II 

117TH CONGRESS 

1ST SESSION S. 3099 

To amend title 44, United States Code, to establish the Federal Risk and 

Authorization Management Program within the General Services Administration, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

OCTOBER 28, 2021 

Mr. PETERS (for himself, Ms. HASSAN, Mr. HAWLEY, and Mr. DAINES) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To amend title 44, United States Code, to establish the 

Federal Risk and Authorization Management Program 

within the General Services Administration, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Secure Cloud 

5 Improvement and Jobs Act of 2021’’. 

6 SEC. 2. FINDINGS. 

7 Congress finds the following: 


pbinns on DSKJLVW7X2PROD with BILLS
2 

•S 3099 IS

1 (1) Ensuring that the Federal Government can 

2 securely leverage cloud computing products and serv3 ices is key to expediting the modernization of legacy 

4 information technology systems, increasing cyberse5 curity within and across departments and agencies, 

6 and supporting the continued leadership of the 

7 United States in technology innovation and job cre8 ation. 

9 (2) According to independent analysis, as of 

10 calendar year 2019, the size of the cloud computing 

11 market had tripled since 2004, enabling more than 

12 2,000,000 jobs and adding more than 

13 $200,000,000,000 to the gross domestic product of 

14 the United States. 

15 (3) The Federal Government, across multiple 

16 presidential administrations and Congresses, has 

17 continued to support the ability of agencies to move 

18 to the cloud, including through— 

19 (A) President Barack Obama’s ‘‘Cloud 

20 First Strategy’’; 

21 (B) President Donald Trump’s ‘‘Cloud 

22 Smart Strategy’’; 

23 (C) the prioritization of cloud security in 

24 Executive Order 14208 (86 Fed. Reg. 26633; 

25 relating to improving the Nation’s cybersecuVerDate Sep 11 2014 00:26 Oct 29, 2021 Jkt 029200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S3099.IS S3099

pbinns on DSKJLVW7X2PROD with BILLS
3 

•S 3099 IS

1 rity), which was issued by President Joe Biden; 

2 and 

3 (D) more than a decade of appropriations 

4 and authorization legislation that provides 

5 agencies with relevant authorities and appro6 priations to modernize on-premises information 

7 technology systems and more readily adopt 

8 cloud computing products and services. 

9 (4) Since it was created in 2011, the Federal 

10 Risk and Authorization Management Program (re11 ferred to in this section as ‘‘FedRAMP’’) at the 

12 General Services Administration has made steady 

13 and sustained improvements in supporting the se14 cure authorization and reuse of cloud computing 

15 products and services within the Federal Govern16 ment, including by reducing the costs and burdens 

17 on both agencies and cloud companies to quickly and 

18 securely enter the Federal market. 

19 (5) According to data from the General Services 

20 Administration, as of the end of fiscal year 2021, 

21 there were 239 cloud providers with FedRAMP au22 thorizations, and those authorizations had been re23 used more than 2,700 times across various agencies. 

24 (6) Providing a legislative framework for 

25 FedRAMP and new authorities to the General ServVerDate Sep 11 2014 00:26 Oct 29, 2021 Jkt 029200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S3099.IS S3099

pbinns on DSKJLVW7X2PROD with BILLS
4 

•S 3099 IS

1 ices Administration, the Office of Management and 

2 Budget, and Federal agencies will— 

3 (A) improve the speed at which new cloud 

4 computing products and services can be se5 curely authorized; 

6 (B) enhance the ability of agencies to ef7 fectively evaluate FedRAMP authorized pro8 viders for reuse; 

9 (C) reduce the costs and burdens to cloud 

10 providers seeking a FedRAMP authorization; 

11 and 

12 (D) provide for more robust transparency 

13 and dialogue between industry and the Federal 

14 Government to drive stronger adoption of se15 cure cloud capabilities, create jobs, and reduce 

16 wasteful legacy information technology. 

