IB 

Union Calendar No. 315 

116TH CONGRESS 

2D SESSION H. R. 3941 

[Report No. 116–391] 

To enhance the innovation, security, and availability of cloud computing 

services used in the Federal Government by establishing the Federal 

Risk and Authorization Management Program within the General Services Administration and by establishing a risk management, authorization, and continuous monitoring process to enable the Federal Government to leverage cloud computing services using a risk-based approach 

consistent with the Federal Information Security Modernization Act of 

2014 and cloud-based operations, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 24, 2019 

Mr. CONNOLLY (for himself and Mr. MEADOWS) introduced the following bill; 

which was referred to the Committee on Oversight and Reform 

FEBRUARY 5, 2020 

Additional sponsor: Mr. FITZPATRICK

FEBRUARY 5, 2020 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on July 24, 2019] 


kjohnson on DSK79L0C42PROD with BILLS
2 

•HR 3941 RH

A BILL 

To enhance the innovation, security, and availability of cloud 

computing services used in the Federal Government by 

establishing the Federal Risk and Authorization Management Program within the General Services Administration and by establishing a risk management, authorization, and continuous monitoring process to enable the 

Federal Government to leverage cloud computing services 

using a risk-based approach consistent with the Federal 

Information Security Modernization Act of 2014 and 

cloud-based operations, and for other purposes. 


kjohnson on DSK79L0C42PROD with BILLS
3 

•HR 3941 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Risk and Au5 thorization Management Program Authorization Act of 

6 2019’’ or the ‘‘FedRAMP Authorization Act’’. 

7 SEC. 2. CODIFICATION OF THE FEDRAMP PROGRAM. 

8 (a) AMENDMENT.—Chapter 36 of title 44, United 

9 States Code, is amended by adding at the end the following 

10 new sections: 

11 ‘‘§ 3607. Federal Risk and Authorization Management 

12 Program 

13 ‘‘(a) ESTABLISHMENT.—There is established within 

14 the General Services Administration the Federal Risk and 

15 Authorization Management Program. The Administrator of 

16 General Services, in accordance with the guidelines estab17 lished pursuant to section 3612, shall establish a govern18 mentwide program that provides the authoritative stand19 ardized approach to security assessment and authorization 

20 for cloud computing products and services that process un21 classified information used by agencies. 

22 ‘‘(b) COMPONENTS OF FEDRAMP.—The Joint Author23 ization Board and the FedRAMP Program Management 

24 Office are established as components of FedRAMP. 


kjohnson on DSK79L0C42PROD with BILLS
4 

•HR 3941 RH

1 ‘‘§ 3608. FedRAMP Program Management Office 

2 ‘‘(a) GSA DUTIES.— 

3 ‘‘(1) ROLES AND RESPONSIBILITIES.—The Ad4 ministrator of General Services shall— 

5 ‘‘(A) determine the categories and character6 istics of cloud computing information technology 

7 goods or services that are within the jurisdiction 

8 of FedRAMP and that require FedRAMP au9 thorization from the Joint Authorization Board 

10 or the FedRAMP Program Management Office; 

11 ‘‘(B) develop, coordinate, and implement a 

12 process for the FedRAMP Program Management 

13 Office, the Joint Authorization Board, and agen14 cies to review security assessments of cloud com15 puting services pursuant to subsections (b) and 

16 (c) of section 3611, and appropriate oversight of 

17 continuous monitoring of cloud computing serv18 ices; and 

19 ‘‘(C) ensure the continuous improvement of 

20 FedRAMP. 

21 ‘‘(2) IMPLEMENTATION.—The Administrator 

22 shall oversee the implementation of FedRAMP, in23 cluding— 

24 ‘‘(A) appointing a Program Director to 

25 oversee the FedRAMP Program Management Of26 fice; 


kjohnson on DSK79L0C42PROD with BILLS
5 

•HR 3941 RH

1 ‘‘(B) hiring professional staff as may be 

2 necessary for the effective operation of the 

3 FedRAMP Program Management Office, and 

4 such other activities as are essential to properly 

5 perform critical functions; 

6 ‘‘(C) entering into interagency agreements 

7 to detail personnel on a reimbursable or non-re8 imbursable basis to assist the FedRAMP Pro9 gram Management Office and the Joint Author10 ization Board in discharging the responsibilities 

11 of the Office under this section; and 

12 ‘‘(D) such other actions as the Adminis13 trator may determine necessary to carry out this 

14 section. 

