee. 


pbinns on DSKJLVW7X2PROD with $$_JOB
25 

•S 3099 RS

1 ‘‘(3) RULES OF PROCEDURE.—The Committee 

2 may establish rules for the conduct of the business 

3 of the Committee if such rules are not inconsistent 

4 with this section or other applicable law. 

5 ‘‘(d) EMPLOYEE STATUS.— 

6 ‘‘(1) IN GENERAL.—A member of the Com7 mittee (other than a member who is appointed to the 

8 Committee in connection with another Federal ap9 pointment) shall not be considered an employee of 

10 the Federal Government by reason of any service as 

11 such a member, except for the purposes of section 

12 5703 of title 5, relating to travel expenses. 

13 ‘‘(2) PAY NOT PERMITTED.—A member of the 

14 Committee covered by paragraph (1) may not receive 

15 pay by reason of service on the Committee. 

16 ‘‘(e) APPLICABILITY TO THE FEDERAL ADVISORY

17 COMMITTEE ACT.—Section 14 of the Federal Advisory 

18 Committee Act (5 U.S.C. App.) shall not apply to the 

19 Committee. 

20 ‘‘(f) DETAIL OF EMPLOYEES.—Any Federal Govern21 ment employee may be detailed to the Committee without 

22 reimbursement from the Committee, and such detailee 

23 shall retain the rights, status, and privileges of his or her 

24 regular employment without interruption. 


pbinns on DSKJLVW7X2PROD with $$_JOB
26 

•S 3099 RS

1 ‘‘(g) POSTAL SERVICES.—The Committee may use 

2 the United States mails in the same manner and under 

3 the same conditions as agencies. 

4 ‘‘(h) REPORTS.— 

5 ‘‘(1) INTERIM REPORTS.—The Committee may 

6 submit to the Administrator of General Services and 

7 Congress interim reports containing such findings, 

8 conclusions, and recommendations as have been 

9 agreed to by the Committee. 

10 ‘‘(2) ANNUAL REPORTS.—Not later than 540 

11 days after the date of enactment of this section, and 

12 annually thereafter, the Committee shall submit to 

13 the Administrator of General Services and Congress 

14 a final report containing such findings, conclusions, 

15 and recommendations as have been agreed to by the 

16 Committee.’’. 

17 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

18 The table of sections for chapter 36 of title 44, United 

19 States Code, is amended by adding at the end the fol20 lowing new items: 

‘‘3607. Definitions. 

‘‘3608. Federal Risk and Authorization Management Program. 

‘‘3609. Roles and responsibilities of the General Services Administration. 

‘‘3610. FedRAMP Board. 

‘‘3611. Independent assessment organizations. 

‘‘3612. Roles and responsibilities of agencies. 

‘‘3613. Roles and responsibilities of the Office of Management and Budget. 

‘‘3614. Authorization of appropriations for FedRAMP. 

‘‘3615. Reports to congress; GAO report. 

‘‘3616. Federal Secure Cloud Advisory Committee.’’. 


pbinns on DSKJLVW7X2PROD with $$_JOB
27 

•S 3099 RS

1 (c) SUNSET.— 

2 (1) IN GENERAL.—Effective on the date that is 

3 5 years after the date of enactment of this Act, 

4 chapter 36 of title 44, United States Code, is 

5 amended by striking sections 3607 through 3616. 

6 (2) CONFORMING AMENDMENT.—Effective on 

7 the date that is 5 years after the date of enactment 

8 of this Act, the table of sections for chapter 36 of 

9 title 44, United States Code, is amended by striking 

10 the items relating to sections 3607 through 3616. 

11 (d) RULE OF CONSTRUCTION.—Nothing in this sec12 tion or any amendment made by this section shall be con13 strued as altering or impairing the authorities of the Di14 rector of the Office of Management and Budget or the 

15 Secretary of Homeland Security under subchapter II of 

16 chapter 35 of title 44, United States Code. 

17 SECTION 1. SHORT TITLE. 

18 This Act may be cited as the ‘‘Federal Secure Cloud 

19 Improvement and Jobs Act of 2021’’. 

20 SEC. 2. FINDINGS. 

21 Congress finds the following: 

22 (1) Ensuring that the Federal Government can 

23 securely leverage cloud computing products and serv24 ices is key to expediting the modernization of legacy 

25 information technology systems, increasing cybersecuVerDate Sep 11 2014 00:52 May 25, 2022 Jkt 029200 PO 00000 Frm 00027 Fmt 6652 Sfmt 6203 E:\BILLS\S3099.RS S3099

pbinns on DSKJLVW7X2PROD with $$_JOB
28 

•S 3099 RS

1 rity within and across departments and agencies, and 

2 supporting the continued leadership of the United 

3 States in technology innovation and job creation. 

4 (2) According to independent analysis, as of cal5 endar year 2019, the size of the cloud computing mar6 ket had tripled since 2004, enabling more than 