17 SEC. 3. TITLE 44 AMENDMENTS. 

18 (a) AMENDMENT.—Chapter 36 of title 44, United 

19 States Code, is amended by adding at the end the fol20 lowing: 

21 ‘‘§ 3607. Definitions 

22 ‘‘(a) IN GENERAL.—Except as provided under sub23 section (b), the definitions under sections 3502 and 3552 

24 apply to this section through section 3616. 


pbinns on DSKJLVW7X2PROD with BILLS
5 

•S 3099 IS

1 ‘‘(b) ADDITIONAL DEFINITIONS.—In this section 

2 through section 3616: 

3 ‘‘(1) CLOUD COMPUTING.—The term ‘cloud 

4 computing’ has the meaning given the term in Spe5 cial Publication 800–145 of the National Institute of 

6 Standards and Technology. 

7 ‘‘(2) CLOUD SERVICE PROVIDER.—The term 

8 ‘cloud service provider’ means an entity offering 

9 cloud computing products or services to agencies. 

10 ‘‘(3) FEDRAMP.—The term ‘FedRAMP’ 

11 means the Federal Risk and Authorization Manage12 ment Program established under section 3608. 

13 ‘‘(4) FEDRAMP AUTHORIZATION.—The term 

14 ‘FedRAMP authorization’ means a certification that 

15 a cloud computing product or service has— 

16 ‘‘(A) completed a FedRAMP authorization 

17 process, as determined by the Administrator of 

18 General Services; or 

19 ‘‘(B) received a FedRAMP provisional au20 thorization to operate, as determined by the 

21 FedRAMP Board. 

22 ‘‘(5) FEDRAMP AUTHORIZATION PACKAGE.— 

23 The term ‘FedRAMP authorization package’ means 

24 the essential information that can be used by an 

25 agency to determine whether to authorize the operVerDate Sep 11 2014 00:26 Oct 29, 2021 Jkt 029200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S3099.IS S3099

pbinns on DSKJLVW7X2PROD with BILLS
6 

•S 3099 IS

1 ation of an information system or the use of a des2 ignated set of common controls for all cloud com3 puting products and services authorized by 

4 FedRAMP. 

5 ‘‘(6) FEDRAMP BOARD.—The term ‘FedRAMP 

6 Board’ means the board established under section 

7 3610. 

8 ‘‘(7) INDEPENDENT ASSESSMENT ORGANIZA9 TION.—The term ‘independent assessment organiza10 tion’ means a third-party organization accredited by 

11 the Administrator of General Services to undertake 

12 conformity assessments of cloud service providers 

13 and their products or services. 

14 ‘‘(8) SECRETARY.—The term ‘Secretary’ means 

15 the Secretary of Homeland Security. 

16 ‘‘§ 3608. Federal Risk and Authorization Management 

17 Program 

18 ‘‘There is established within the General Services Ad19 ministration the Federal Risk and Authorization Manage20 ment Program. The Administrator of General Services, 

21 subject to section 3613, shall establish a Government-wide 

22 program that provides a standardized, reusable approach 

23 to security assessment and authorization for cloud com24 puting products and services that process unclassified in25 formation used by agencies. 


pbinns on DSKJLVW7X2PROD with BILLS
7 

•S 3099 IS

1 ‘‘§ 3609. Roles and responsibilities of the General 

2 Services Administration 

3 ‘‘(a) ROLES AND RESPONSIBILITIES.—The Adminis4 trator of General Services shall— 

5 ‘‘(1) in consultation with the Secretary, develop, 

6 coordinate, and implement a process to support 

7 agency review, reuse, and standardization, where ap8 propriate, of security assessments of cloud com9 puting products and services, including, as appro10 priate, oversight of continuous monitoring of cloud 

11 computing products and services, pursuant to guid12 ance issued by the Director pursuant to section 

13 3613; 

14 ‘‘(2) establish processes and identify criteria 

15 consistent with guidance issued by the Director 

16 under section 3613 to make a cloud computing prod17 uct or service eligible for a FedRAMP authorization 

18 and validate whether a cloud computing product or 

19 service has a FedRAMP authorization; 

20 ‘‘(3) develop and publish templates, best prac21 tices, technical assistance, and other materials to 

22 support the authorization of cloud computing prod23 ucts and services and increase the speed, effective24 ness, and transparency of the authorization process, 

25 consistent with standards established by the Director 


pbinns on DSKJLVW7X2PROD with BILLS
8 

•S 3099 IS

1 of the National Institute of Standards and Tech2 nology and relevant statutes; 