15 ‘‘(b) DUTIES.—The FedRAMP Program Management 

16 Office shall have the following duties: 

17 ‘‘(1) Provide guidance to independent assessment 

18 organizations, validate the independent assessments, 

19 and apply the requirements and guidelines adopted in 

20 section 3609(c)(5). 

21 ‘‘(2) Oversee and issue guidelines regarding the 

22 qualifications, roles, and responsibilities of inde23 pendent assessment organizations. 

24 ‘‘(3) Develop templates and other materials to 

25 support the Joint Authorization Board and agencies 


kjohnson on DSK79L0C42PROD with BILLS
6 

•HR 3941 RH

1 in the authorization of cloud computing services to 

2 increase the speed, effectiveness, and transparency of 

3 the authorization process, consistent with standards 

4 defined by the National Institute of Standards and 

5 Technology. 

6 ‘‘(4) Establish and maintain a public comment 

7 process for proposed guidance before the issuance of 

8 such guidance by FedRAMP. 

9 ‘‘(5) Issue FedRAMP authorization for any au10 thorizations to operate issued by an agency that meets 

11 the requirements and guidelines described in para12 graph (1). 

13 ‘‘(6) Establish frameworks for agencies to use au14 thorization packages processed by the FedRAMP Pro15 gram Management Office and Joint Authorization 

16 Board. 

17 ‘‘(7) Coordinate with the Secretary of Defense 

18 and the Secretary of Homeland Security to establish 

19 a framework for continuous monitoring and reporting 

20 required of agencies pursuant to section 3553. 

21 ‘‘(8) Establish a centralized and secure reposi22 tory to collect and share necessary data, including se23 curity authorization packages, from the Joint Author24 ization Board and agencies to enable better sharing 

25 and reuse to such packages across agencies. 


kjohnson on DSK79L0C42PROD with BILLS
7 

•HR 3941 RH

1 ‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 

2 ‘‘(1) IN GENERAL.—The FedRAMP Program 

3 Management Office shall assess and evaluate available 

4 automation capabilities and procedures to improve 

5 the efficiency and effectiveness of the issuance of pro6 visional authorizations to operate issued by the Joint 

7 Authorization Board and FedRAMP authorizations, 

8 including continuous monitoring of cloud environ9 ments and among cloud environments. 

10 ‘‘(2) MEANS FOR AUTOMATION.—Not later than 

11 1 year after the date of the enactment of this section 

12 and updated annually thereafter, the FedRAMP Pro13 gram Management Office shall establish a means for 

14 the automation of security assessments and reviews. 

15 ‘‘(d) METRICS FOR AUTHORIZATION.—The FedRAMP 

16 Program Management Office shall establish annual metrics 

17 regarding the time and quality of the assessments necessary 

18 for completion of a FedRAMP authorization process in a 

19 manner that can be consistently tracked over time in con20 junction with the periodic testing and evaluation process 

21 pursuant to section 3554 in a manner that minimizes the 

22 agency reporting burden. 

23 ‘‘§ 3609. Joint Authorization Board 

24 ‘‘(a) ESTABLISHMENT.—There is established the Joint 

25 Authorization Board which shall consist of cloud computing 


kjohnson on DSK79L0C42PROD with BILLS
8 

•HR 3941 RH

1 experts, appointed by the Director in consultation with the 

2 Administrator, from each of the following: 

3 ‘‘(1) The Department of Defense. 

4 ‘‘(2) The Department of Homeland Security. 

5 ‘‘(3) The General Services Administration. 

6 ‘‘(4) Such other agencies as determined by the 

7 Director, in consultation with the Administrator. 

8 ‘‘(b) ISSUANCE OF PROVISIONAL AUTHORIZATIONS TO

9 OPERATE.—The Joint Authorization Board shall conduct 

10 security assessments of cloud computing services and issue 

11 provisional authorizations to operate to cloud service pro12 viders that meet FedRAMP security guidelines set forth in 

13 section 3608(b)(1). 