7 2,000,000 jobs and adding more than 

8 $200,000,000,000 to the gross domestic product of the 

9 United States. 

10 (3) The Federal Government, across multiple 

11 presidential administrations and Congresses, has con12 tinued to support the ability of agencies to move to 

13 the cloud, including through— 

14 (A) President Barack Obama’s ‘‘Cloud First 

15 Strategy’’; 

16 (B) President Donald Trump’s ‘‘Cloud 

17 Smart Strategy’’; 

18 (C) the prioritization of cloud security in 

19 Executive Order 14028 (86 Fed. Reg. 26633; re20 lating to improving the nation’s cybersecurity), 

21 which was issued by President Joe Biden; and 

22 (D) more than a decade of appropriations 

23 and authorization legislation that provides agen24 cies with relevant authorities and appropriations 

25 to modernize on-premises information technology 


pbinns on DSKJLVW7X2PROD with $$_JOB
29 

•S 3099 RS

1 systems and more readily adopt cloud computing 

2 products and services. 

3 (4) Since it was created in 2011, the Federal 

4 Risk and Authorization Management Program (re5 ferred to in this section as ‘‘FedRAMP’’) at the Gen6 eral Services Administration has made steady and 

7 sustained improvements in supporting the secure au8 thorization and reuse of cloud computing products 

9 and services within the Federal Government, includ10 ing by reducing the costs and burdens on both agen11 cies and cloud companies to quickly and securely 

12 enter the Federal market. 

13 (5) According to data from the General Services 

14 Administration, as of the end of fiscal year 2021, 

15 there were 239 cloud providers with FedRAMP au16 thorizations, and those authorizations had been reused 

17 more than 2,700 times across various agencies. 

18 (6) Providing a legislative framework for 

19 FedRAMP and new authorities to the General Serv20 ices Administration, the Office of Management and 

21 Budget, and Federal agencies will— 

22 (A) improve the speed at which new cloud 

23 computing products and services can be securely 

24 authorized; 


pbinns on DSKJLVW7X2PROD with $$_JOB
30 

•S 3099 RS

1 (B) enhance the ability of agencies to effec2 tively evaluate FedRAMP authorized providers 

3 for reuse; 

4 (C) reduce the costs and burdens to cloud 

5 providers seeking a FedRAMP authorization; 

6 and 

7 (D) provide for more robust transparency 

8 and dialogue between industry and the Federal 

9 Government to drive stronger adoption of secure 

10 cloud capabilities, create jobs, and reduce waste11 ful legacy information technology. 

12 SEC. 3. TITLE 44 AMENDMENTS. 

13 (a) AMENDMENT.—Chapter 36 of title 44, United 

14 States Code, is amended by adding at the end the following: 

15 ‘‘§ 3607. Definitions 

16 ‘‘(a) IN GENERAL.—Except as provided under sub17 section (b), the definitions under sections 3502 and 3552 

18 apply to this section through section 3616. 

19 ‘‘(b) ADDITIONAL DEFINITIONS.—In this section 

20 through section 3616: 

21 ‘‘(1) ADMINISTRATOR.—The term ‘Adminis22 trator’ means the Administrator of General Services. 

23 ‘‘(2) APPROPRIATE CONGRESSIONAL COMMIT24 TEES.—The term ‘appropriate congressional commit25 tees’ means the Committee on Homeland Security and 


pbinns on DSKJLVW7X2PROD with $$_JOB
31 

•S 3099 RS

1 Governmental Affairs of the Senate and the Com2 mittee on Oversight and Reform of the House of Rep3 resentatives. 

4 ‘‘(3) AUTHORIZATION TO OPERATE; FEDERAL IN5 FORMATION.—The terms ‘authorization to operate’ 

6 and ‘Federal information’ have the meaning given 

7 those term in Circular A–130 of the Office of Manage8 ment and Budget entitled ‘Managing Information as 

9 a Strategic Resource’, or any successor document. 

10 ‘‘(4) CLOUD COMPUTING.—The term ‘cloud com11 puting’ has the meaning given the term in Special 

12 Publication 800–145 of the National Institute of 

13 Standards and Technology, or any successor docu14 ment. 

15 ‘‘(5) CLOUD SERVICE PROVIDER.—The term 

16 ‘cloud service provider’ means an entity offering cloud 

17 computing products or services to agencies. 

18 ‘‘(6) FEDRAMP.—The term ‘FedRAMP’ means 

19 the Federal Risk and Authorization Management Pro20 gram established under section 3608. 

21 ‘‘(7) FEDRAMP AUTHORIZATION.—The term 

22 ‘FedRAMP authorization’ means a certification that 

23 a cloud computing product or service has— 

24 ‘‘(A) completed a FedRAMP authorization 

25 process, as determined by the Administrator; or 


pbinns on DSKJLVW7X2PROD with $$_JOB
32 

•S 3099 RS

1 ‘‘(B) received a FedRAMP provisional au2 thorization to operate, as determined by the 

3 FedRAMP Board. 

4 ‘‘(8) FEDRAMP AUTHORIZATION PACKAGE.—The 

5 term ‘FedRAMP authorization package’ means the es6 sential information that can be used by an agency to 

7 determine whether to authorize the operation of an in8 formation system or the use of a designated set of 

9 common controls for all cloud computing products 

10 and services authorized by FedRAMP. 