3 ‘‘(4) grant FedRAMP authorizations to cloud 

4 computing products and services consistent with the 

5 guidance and direction of the FedRAMP Board; 

6 ‘‘(5) establish and maintain a public comment 

7 process for proposed guidance and other FedRAMP 

8 directives that may have a direct impact on cloud 

9 service providers and agencies before the issuance of 

10 such guidance or other FedRAMP directives; 

11 ‘‘(6) coordinate with the FedRAMP Board, the 

12 Director of the Cybersecurity and Infrastructure Se13 curity Agency, and other entities identified by the 

14 Administrator of General Services, with the concur15 rence of the Director and the Secretary, to establish 

16 and regularly update a framework for continuous 

17 monitoring under section 3553; 

18 ‘‘(7) provide a secure mechanism for storing 

19 and sharing necessary data, including FedRAMP 

20 authorization packages, to enable better reuse of 

21 such packages across agencies, including making 

22 available any information and data necessary for 

23 agencies to fulfill the requirements of section 3612; 

24 ‘‘(8) provide regular updates to applicant cloud 

25 service providers on the status of any cloud comVerDate Sep 11 2014 00:26 Oct 29, 2021 Jkt 029200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S3099.IS S3099

pbinns on DSKJLVW7X2PROD with BILLS
9 

•S 3099 IS

1 puting product or service during an assessment 

2 process; 

3 ‘‘(9) regularly review, in consultation with the 

4 FedRAMP Board, the costs associated with the 

5 independent assessment services of the third-party 

6 organizations described in section 3611; 

7 ‘‘(10) support the Federal Secure Cloud Advi8 sory Committee established pursuant to section 

9 3616; and 

10 ‘‘(11) take such other actions as the Adminis11 trator of General Services may determine necessary 

12 to carry out FedRAMP. 

13 ‘‘(b) WEBSITE.— 

14 ‘‘(1) IN GENERAL.—The Administrator of Gen15 eral Services shall maintain a public website to serve 

16 as the authoritative repository for FedRAMP, in17 cluding the timely publication and updates for all 

18 relevant information, guidance, determinations, and 

19 other materials required under subsection (a). 

20 ‘‘(2) CRITERIA AND PROCESS FOR FEDRAMP

21 AUTHORIZATION PRIORITIES.—The Administrator of 

22 General Services shall develop and make publicly 

23 available on the website described in paragraph (1) 

24 the criteria and process for prioritizing and selecting 

25 cloud computing products and services that will reVerDate Sep 11 2014 00:26 Oct 29, 2021 Jkt 029200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S3099.IS S3099

pbinns on DSKJLVW7X2PROD with BILLS
10 

•S 3099 IS

1 ceive a FedRAMP authorization, in consultation 

2 with the FedRAMP Board and the Chief Informa3 tion Officers Council. 

4 ‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 

5 ‘‘(1) IN GENERAL.—The Administrator of Gen6 eral Services, in coordination with the Secretary, 

7 shall assess and evaluate available automation capa8 bilities and procedures to improve the efficiency and 

9 effectiveness of the issuance of FedRAMP authoriza10 tions, including continuous monitoring of cloud com11 puting products and services. 

12 ‘‘(2) MEANS FOR AUTOMATION.—Not later than 

13 1 year after the date of enactment of this section, 

14 and updated regularly thereafter, the Administrator 

15 of General Services shall establish a means for the 

16 automation of security assessments and reviews. 

17 ‘‘(d) METRICS FOR AUTHORIZATION.—The Adminis18 trator of General Services shall establish annual metrics 

19 regarding the time and quality of the assessments nec20 essary for completion of a FedRAMP authorization proc21 ess in a manner that can be consistently tracked over time 

22 in conjunction with the periodic testing and evaluation 

23 process pursuant to section 3554 in a manner that mini24 mizes the agency reporting burden. 


pbinns on DSKJLVW7X2PROD with BILLS
11 

•S 3099 IS

1 ‘‘§ 3610. FedRAMP Board 

2 ‘‘(a) ESTABLISHMENT.—There is established a 

3 FedRAMP Board to provide input and recommendations 

4 to the Administrator of General Services regarding the re5 quirements and guidelines for, and the prioritization of, 

6 security assessments of cloud computing products and 

7 services. 