14 ‘‘(c) DUTIES.—The Joint Authorization Board shall— 

15 ‘‘(1) develop and make publicly available on a 

16 website, determined by the Administrator, criteria for 

17 prioritizing and selecting cloud computing services to 

18 be assessed by the Joint Authorization Board; 

19 ‘‘(2) provide regular updates on the status of any 

20 cloud computing service during the assessment and 

21 authorization process of the Joint Authorization 

22 Board; 

23 ‘‘(3) review and validate cloud computing serv24 ices and independent assessment organization security 

25 packages or any documentation determined to be necVerDate Sep 11 2014 21:44 Feb 05, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\H3941.RH H3941

kjohnson on DSK79L0C42PROD with BILLS
9 

•HR 3941 RH

1 essary by the Joint Authorization Board to evaluate 

2 the system security of a cloud computing service; 

3 ‘‘(4) in consultation with the FedRAMP Pro4 gram Management Office, serve as a resource for best 

5 practices to accelerate the FedRAMP process; 

6 ‘‘(5) establish requirements and guidelines for se7 curity assessments of cloud computing services, con8 sistent with standards defined by the National Insti9 tute of Standards and Technology, to be used by the 

10 Joint Authorization Board and agencies; 

11 ‘‘(6) perform such other roles and responsibilities 

12 as the Administrator may assign, in consultation 

13 with the FedRAMP Program Management Office and 

14 members of the Joint Authorization Board; and 

15 ‘‘(7) establish metrics and goals for reviews and 

16 activities associated with issuing provisional author17 izations to operate and provide to the FedRAMP Pro18 gram Management Office. 

19 ‘‘(d) DETERMINATIONS OF DEMAND FOR CLOUD COM20 PUTING SERVICES.—The Joint Authorization Board shall 

21 consult with the Chief Information Officers Council estab22 lished in section 3603 to establish a process for prioritizing 

23 and accepting the cloud computing services to be granted 

24 a provisional authorization to operate through the Joint 


kjohnson on DSK79L0C42PROD with BILLS
10 

•HR 3941 RH

1 Authorization Board, which shall be made available on a 

2 public website. 

3 ‘‘(e) DETAIL OF PERSONNEL.—To assist the Joint Au4 thorization Board in discharging the responsibilities under 

5 this section, personnel of agencies may be detailed to the 

6 Joint Authorization Board for the performance of duties de7 scribed under subsection (c). 

8 ‘‘§ 3610. Independent assessment organizations 

9 ‘‘(a) REQUIREMENTS FOR ACCREDITATION.—The 

10 Joint Authorization Board shall determine the requirements 

11 for certification of independent assessment organizations 

12 pursuant to section 3609. Such requirements may include 

13 developing or requiring certification programs for individ14 uals employed by the independent assessment organizations 

15 who lead FedRAMP assessment teams. 

16 ‘‘(b) ASSESSMENT.—Accredited independent assess17 ment organizations may assess, validate, and attest to the 

18 quality and compliance of security assessment materials 

19 provided by cloud service providers. 

20 ‘‘§ 3611. Roles and responsibilities of agencies 

21 ‘‘(a) IN GENERAL.—In implementing the requirements 

22 of FedRAMP, the head of each agency shall, consistent with 

23 guidance issued by the Director pursuant to section 3612— 

24 ‘‘(1) create policies to ensure cloud computing 

25 services used by the agency meet FedRAMP security 


kjohnson on DSK79L0C42PROD with BILLS
11 

•HR 3941 RH

1 requirements and other risk-based performance re2 quirements as defined by the Director; 

3 ‘‘(2) issue agency-specific authorizations to oper4 ate for cloud computing services in compliance with 

5 section 3554; 

6 ‘‘(3) confirm whether there is a provisional au7 thorization to operate in the cloud security repository 

8 established under section 3608(b)(10) issued by the 

9 Joint Authorization Board or a FedRAMP authoriza10 tion issued by the FedRAMP Program Management 

11 Office before beginning an agency authorization for a 

12 cloud computing product or service; 

13 ‘‘(4) to the extent practicable, for any cloud com14 puting product or service the agency seeks to author15 ize that has received either a provisional authoriza16 tion to operate by the Joint Authorization Board or 

17 a FedRAMP authorization by the FedRAMP Program 

18 Management Office, use the existing assessments of se19 curity controls and materials within the authoriza20 tion package; and 

21 ‘‘(5) provide data and information required to 

22 the Director pursuant to section 3612 to determine 

23 how agencies are meeting metrics as defined by the 

24 FedRAMP Program Management Office. 


kjohnson on DSK79L0C42PROD with BILLS
12 

•HR 3941 RH

1 ‘‘(b) SUBMISSION OF POLICIES REQUIRED.—Not later 

2 than 6 months after the date of the enactment of this section, 

3 the head of each agency shall submit to the Director the 

4 policies created pursuant to subsection (a)(1) for review and 

5 approval. 