11 ‘‘(9) FEDRAMP BOARD.—The term ‘FedRAMP 

12 Board’ means the board established under section 

13 3610. 

14 ‘‘(10) INDEPENDENT ASSESSMENT SERVICE.— 

15 The term ‘independent assessment service’ means a 

16 third-party organization accredited by the Adminis17 trator to undertake conformity assessments of cloud 

18 service providers and the products or services of cloud 

19 service providers. 

20 ‘‘(11) SECRETARY.—The term ‘Secretary’ means 

21 the Secretary of Homeland Security. 

22 ‘‘§ 3608. Federal Risk and Authorization Management 

23 Program 

24 ‘‘There is established within the General Services Ad25 ministration the Federal Risk and Authorization ManageVerDate Sep 11 2014 00:52 May 25, 2022 Jkt 029200 PO 00000 Frm 00032 Fmt 6652 Sfmt 6203 E:\BILLS\S3099.RS S3099

pbinns on DSKJLVW7X2PROD with $$_JOB
33 

•S 3099 RS

1 ment Program. The Administrator, subject to section 3614, 

2 shall establish a Government-wide program that provides 

3 a standardized, reusable approach to security assessment 

4 and authorization for cloud computing products and serv5 ices that process unclassified information used by agencies. 

6 ‘‘§ 3609. Roles and responsibilities of the General 

7 Services Administration 

8 ‘‘(a) ROLES AND RESPONSIBILITIES.—The Adminis9 trator shall— 

10 ‘‘(1) in consultation with the Secretary, develop, 

11 coordinate, and implement a process to support agen12 cy review, reuse, and standardization, where appro13 priate, of security assessments of cloud computing 

14 products and services, including, as appropriate, 

15 oversight of continuous monitoring of cloud com16 puting products and services, pursuant to guidance 

17 issued by the Director pursuant to section 3614; 

18 ‘‘(2) establish processes and identify criteria con19 sistent with guidance issued by the Director under 

20 section 3614 to make a cloud computing product or 

21 service eligible for a FedRAMP authorization and 

22 validate whether a cloud computing product or service 

23 has a FedRAMP authorization; 

24 ‘‘(3) develop and publish templates, best prac25 tices, technical assistance, and other materials to supVerDate Sep 11 2014 00:52 May 25, 2022 Jkt 029200 PO 00000 Frm 00033 Fmt 6652 Sfmt 6203 E:\BILLS\S3099.RS S3099

pbinns on DSKJLVW7X2PROD with $$_JOB
34 

•S 3099 RS

1 port the authorization of cloud computing products 

2 and services and increase the speed, effectiveness, and 

3 transparency of the authorization process, consistent 

4 with standards and guidelines established by the Di5 rector of the National Institute of Standards and 

6 Technology and relevant statutes; 

7 ‘‘(4) establish and update guidance on the 

8 boundaries of FedRAMP authorization packages to 

9 enhance the security and protection of Federal infor10 mation and promote transparency for agencies and 

11 users as to which services are included in the scope 

12 of a FedRAMP authorization; 

13 ‘‘(5) grant FedRAMP authorizations to cloud 

14 computing products and services consistent with the 

15 guidance and direction of the FedRAMP Board; 

16 ‘‘(6) establish and maintain a public comment 

17 process for proposed guidance and other FedRAMP 

18 directives that may have a direct impact on cloud 

19 service providers and agencies before the issuance of 

20 such guidance or other FedRAMP directives; 

21 ‘‘(7) coordinate with the FedRAMP Board, the 

22 Director of the Cybersecurity and Infrastructure Se23 curity Agency, and other entities identified by the Ad24 ministrator, with the concurrence of the Director and 

25 the Secretary, to establish and regularly update a 


pbinns on DSKJLVW7X2PROD with $$_JOB
35 

•S 3099 RS

1 framework for continuous monitoring under section 

2 3553; 

3 ‘‘(8) provide a secure mechanism for storing and 

4 sharing necessary data, including FedRAMP author5 ization packages, to enable better reuse of such pack6 ages across agencies, including making available any 

7 information and data necessary for agencies to fulfill 

8 the requirements of section 3613; 

9 ‘‘(9) provide regular updates to applicant cloud 

10 service providers on the status of any cloud com11 puting product or service during an assessment proc12 ess; 

13 ‘‘(10) regularly review, in consultation with the 

14 FedRAMP Board— 

15 ‘‘(A) the costs associated with the inde16 pendent assessment services described in section 

17 3611; and 

18 ‘‘(B) the information relating to foreign in19 terests submitted pursuant to section 3612; 