8 ‘‘(b) MEMBERSHIP.—The FedRAMP Board shall 

9 consist of not more than 7 senior officials or experts from 

10 agencies appointed by the Director, in consultation with 

11 the Administrator of General Services, from each of the 

12 following: 

13 ‘‘(1) The Department of Defense. 

14 ‘‘(2) The Department of Homeland Security. 

15 ‘‘(3) The General Services Administration. 

16 ‘‘(4) Such other agencies as determined by the 

17 Director, in consultation with the Administrator of 

18 General Services. 

19 ‘‘(c) QUALIFICATIONS.—Members of the FedRAMP 

20 Board appointed under subsection (b) shall have technical 

21 expertise in domains relevant to FedRAMP, such as— 

22 ‘‘(1) cloud computing; 

23 ‘‘(2) cybersecurity; 

24 ‘‘(3) privacy; 

25 ‘‘(4) risk management; and 


pbinns on DSKJLVW7X2PROD with BILLS
12 

•S 3099 IS

1 ‘‘(5) other competencies identified by the Direc2 tor to support the secure authorization of cloud serv3 ices and products. 

4 ‘‘(d) DUTIES.—The FedRAMP Board shall— 

5 ‘‘(1) in consultation with the Administrator of 

6 General Services, serve as a resource for best prac7 tices to accelerate the process for obtaining a 

8 FedRAMP authorization; 

9 ‘‘(2) establish and regularly update require10 ments and guidelines for security authorizations of 

11 cloud computing products and services, consistent 

12 with standards established by the Director of the 

13 National Institute of Standards and Technology, to 

14 be used in the determination of FedRAMP author15 izations; 

16 ‘‘(3) monitor and oversee, to the greatest extent 

17 practicable, the processes and procedures by which 

18 agencies determine and validate requirements for a 

19 FedRAMP authorization, including periodic review 

20 of the agency determinations described in section 

21 3612(b); 

22 ‘‘(4) ensure consistency and transparency be23 tween agencies and cloud service providers in a man24 ner that minimizes confusion and engenders trust; 

25 and 


pbinns on DSKJLVW7X2PROD with BILLS
13 

•S 3099 IS

1 ‘‘(5) perform such other roles and responsibil2 ities as the Director may assign, with concurrence 

3 from the Administrator of General Services. 

4 ‘‘(e) DETERMINATIONS OF DEMAND FOR CLOUD

5 COMPUTING PRODUCTS AND SERVICES.—The FedRAMP 

6 Board may consult with the Chief Information Officers 

7 Council to establish a process, which may be made avail8 able on the website maintained under section 3609(b), for 

9 prioritizing and accepting the cloud computing products 

10 and services to be granted a FedRAMP authorization. 

11 ‘‘§ 3611. Independent assessment organizations 

12 ‘‘(a) REQUIREMENTS FOR ACCREDITATION.—The 

13 Administrator of General Services may, consistent with 

14 guidance issued by the Director, determine the require15 ments for accreditation of a third-party organization to 

16 perform independent assessments and other activities that 

17 will improve the overall performance of FedRAMP and re18 duce the cost of FedRAMP authorizations for cloud serv19 ice providers. Such requirements may include developing 

20 or requiring certification programs for individuals em21 ployed by the third-party organization seeking accredita22 tion. 

23 ‘‘(b) CERTIFICATION.—The Administrator of General 

24 Services may accredit any third-party organization that 

25 meets the requirements for accreditation determined 


pbinns on DSKJLVW7X2PROD with BILLS
14 

•S 3099 IS

1 under subsection (a). If accredited pursuant to the re2 quirements determined under subsection (a), a certified 

3 independent assessment organization may assess, validate, 

4 and attest to the quality and compliance of security assess5 ment materials provided by cloud service providers. 