6 ‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE

7 REQUIRED.—Upon issuance of an authorization to operate 

8 or a provisional authorization to operate issued by an agen9 cy, the head of each agency shall provide a copy of the au10 thorization to operate letter and any supplementary infor11 mation required pursuant to section 3608(b) to the 

12 FedRAMP Program Management Office. 

13 ‘‘(d) PRESUMPTION OF ADEQUACY.— 

14 ‘‘(1) IN GENERAL.—The assessment of security 

15 controls and materials within the authorization pack16 age for provisional authorizations to operate issued 

17 by the Joint Authorization Board and agency author18 izations to operate that receive FedRAMP authoriza19 tion from the FedRAMP Program Management Office 

20 shall be presumed adequate for use in agency author21 izations of cloud computing products and services. 

22 ‘‘(2) INFORMATION SECURITY REQUIREMENTS.— 

23 The presumption under paragraph (1) does not mod24 ify or alter the responsibility of any agency to ensure 

25 compliance with subchapter II of chapter 35 for any 


kjohnson on DSK79L0C42PROD with BILLS
13 

•HR 3941 RH

1 cloud computing products or services used by the 

2 agency. 

3 ‘‘§ 3612. Roles and responsibilities of the Office of 

4 Management and Budget 

5 ‘‘The Director shall have the following duties: 

6 ‘‘(1) Issue guidance to ensure that an agency 

7 does not operate a Federal Government cloud com8 puting service using Government data without an au9 thorization to operate issued by the agency that meets 

10 the requirements of subchapter II of chapter 35 and 

11 FedRAMP. 

12 ‘‘(2) Ensure agencies are in compliance with 

13 any guidance or other requirements issued related to 

14 FedRAMP. 

15 ‘‘(3) Review, analyze, and update guidance on 

16 the adoption, security, and use of cloud computing 

17 services used by agencies. 

18 ‘‘(4) Ensure the Joint Authorization Board is in 

19 compliance with section 3609(c). 

20 ‘‘(5) Adjudicate disagreements between the Joint 

21 Authorization Board and cloud service providers seek22 ing a provisional authorization to operate through the 

23 Joint Authorization Board. 

24 ‘‘(6) Promulgate regulations on the role of 

25 FedRAMP authorization in agency acquisition of 


kjohnson on DSK79L0C42PROD with BILLS
14 

•HR 3941 RH

1 cloud computing products and services that process 

2 unclassified information. 

3 ‘‘§ 3613. Authorization of appropriations for 

4 FEDRAMP 

5 ‘‘There is authorized to be appropriated $20,000,000 

6 each year for the FedRAMP Program Management Office 

7 and the Joint Authorization Board. 

8 ‘‘§ 3614. Reports to Congress 

9 ‘‘Not later than 12 months after the date of the enact10 ment of this section, and annually thereafter, the Director 

11 shall submit to the Committee on Oversight and Reform of 

12 the House of Representatives and the Committee on Home13 land Security and Governmental Affairs of the Senate a 

14 report that includes the following: 

15 ‘‘(1) The status, efficiency, and effectiveness of 

16 FedRAMP Program Management Office and agencies 

17 during the preceding year in supporting the speed, ef18 fectiveness, sharing, reuse, and security of authoriza19 tions to operate for cloud computing products and 

20 services, including progress towards meeting the 

21 metrics adopted by the FedRAMP Program Manage22 ment Office pursuant to section 3608(d) and the Joint 

23 Authorization Board pursuant to section 3609(c)(5). 

24 ‘‘(2) Data on agency use of provisional author25 izations to operate issued by the Joint Authorization 


kjohnson on DSK79L0C42PROD with BILLS
15 

•HR 3941 RH

1 Board and agency sponsored authorizations that re2 ceive FedRAMP authorization by the FedRAMP Pro3 gram Management Office. 

4 ‘‘(3) The length of time for the Joint Authoriza5 tion Board to review applications for and issue provi6 sional authorizations to operate. 

7 ‘‘(4) The length of time for the FedRAMP Pro8 gram Management Office to review agency applica9 tions for and issue FedRAMP authorization. 