20 ‘‘(11) in coordination with the Director of the 

21 National Institute of Standards and Technology, the 

22 Director, the Secretary, and other stakeholders, as ap23 propriate, determine the sufficiency of underlying 

24 standards and requirements to identify and assess the 


pbinns on DSKJLVW7X2PROD with $$_JOB
36 

•S 3099 RS

1 provenance of the software in cloud services and prod2 ucts; 

3 ‘‘(12) support the Federal Secure Cloud Advisory 

4 Committee established pursuant to section 3616; and 

5 ‘‘(13) take such other actions as the Adminis6 trator may determine necessary to carry out 

7 FedRAMP. 

8 ‘‘(b) WEBSITE.— 

9 ‘‘(1) IN GENERAL.—The Administrator shall 

10 maintain a public website to serve as the authori11 tative repository for FedRAMP, including the timely 

12 publication and updates for all relevant information, 

13 guidance, determinations, and other materials re14 quired under subsection (a). 

15 ‘‘(2) CRITERIA AND PROCESS FOR FEDRAMP AU16 THORIZATION PRIORITIES.—The Administrator shall 

17 develop and make publicly available on the website 

18 described in paragraph (1) the criteria and process 

19 for prioritizing and selecting cloud computing prod20 ucts and services that will receive a FedRAMP au21 thorization, in consultation with the FedRAMP 

22 Board and the Chief Information Officers Council. 

23 ‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 

24 ‘‘(1) IN GENERAL.—The Administrator, in co25 ordination with the Secretary, shall assess and evaluVerDate Sep 11 2014 00:52 May 25, 2022 Jkt 029200 PO 00000 Frm 00036 Fmt 6652 Sfmt 6203 E:\BILLS\S3099.RS S3099

pbinns on DSKJLVW7X2PROD with $$_JOB
37 

•S 3099 RS

1 ate available automation capabilities and procedures 

2 to improve the efficiency and effectiveness of the 

3 issuance of FedRAMP authorizations, including con4 tinuous monitoring of cloud computing products and 

5 services. 

6 ‘‘(2) MEANS FOR AUTOMATION.—Not later than 

7 1 year after the date of enactment of this section, and 

8 updated regularly thereafter, the Administrator shall 

9 establish a means for the automation of security as10 sessments and reviews. 

11 ‘‘(d) METRICS FOR AUTHORIZATION.—The Adminis12 trator shall establish annual metrics regarding the time and 

13 quality of the assessments necessary for completion of a 

14 FedRAMP authorization process in a manner that can be 

15 consistently tracked over time in conjunction with the peri16 odic testing and evaluation process pursuant to section 

17 3554 in a manner that minimizes the agency reporting bur18 den. 

19 ‘‘§ 3610. FedRAMP Board 

20 ‘‘(a) ESTABLISHMENT.—There is established a 

21 FedRAMP Board to provide input and recommendations 

22 to the Administrator regarding the requirements and guide23 lines for, and the prioritization of, security assessments of 

24 cloud computing products and services. 


pbinns on DSKJLVW7X2PROD with $$_JOB
38 

•S 3099 RS

1 ‘‘(b) MEMBERSHIP.—The FedRAMP Board shall con2 sist of not more than 7 senior officials or experts from agen3 cies appointed by the Director, in consultation with the Ad4 ministrator, from each of the following: 

5 ‘‘(1) The Department of Defense. 

6 ‘‘(2) The Department of Homeland Security. 

7 ‘‘(3) The General Services Administration. 

8 ‘‘(4) Such other agencies as determined by the 

9 Director, in consultation with the Administrator. 

10 ‘‘(c) QUALIFICATIONS.—Members of the FedRAMP 

11 Board appointed under subsection (b) shall have technical 

12 expertise in domains relevant to FedRAMP, such as— 

13 ‘‘(1) cloud computing; 

14 ‘‘(2) cybersecurity; 

15 ‘‘(3) privacy; 

16 ‘‘(4) risk management; and 

17 ‘‘(5) other competencies identified by the Director 

18 to support the secure authorization of cloud services 

19 and products. 

20 ‘‘(d) DUTIES.—The FedRAMP Board shall— 

21 ‘‘(1) in consultation with the Administrator, 

22 serve as a resource for best practices to accelerate the 

23 process for obtaining a FedRAMP authorization; 

24 ‘‘(2) establish and regularly update requirements 

25 and guidelines for security authorizations of cloud 


pbinns on DSKJLVW7X2PROD with $$_JOB
39 

•S 3099 RS

1 computing products and services, consistent with 

2 standards and guidelines established by the Director 

3 of the National Institute of Standards and Tech4 nology, to be used in the determination of FedRAMP 

5 authorizations; 

6 ‘‘(3) monitor and oversee, to the greatest extent 

7 practicable, the processes and procedures by which 

8 agencies determine and validate requirements for a 

9 FedRAMP authorization, including periodic review of 

10 the agency determinations described in section 

11 3613(b); 

12 ‘‘(4) ensure consistency and transparency be13 tween agencies and cloud service providers in a man14 ner that minimizes confusion and engenders trust; 