6 ‘‘§ 3612. Roles and responsibilities of agencies 

7 ‘‘(a) IN GENERAL.—In implementing the require8 ments of FedRAMP, the head of each agency shall, con9 sistent with guidance issued by the Director pursuant to 

10 section 3613— 

11 ‘‘(1) promote the use of cloud computing prod12 ucts and services that meet FedRAMP security re13 quirements and other risk-based performance re14 quirements as determined by the Director, in con15 sultation with the Secretary; 

16 ‘‘(2) confirm whether there is a FedRAMP au17 thorization in the secure mechanism provided under 

18 section 3609(a)(7) before beginning the process of 

19 granting a FedRAMP authorization for a cloud com20 puting product or service; 

21 ‘‘(3) to the extent practicable, for any cloud 

22 computing product or service the agency seeks to au23 thorize that has received a FedRAMP authorization, 

24 use the existing assessments of security controls and 


pbinns on DSKJLVW7X2PROD with BILLS
15 

•S 3099 IS

1 materials within the FedRAMP authorization pack2 age; and 

3 ‘‘(4) provide data and information required to 

4 the Director pursuant to section 3613 to determine 

5 how agencies are meeting metrics established by the 

6 Administrator of General Services. 

7 ‘‘(b) ATTESTATION.—Upon completing an assess8 ment or authorization activity with respect to a particular 

9 cloud computing product or service, if an agency deter10 mines that the information and data the agency has re11 viewed under paragraph (2) or (3) of subsection (a) is 

12 wholly or substantially deficient for the purposes of per13 forming an authorization of the cloud computing product 

14 or service, the head of the agency shall document as part 

15 of the resulting FedRAMP authorization package the rea16 sons for this determination. 

17 ‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE

18 REQUIRED.—Upon issuance of an agency authorization to 

19 operate based on a FedRAMP authorization, the head of 

20 the agency shall provide a copy of its authorization to op21 erate letter and any supplementary information required 

22 pursuant to section 3609(a) to the Administrator of Gen23 eral Services. 

24 ‘‘(d) SUBMISSION OF POLICIES REQUIRED.—Not 

25 later than 180 days after the date on which the Director 


pbinns on DSKJLVW7X2PROD with BILLS
16 

•S 3099 IS

1 issues guidance in accordance with section 3613, the head 

2 of each agency, acting through the agency chief informa3 tion officer of the agency, shall submit to the Director all 

4 agency policies relating to the authorization of cloud com5 puting products and services. 

6 ‘‘(e) PRESUMPTION OF ADEQUACY.— 

7 ‘‘(1) IN GENERAL.—The assessment of security 

8 controls and materials within the authorization 

9 package for a FedRAMP authorization shall be pre10 sumed adequate for use in an agency authorization 

11 to operate cloud computing products and services. 

12 ‘‘(2) INFORMATION SECURITY REQUIRE13 MENTS.—The presumption under paragraph (1) 

14 does not modify or alter— 

15 ‘‘(A) the responsibility of any agency to en16 sure compliance with subchapter II of chapter 

17 35 for any cloud computing products or services 

18 used by the agency; or 

19 ‘‘(B) the authority of the head of any 

20 agency to make a determination that there is a 

21 demonstrable need for additional security re22 quirements beyond the security requirements 

23 included in a FedRAMP authorization for a 

24 particular control implementation. 


pbinns on DSKJLVW7X2PROD with BILLS
17 

•S 3099 IS

1 ‘‘§ 3613. Roles and responsibilities of the Office of 

2 Management and Budget 

3 ‘‘(a) ROLES AND RESPONSIBILITIES.—The Director 

4 shall— 

5 ‘‘(1) in consultation with the Administrator of 

6 General Services and the Secretary, issue guidance 

7 that— 

8 ‘‘(A) specifies the categories or characteris9 tics of cloud computing products and services 

10 that are within the scope of FedRAMP; 

11 ‘‘(B) includes requirements for agencies to 

12 obtain a FedRAMP authorization when oper13 ating a cloud computing product or service de14 scribed in subparagraph (A) as a Federal infor15 mation system; and 

16 ‘‘(C) encompasses, to the greatest extent 

17 practicable, all necessary and appropriate cloud 

18 computing products and services; 

19 ‘‘(2) issue guidance describing additional re20 sponsibilities of FedRAMP and the FedRAMP 

21 Board to accelerate the adoption of secure cloud 

22 computing services by the Federal Government; 

23 ‘‘(3) oversee the effectiveness of FedRAMP and 

24 the FedRAMP Board, including the compliance by 

25 the FedRAMP Board with the duties described in 

26 section 3610(d); and 


pbinns on DSKJLVW7X2PROD with BILLS
18 

•S 3099 IS

1 ‘‘(4) to the greatest extent practicable, encour2 age and promote consistency of the assessment, au3 thorization, adoption, and use of cloud computing 

4 products and services within and across agencies. 

5 ‘‘§ 3614. Authorization of appropriations for 

6 FedRAMP 

7 ‘‘There is authorized to be appropriated to the Ad8 ministrator of General Services $20,000,000 for each fis9 cal year for FedRAMP and the FedRAMP Board. 

10 ‘‘§ 3615. Reports to congress; GAO report 

11 ‘‘(a) REPORTS TO CONGRESS.—Not later than 1 year 

12 after the date of enactment of this section, and annually 

13 thereafter, the Director shall submit to the Committee on 

14 Oversight and Reform of the House of Representatives 

15 and the Committee on Homeland Security and Govern16 mental Affairs of the Senate a report that includes the 

17 following: 

18 ‘‘(1) During the preceding year, the status, effi19 ciency, and effectiveness of the General Services Ad20 ministration under section 3609 and agencies under 

21 section 3612 and in supporting the speed, effective22 ness, sharing, reuse, and security of authorizations 

23 to operate for cloud computing products and serv24 ices. 


pbinns on DSKJLVW7X2PROD with BILLS
19 

•S 3099 IS

1 ‘‘(2) Progress towards meeting the metrics re2 quired under section 3609(d). 

3 ‘‘(3) Data on FedRAMP authorizations. 

4 ‘‘(4) The average length of time to issue 

5 FedRAMP authorizations. 

6 ‘‘(5) The number of FedRAMP authorizations 

7 submitted, issued, and denied for the preceding year. 

8 ‘‘(6) A review of progress made during the pre9 ceding year in advancing automation techniques to 

10 securely automate FedRAMP processes and to accel11 erate reporting under this section. 

12 ‘‘(7) The number and characteristics of author13 ized cloud computing products and services in use at 

14 each agency consistent with guidance provided by 

15 the Director under section 3613. 

16 ‘‘(b) GAO REPORT.—Not later than 180 days after 

17 the date of enactment of this section, the Comptroller 

18 General of the United States shall publish a report that 

19 includes an assessment of the following: 

20 ‘‘(1) The costs incurred by agencies and cloud 

21 service providers relating to the issuance of 

22 FedRAMP authorizations. 

23 ‘‘(2) The extent to which agencies have proc24 esses in place to continuously monitor cloud comVerDate Sep 11 2014 00:26 Oct 29, 2021 Jkt 029200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\S3099.IS S3099

pbinns on DSKJLVW7X2PROD with BILLS
20 

•S 3099 IS

1 puting products and services operating as Federal 

2 information systems. 

3 ‘‘(3) How often and for which categories of 

4 products agencies use FedRAMP authorizations. 

5 ‘‘(4) The unique costs and potential burdens in6 curred by cloud computing companies that are small 

7 business concerns (as defined in section 3(a) of the 

8 Small Business Act (15 U.S.C. 632(a))) as a part 

9 of the FedRAMP authorization process. 

10 ‘‘§ 3616. Federal Secure Cloud Advisory Committee 

11 ‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 

12 ‘‘(1) ESTABLISHMENT.—There is established a 

13 Federal Secure Cloud Advisory Committee (referred 

14 to in this section as the ‘Committee’) to ensure ef15 fective and ongoing coordination of agency adoption, 

16 use, authorization, monitoring, acquisition, and secu17 rity of cloud computing products and services to en18 able agency mission and administrative priorities. 

19 ‘‘(2) PURPOSES.—The purposes of the Com20 mittee are the following: 

21 ‘‘(A) To examine the operations of 

22 FedRAMP and determine ways that authoriza23 tion processes can continuously be improved, in24 cluding the following: 


pbinns on DSKJLVW7X2PROD with BILLS
21 

•S 3099 IS

1 ‘‘(i) Measures to increase agency 

2 reuse of FedRAMP authorizations. 

3 ‘‘(ii) Proposed actions that can be 

4 adopted to reduce the burden, confusion, 

5 and cost associated with FedRAMP au6 thorizations for cloud service providers. 