15 and 

16 ‘‘(5) perform such other roles and responsibilities 

17 as the Director may assign, with concurrence from the 

18 Administrator. 

19 ‘‘(e) DETERMINATIONS OF DEMAND FOR CLOUD COM20 PUTING PRODUCTS AND SERVICES.—The FedRAMP Board 

21 may consult with the Chief Information Officers Council 

22 to establish a process, which may be made available on the 

23 website maintained under section 3609(b), for prioritizing 

24 and accepting the cloud computing products and services 

25 to be granted a FedRAMP authorization. 


pbinns on DSKJLVW7X2PROD with $$_JOB
40 

•S 3099 RS

1 ‘‘§ 3611. Independent assessment 

2 ‘‘The Administrator may determine whether 

3 FedRAMP may use an independent assessment service to 

4 analyze, validate, and attest to the quality and compliance 

5 of security assessment materials provided by cloud service 

6 providers during the course of a determination of whether 

7 to use a cloud computing product or service. 

8 ‘‘§ 3612. Declaration of foreign interests 

9 ‘‘(a) IN GENERAL.—An independent assessment service 

10 that performs services described in section 3611 shall annu11 ally submit to the Administrator information relating to 

12 any foreign interest, foreign influence, or foreign control of 

13 the independent assessment service. 

14 ‘‘(b) UPDATES.—Not later than 48 hours after there 

15 is a change in foreign ownership or control of an inde16 pendent assessment service that performs services described 

17 in section 3611, the independent assessment service shall 

18 submit to the Administrator an update to the information 

19 submitted under subsection (a). 

20 ‘‘(c) CERTIFICATION.—The Administrator may require 

21 a representative of an independent assessment service to cer22 tify the accuracy and completeness of any information sub23 mitted under this section. 


pbinns on DSKJLVW7X2PROD with $$_JOB
41 

•S 3099 RS

1 ‘‘§ 3613. Roles and responsibilities of agencies 

2 ‘‘(a) IN GENERAL.—In implementing the requirements 

3 of FedRAMP, the head of each agency shall, consistent with 

4 guidance issued by the Director pursuant to section 3614— 

5 ‘‘(1) promote the use of cloud computing prod6 ucts and services that meet FedRAMP security re7 quirements and other risk-based performance require8 ments as determined by the Director, in consultation 

9 with the Secretary; 

10 ‘‘(2) confirm whether there is a FedRAMP au11 thorization in the secure mechanism provided under 

12 section 3609(a)(8) before beginning the process of 

13 granting a FedRAMP authorization for a cloud com14 puting product or service; 

15 ‘‘(3) to the extent practicable, for any cloud com16 puting product or service the agency seeks to author17 ize that has received a FedRAMP authorization, use 

18 the existing assessments of security controls and mate19 rials within any FedRAMP authorization package for 

20 that cloud computing product or service; and 

21 ‘‘(4) provide to the Director data and informa22 tion required by the Director pursuant to section 

23 3614 to determine how agencies are meeting metrics 

24 established by the Administrator. 

25 ‘‘(b) ATTESTATION.—Upon completing an assessment 

26 or authorization activity with respect to a particular cloud 


pbinns on DSKJLVW7X2PROD with $$_JOB
42 

•S 3099 RS

1 computing product or service, if an agency determines that 

2 the information and data the agency has reviewed under 

3 paragraph (2) or (3) of subsection (a) is wholly or substan4 tially deficient for the purposes of performing an authoriza5 tion of the cloud computing product or service, the head 

6 of the agency shall document as part of the resulting 

7 FedRAMP authorization package the reasons for this deter8 mination. 

9 ‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE

10 REQUIRED.—Upon issuance of an agency authorization to 

11 operate based on a FedRAMP authorization, the head of 

12 the agency shall provide a copy of its authorization to oper13 ate letter and any supplementary information required 

14 pursuant to section 3609(a) to the Administrator. 

15 ‘‘(d) SUBMISSION OF POLICIES REQUIRED.—Not later 

16 than 180 days after the date on which the Director issues 

17 guidance in accordance with section 3614(1), the head of 

18 each agency, acting through the chief information officer of 

19 the agency, shall submit to the Director all agency policies 

20 relating to the authorization of cloud computing products 

21 and services. 

22 ‘‘(e) PRESUMPTION OF ADEQUACY.— 

23 ‘‘(1) IN GENERAL.—The assessment of security 

24 controls and materials within the authorization pack25 age for a FedRAMP authorization shall be presumed 


pbinns on DSKJLVW7X2PROD with $$_JOB
43 

•S 3099 RS

1 adequate for use in an agency authorization to oper2 ate cloud computing products and services. 

3 ‘‘(2) INFORMATION SECURITY REQUIREMENTS.— 

4 The presumption under paragraph (1) does not mod5 ify or alter— 

6 ‘‘(A) the responsibility of any agency to en7 sure compliance with subchapter II of chapter 35 

8 for any cloud computing product or service used 

9 by the agency; or 

10 ‘‘(B) the authority of the head of any agen11 cy to make a determination that there is a de12 monstrable need for additional security require13 ments beyond the security requirements included 

14 in a FedRAMP authorization for a particular 

15 control implementation. 