7 ‘‘(iii) Measures to increase the num8 ber of FedRAMP authorizations for cloud 

9 computing services offered by small busi10 nesses concerns (as defined by section 3(a) 

11 of the Small Business Act (15 U.S.C. 

12 632(a))). 

13 ‘‘(iv) Proposed actions that can be 

14 adopted to reduce the burden and cost of 

15 FedRAMP authorizations for agencies. 

16 ‘‘(B) Collect information and feedback on 

17 agency compliance with and implementation of 

18 FedRAMP requirements. 

19 ‘‘(C) Serve as a forum that facilitates com20 munication and collaboration among the 

21 FedRAMP stakeholder community. 

22 ‘‘(3) DUTIES.—The duties of the Committee in23 clude providing advice and recommendations to the 

24 Administrator of General Services, the FedRAMP 

25 Board, and agencies on technical, financial, proVerDate Sep 11 2014 00:26 Oct 29, 2021 Jkt 029200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6201 E:\BILLS\S3099.IS S3099

pbinns on DSKJLVW7X2PROD with BILLS
22 

•S 3099 IS

1 grammatic, and operational matters regarding se2 cure adoption of cloud computing products and serv3 ices. 

4 ‘‘(b) MEMBERS.— 

5 ‘‘(1) COMPOSITION.—The Committee shall be 

6 comprised of not more than 15 members who are 

7 qualified representatives from the public and private 

8 sectors, appointed by the Administrator of General 

9 Services, in consultation with the Director, as fol10 lows: 

11 ‘‘(A) The Administrator of General Serv12 ices or the Administrator of General Services’s 

13 designee, who shall be the Chair of the Com14 mittee. 

15 ‘‘(B) At least 1 representative each from 

16 the Cybersecurity and Infrastructure Security 

17 Agency and the National Institute of Standards 

18 and Technology. 

19 ‘‘(C) At least 2 officials who serve as the 

20 Chief Information Security Officer within an 

21 agency, who shall be required to maintain such 

22 a position throughout the duration of their serv23 ice on the Committee. 

24 ‘‘(D) At least 1 official serving as Chief 

25 Procurement Officer (or equivalent) in an agenVerDate Sep 11 2014 00:26 Oct 29, 2021 Jkt 029200 PO 00000 Frm 00022 Fmt 6652 Sfmt 6201 E:\BILLS\S3099.IS S3099

pbinns on DSKJLVW7X2PROD with BILLS
23 

•S 3099 IS

1 cy, who shall be required to maintain such a po2 sition throughout the duration of their service 

3 on the Committee. 

4 ‘‘(E) At least 1 individual representing an 

5 independent assessment organization. 

6 ‘‘(F) No fewer than 5 representatives from 

7 unique businesses that primarily provide cloud 

8 computing services or products, including at 

9 least two representatives from a small business 

10 concern (as defined by section 3(a) of the Small 

11 Business Act (15 U.S.C. 632(a))). 

12 ‘‘(G) At least 2 other representatives of the 

13 Federal Government as the Administrator of 

14 General Services determines necessary to pro15 vide sufficient balance, insights, or expertise to 

16 the Committee. 

17 ‘‘(2) DEADLINE FOR APPOINTMENT.—Each 

18 member of the Committee shall be appointed not 

19 later than 90 days after the date of enactment of 

20 this section. 

21 ‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 

22 ‘‘(A) IN GENERAL.—Each non-Federal 

23 member of the Committee shall be appointed 

24 for a term of 3 years, except that the initial 

25 terms for members may be staggered 1-, 2-, or 


pbinns on DSKJLVW7X2PROD with BILLS
24 

•S 3099 IS

1 3-year terms to establish a rotation in which 

2 one-third of the members are selected each 

3 year. Any such member may be appointed for 

4 not more than 2 consecutive terms. 

5 ‘‘(B) VACANCIES.—Any vacancy in the 

6 Committee shall not affect its powers, but shall 

7 be filled in the same manner in which the origi8 nal appointment was made. Any member ap9 pointed to fill a vacancy occurring before the 

10 expiration of the term for which the member’s 

11 predecessor was appointed shall be appointed 

12 only for the remainder of that term. A member 

13 may serve after the expiration of that member’s 

14 term until a successor has taken office. 

15 ‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 

16 ‘‘(1) MEETINGS.—The Committee shall hold 

17 not fewer than 3 meetings in a calendar year, at 

18 such time and place as determined by the Chair. 