16 ‘‘§ 3614. Roles and responsibilities of the Office of 

17 Management and Budget 

18 ‘‘The Director shall— 

19 ‘‘(1) in consultation with the Administrator and 

20 the Secretary, issue guidance that— 

21 ‘‘(A) specifies the categories or characteris22 tics of cloud computing products and services 

23 that are within the scope of FedRAMP; 

24 ‘‘(B) includes requirements for agencies to 

25 obtain a FedRAMP authorization when operVerDate Sep 11 2014 00:52 May 25, 2022 Jkt 029200 PO 00000 Frm 00043 Fmt 6652 Sfmt 6203 E:\BILLS\S3099.RS S3099

pbinns on DSKJLVW7X2PROD with $$_JOB
44 

•S 3099 RS

1 ating a cloud computing product or service de2 scribed in subparagraph (A) as a Federal infor3 mation system; and 

4 ‘‘(C) encompasses, to the greatest extent 

5 practicable, all necessary and appropriate cloud 

6 computing products and services; 

7 ‘‘(2) issue guidance describing additional respon8 sibilities of FedRAMP and the FedRAMP Board to 

9 accelerate the adoption of secure cloud computing 

10 products and services by the Federal Government; 

11 ‘‘(3) in consultation with the Administrator, es12 tablish a process to periodically review FedRAMP au13 thorization packages to support the secure authoriza14 tion and reuse of secure cloud products and services; 

15 ‘‘(4) oversee the effectiveness of FedRAMP and 

16 the FedRAMP Board, including the compliance by the 

17 FedRAMP Board with the duties described in section 

18 3610(d); and 

19 ‘‘(5) to the greatest extent practicable, encourage 

20 and promote consistency of the assessment, authoriza21 tion, adoption, and use of secure cloud computing 

22 products and services within and across agencies. 

23 ‘‘§ 3615. Reports to Congress; GAO report 

24 ‘‘(a) REPORTS TO CONGRESS.—Not later than 1 year 

25 after the date of enactment of this section, and annually 


pbinns on DSKJLVW7X2PROD with $$_JOB
45 

•S 3099 RS

1 thereafter, the Director shall submit to the appropriate con2 gressional committees a report that includes the following: 

3 ‘‘(1) During the preceding year, the status, effi4 ciency, and effectiveness of the General Services Ad5 ministration under section 3609 and agencies under 

6 section 3613 and in supporting the speed, effective7 ness, sharing, reuse, and security of authorizations to 

8 operate for secure cloud computing products and serv9 ices. 

10 ‘‘(2) Progress towards meeting the metrics re11 quired under section 3609(d). 

12 ‘‘(3) Data on FedRAMP authorizations. 

13 ‘‘(4) The average length of time to issue 

14 FedRAMP authorizations. 

15 ‘‘(5) The number of FedRAMP authorizations 

16 submitted, issued, and denied for the preceding year. 

17 ‘‘(6) A review of progress made during the pre18 ceding year in advancing automation techniques to 

19 securely automate FedRAMP processes and to accel20 erate reporting under this section. 

21 ‘‘(7) The number and characteristics of author22 ized cloud computing products and services in use at 

23 each agency consistent with guidance provided by the 

24 Director under section 3614. 


pbinns on DSKJLVW7X2PROD with $$_JOB
46 

•S 3099 RS

1 ‘‘(8) A review of FedRAMP measures to ensure 

2 the security of data stored or processed by cloud serv3 ice providers, which may include— 

4 ‘‘(A) geolocation restrictions for provided 

5 products or services; 

6 ‘‘(B) disclosures of foreign elements of sup7 ply chains of acquired products or services; 

8 ‘‘(C) continued disclosures of ownership of 

9 cloud service providers by foreign entities; and 

10 ‘‘(D) encryption for data processed, stored, 

11 or transmitted by cloud service providers. 

12 ‘‘(b) GAO REPORT.—Not later than 180 days after the 

13 date of enactment of this section, the Comptroller General 

14 of the United States shall report to the appropriate congres15 sional committees an assessment of the following: 

16 ‘‘(1) The costs incurred by agencies and cloud 

17 service providers relating to the issuance of FedRAMP 

18 authorizations. 

19 ‘‘(2) The extent to which agencies have processes 

20 in place to continuously monitor the implementation 

21 of cloud computing products and services operating as 

22 Federal information systems. 

23 ‘‘(3) How often and for which categories of prod24 ucts and services agencies use FedRAMP authoriza25 tions. 


pbinns on DSKJLVW7X2PROD with $$_JOB
47 

•S 3099 RS

1 ‘‘(4) The unique costs and potential burdens in2 curred by cloud computing companies that are small 

3 business concerns (as defined in section 3(a) of the 

4 Small Business Act (15 U.S.C. 632(a)) as a part of 

5 the FedRAMP authorization process. 

6 ‘‘§ 3616. Federal Secure Cloud Advisory Committee 

7 ‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 

8 ‘‘(1) ESTABLISHMENT.—There is established a 

9 Federal Secure Cloud Advisory Committee (referred to 

10 in this section as the ‘Committee’) to ensure effective 

11 and ongoing coordination of agency adoption, use, 

12 authorization, monitoring, acquisition, and security 

13 of cloud computing products and services to enable 

14 agency mission and administrative priorities. 

15 ‘‘(2) PURPOSES.—The purposes of the Committee 

16 are the following: 

17 ‘‘(A) To examine the operations of 

18 FedRAMP and determine ways that authoriza19 tion processes can continuously be improved, in20 cluding the following: 

21 ‘‘(i) Measures to increase agency reuse 

22 of FedRAMP authorizations. 

23 ‘‘(ii) Proposed actions that can be 

24 adopted to reduce the burden, confusion, 


pbinns on DSKJLVW7X2PROD with $$_JOB
48 

•S 3099 RS

1 and cost associated with FedRAMP author2 izations for cloud service providers. 

3 ‘‘(iii) Measures to increase the number 

4 of FedRAMP authorizations for cloud com5 puting products and services offered by 

6 small businesses concerns (as defined by sec7 tion 3(a) of the Small Business Act (15 

8 U.S.C. 632(a)). 

9 ‘‘(iv) Proposed actions that can be 

10 adopted to reduce the burden and cost of 

11 FedRAMP authorizations for agencies. 

12 ‘‘(B) Collect information and feedback on 

13 agency compliance with and implementation of 

14 FedRAMP requirements. 

15 ‘‘(C) Serve as a forum that facilitates com16 munication and collaboration among the 

17 FedRAMP stakeholder community. 

18 ‘‘(3) DUTIES.—The duties of the Committee in19 clude providing advice and recommendations to the 

20 Administrator, the FedRAMP Board, and agencies on 

21 technical, financial, programmatic, and operational 

22 matters regarding secure adoption of cloud computing 

23 products and services. 

24 ‘‘(b) MEMBERS.— 


pbinns on DSKJLVW7X2PROD with $$_JOB
49 

•S 3099 RS

1 ‘‘(1) COMPOSITION.—The Committee shall be 

2 comprised of not more than 15 members who are 

3 qualified representatives from the public and private 

4 sectors, appointed by the Administrator, in consulta5 tion with the Director, as follows: 

6 ‘‘(A) The Administrator or the Administra7 tor’s designee, who shall be the Chair of the Com8 mittee. 

9 ‘‘(B) At least 1 representative each from the 

10 Cybersecurity and Infrastructure Security Agen11 cy and the National Institute of Standards and 

12 Technology. 

13 ‘‘(C) At least 2 officials who serve as the 

14 Chief Information Security Officer within an 

15 agency, who shall be required to maintain such 

16 a position throughout the duration of their serv17 ice on the Committee. 

18 ‘‘(D) At least 1 official serving as Chief 

19 Procurement Officer (or equivalent) in an agen20 cy, who shall be required to maintain such a po21 sition throughout the duration of their service on 

22 the Committee. 

23 ‘‘(E) At least 1 individual representing an 

24 independent assessment service. 


pbinns on DSKJLVW7X2PROD with $$_JOB
50 

•S 3099 RS

1 ‘‘(F) At least 5 representatives from unique 

2 businesses that primarily provide cloud com3 puting services or products, including at least 2 

4 representatives from a small business concern (as 

5 defined by section 3(a) of the Small Business Act 

6 (15 U.S.C. 632(a))). 

7 ‘‘(G) At least 2 other representatives of the 

8 Federal Government as the Administrator deter9 mines necessary to provide sufficient balance, in10 sights, or expertise to the Committee. 

11 ‘‘(2) DEADLINE FOR APPOINTMENT.—Each mem12 ber of the Committee shall be appointed not later than 

13 90 days after the date of enactment of this section. 

14 ‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 

15 ‘‘(A) IN GENERAL.—Each non-Federal 

16 member of the Committee shall be appointed for 

17 a term of 3 years, except that the initial terms 

18 for members may be staggered 1-, 2-, or 3-year 

19 terms to establish a rotation in which one-third 

20 of the members are selected each year. Any such 

21 member may be appointed for not more than 2 

22 consecutive terms. 

23 ‘‘(B) VACANCIES.—Any vacancy in the 

24 Committee shall not affect its powers, but shall 

25 be filled in the same manner in which the origiVerDate Sep 11 2014 00:52 May 25, 2022 Jkt 029200 PO 00000 Frm 00050 Fmt 6652 Sfmt 6203 E:\BILLS\S3099.RS S3099

pbinns on DSKJLVW7X2PROD with $$_JOB
51 

•S 3099 RS

1 nal appointment was made. Any member ap2 pointed to fill a vacancy occurring before the ex3 piration of the term for which the member’s 

4 predecessor was appointed shall be appointed 

5 only for the remainder of that term. A member 

6 may serve after the expiration of that member’s 

7 term until a successor has taken office. 