19 ‘‘(2) INITIAL MEETING.—Not later than 120 

20 days after the date of enactment of this section, the 

21 Committee shall meet and begin the operations of 

22 the Committee. 

23 ‘‘(3) RULES OF PROCEDURE.—The Committee 

24 may establish rules for the conduct of the business 


pbinns on DSKJLVW7X2PROD with BILLS
25 

•S 3099 IS

1 of the Committee if such rules are not inconsistent 

2 with this section or other applicable law. 

3 ‘‘(d) EMPLOYEE STATUS.— 

4 ‘‘(1) IN GENERAL.—A member of the Com5 mittee (other than a member who is appointed to the 

6 Committee in connection with another Federal ap7 pointment) shall not be considered an employee of 

8 the Federal Government by reason of any service as 

9 such a member, except for the purposes of section 

10 5703 of title 5, relating to travel expenses. 

11 ‘‘(2) PAY NOT PERMITTED.—A member of the 

12 Committee covered by paragraph (1) may not receive 

13 pay by reason of service on the Committee. 

14 ‘‘(e) APPLICABILITY TO THE FEDERAL ADVISORY

15 COMMITTEE ACT.—Section 14 of the Federal Advisory 

16 Committee Act (5 U.S.C. App.) shall not apply to the 

17 Committee. 

18 ‘‘(f) DETAIL OF EMPLOYEES.—Any Federal Govern19 ment employee may be detailed to the Committee without 

20 reimbursement from the Committee, and such detailee 

21 shall retain the rights, status, and privileges of his or her 

22 regular employment without interruption. 

23 ‘‘(g) POSTAL SERVICES.—The Committee may use 

24 the United States mails in the same manner and under 

25 the same conditions as agencies. 


pbinns on DSKJLVW7X2PROD with BILLS
26 

•S 3099 IS

1 ‘‘(h) REPORTS.— 

2 ‘‘(1) INTERIM REPORTS.—The Committee may 

3 submit to the Administrator of General Services and 

4 Congress interim reports containing such findings, 

5 conclusions, and recommendations as have been 

6 agreed to by the Committee. 

7 ‘‘(2) ANNUAL REPORTS.—Not later than 540 

8 days after the date of enactment of this section, and 

9 annually thereafter, the Committee shall submit to 

10 the Administrator of General Services and Congress 

11 a final report containing such findings, conclusions, 

12 and recommendations as have been agreed to by the 

13 Committee.’’. 

14 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

15 The table of sections for chapter 36 of title 44, United 

16 States Code, is amended by adding at the end the fol17 lowing new items: 

‘‘3607. Definitions. 

‘‘3608. Federal Risk and Authorization Management Program. 

‘‘3609. Roles and responsibilities of the General Services Administration. 

‘‘3610. FedRAMP Board. 

‘‘3611. Independent assessment organizations. 

‘‘3612. Roles and responsibilities of agencies. 

‘‘3613. Roles and responsibilities of the Office of Management and Budget. 

‘‘3614. Authorization of appropriations for FedRAMP. 

‘‘3615. Reports to congress; GAO report. 

‘‘3616. Federal Secure Cloud Advisory Committee.’’. 

18 (c) SUNSET.— 

19 (1) IN GENERAL.—Effective on the date that is 

20 5 years after the date of enactment of this Act, 


pbinns on DSKJLVW7X2PROD with BILLS
27 

•S 3099 IS

1 chapter 36 of title 44, United States Code, is 

2 amended by striking sections 3607 through 3616. 

3 (2) CONFORMING AMENDMENT.—Effective on 

4 the date that is 5 years after the date of enactment 

5 of this Act, the table of sections for chapter 36 of 

6 title 44, United States Code, is amended by striking 

7 the items relating to sections 3607 through 3616. 

8 (d) RULE OF CONSTRUCTION.—Nothing in this sec9 tion or any amendment made by this section shall be con10 strued as altering or impairing the authorities of the Di11 rector of the Office of Management and Budget or the 

12 Secretary of Homeland Security under subchapter II of 

13 chapter 35 of title 44, United States Code. 

Æ 


pbinns on DSKJLVW7X2PROD with BILLS