8 ‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 

9 ‘‘(1) MEETINGS.—The Committee shall hold not 

10 fewer than 3 meetings in a calendar year, at such 

11 time and place as determined by the Chair. 

12 ‘‘(2) INITIAL MEETING.—Not later than 120 days 

13 after the date of enactment of this section, the Com14 mittee shall meet and begin the operations of the 

15 Committee. 

16 ‘‘(3) RULES OF PROCEDURE.—The Committee 

17 may establish rules for the conduct of the business of 

18 the Committee if such rules are not inconsistent with 

19 this section or other applicable law. 

20 ‘‘(d) EMPLOYEE STATUS.— 

21 ‘‘(1) IN GENERAL.—A member of the Committee 

22 (other than a member who is appointed to the Com23 mittee in connection with another Federal appoint24 ment) shall not be considered an employee of the Fed25 eral Government by reason of any service as such a 


pbinns on DSKJLVW7X2PROD with $$_JOB
52 

•S 3099 RS

1 member, except for the purposes of section 5703 of 

2 title 5, relating to travel expenses. 

3 ‘‘(2) PAY NOT PERMITTED.—A member of the 

4 Committee covered by paragraph (1) may not receive 

5 pay by reason of service on the Committee. 

6 ‘‘(e) APPLICABILITY TO THE FEDERAL ADVISORY COM7 MITTEE ACT.—Section 14 of the Federal Advisory Com8 mittee Act (5 U.S.C. App.) shall not apply to the Com9 mittee. 

10 ‘‘(f) DETAIL OF EMPLOYEES.—Any Federal Govern11 ment employee may be detailed to the Committee without 

12 reimbursement from the Committee, and such detailee shall 

13 retain the rights, status, and privileges of his or her regular 

14 employment without interruption. 

15 ‘‘(g) POSTAL SERVICES.—The Committee may use the 

16 United States mails in the same manner and under the 

17 same conditions as agencies. 

18 ‘‘(h) REPORTS.— 

19 ‘‘(1) INTERIM REPORTS.—The Committee may 

20 submit to the Administrator and Congress interim re21 ports containing such findings, conclusions, and rec22 ommendations as have been agreed to by the Com23 mittee. 

24 ‘‘(2) ANNUAL REPORTS.—Not later than 540 

25 days after the date of enactment of this section, and 


pbinns on DSKJLVW7X2PROD with $$_JOB
53 

•S 3099 RS

1 annually thereafter, the Committee shall submit to the 

2 Administrator and Congress a report containing such 

3 findings, conclusions, and recommendations as have 

4 been agreed to by the Committee.’’. 

5 (b) TECHNICAL AND CONFORMING AMENDMENT.—The 

6 table of sections for chapter 36 of title 44, United States 

7 Code, is amended by adding at the end the following new 

8 items: 

‘‘3607. Definitions. 

‘‘3608. Federal Risk and Authorization Management Program. 

‘‘3609. Roles and responsibilities of the General Services Administration. 

‘‘3610. FedRAMP Board. 

‘‘3611. Independent assessment. 

‘‘3612. Declaration of foreign interests. 

‘‘3613. Roles and responsibilities of agencies. 

‘‘3614. Roles and responsibilities of the Office of Management and Budget. 

‘‘3615. Reports to Congress; GAO report. 

‘‘3616. Federal Secure Cloud Advisory Committee.’’. 

9 (c) SUNSET.— 

10 (1) IN GENERAL.—Effective on the date that is 

11 5 years after the date of enactment of this Act, chap12 ter 36 of title 44, United States Code, is amended by 

13 striking sections 3607 through 3616. 

14 (2) CONFORMING AMENDMENT.—Effective on the 

15 date that is 5 years after the date of enactment of this 

16 Act, the table of sections for chapter 36 of title 44, 

17 United States Code, is amended by striking the items 

18 relating to sections 3607 through 3616. 

19 (d) RULE OF CONSTRUCTION.—Nothing in this section 

20 or any amendment made by this section shall be construed 


pbinns on DSKJLVW7X2PROD with $$_JOB
54 

•S 3099 RS

1 as altering or impairing the authorities of the Director of 

2 the Office of Management and Budget or the Secretary of 

3 Homeland Security under subchapter II of chapter 35 of 

4 title 44, United States Code. 


pbinns on DSKJLVW7X2PROD with $$_JOB

pbinns on DSKJLVW7X2PROD with $$_JOB
Calendar No. 383 

117TH CONGRESS 

2D SESSION S. 3099 

[Report No. 117–115] 

A BILL 

To amend title 44, United States Code, to establish 

tion, and for other purposes. Program within the General Services Administrathe Federal Risk and Authorization Management 

MAY 24, 2022 

Reported with an amendment 


pbinns on DSKJLVW7X2PROD with $$_JOB