10 ‘‘(5) The number of provisional authorizations to 

11 operate issued by the Joint Authorization Board and 

12 FedRAMP authorizations issued by the FedRAMP 

13 Program Management Office for the previous year. 

14 ‘‘(6) A review of progress made during the pre15 ceding year in advancing automation techniques to 

16 securely automate FedRAMP processes and to accel17 erate reporting as described in this section. 

18 ‘‘(7) The number and characteristics of author19 ized cloud computing services in use at each agency 

20 consistent with guidance provided by the Director in 

21 section 3612. 

22 ‘‘§ 3615. Federal Secure Cloud Advisory Committee 

23 ‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 

24 ‘‘(1) ESTABLISHMENT.—There is established a 

25 Federal Secure Cloud Advisory Committee (referred to 


kjohnson on DSK79L0C42PROD with BILLS
16 

•HR 3941 RH

1 in this section as the ‘Committee’) to ensure effective 

2 and ongoing coordination of agency adoption, use, 

3 authorization, monitoring, acquisition, and security 

4 of cloud computing products and services to enable 

5 agency mission and administrative priorities. 

6 ‘‘(2) PURPOSES.—The purposes of the Committee 

7 are the following: 

8 ‘‘(A) To examine the operations of 

9 FedRAMP and determine ways that authoriza10 tion processes can continuously be improved, in11 cluding the following: 

12 ‘‘(i) Measures to increase agency re-use 

13 of provisional authorizations to operate 

14 issued by the Joint Authorization Board. 

15 ‘‘(ii) Proposed actions that can be 

16 adopted to reduce the cost of provisional au17 thorizations to operate and FedRAMP au18 thorizations for cloud service providers. 

19 ‘‘(iii) Measures to increase the number 

20 of provisional authorizations to operate or 

21 FedRAMP authorizations for cloud com22 puting services offered by small businesses 

23 (as defined by section 3(a) of the Small 

24 Business Act (15 U.S.C. 632(a)). 


kjohnson on DSK79L0C42PROD with BILLS
17 

•HR 3941 RH

1 ‘‘(B) Collect information and feedback on 

2 agency compliance with and implementation of 

3 FedRAMP requirements. 

4 ‘‘(C) Serve as a forum that facilitates com5 munication and collaboration among the 

6 FedRAMP stakeholder community. 

7 ‘‘(3) DUTIES.—The duties of the Committee are, 

8 at a minimum, the following: 

9 ‘‘(A) Provide advice and recommendations 

10 to the Administrator, the Joint Authorization 

11 Board, and to agencies on technical, financial, 

12 programmatic, and operational matters regard13 ing secure adoption of cloud computing services. 

14 ‘‘(B) Submit reports as required. 

15 ‘‘(b) MEMBERS.— 

16 ‘‘(1) COMPOSITION.—The Committee shall be 

17 comprised of not more than 15 members who are 

18 qualified representatives from the public and private 

19 sectors, appointed by the Administrator, in consulta20 tion with the Administrator of the Office of Electronic 

21 Government, as follows: 

22 ‘‘(A) The Administrator or the Administra23 tor’s designee, who shall be the Chair of the Com24 mittee. 


kjohnson on DSK79L0C42PROD with BILLS
18 

•HR 3941 RH

1 ‘‘(B) At least 1 representative each from the 

2 Cybersecurity and Infrastructure Security Agen3 cy and the National Institute of Standards and 

4 Technology. 

5 ‘‘(C) At least 2 officials who serve as the 

6 Chief Information Security Officer within an 

7 agency, who shall be required to maintain such 

8 a position throughout the duration of their serv9 ice on the Committee. 

10 ‘‘(D) At least 1 official serving as Chief 

11 Procurement Officer (or equivalent) in an agen12 cy, who shall be required to maintain such a po13 sition throughout the duration of their service on 

14 the Committee. 

15 ‘‘(E) At least 1 individual representing an 

16 independent assessment organization. 

17 ‘‘(F) No fewer than 5 representatives from 

18 unique businesses that primarily provide cloud 

19 computing services or products, including at 

20 least 2 representatives from a small business (as 

21 defined by section 3(a) of the Small Business Act 

22 (15 U.S.C. 632(a))). 

23 ‘‘(G) At least 2 other government represent24 atives as the Administrator determines to be necVerDate Sep 11 2014 21:44 Feb 05, 2020 Jkt 099200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6203 E:\BILLS\H3941.RH H3941

kjohnson on DSK79L0C42PROD with BILLS
19 

•HR 3941 RH

1 essary to provide sufficient balance, insights, or 

2 expertise to the Committee. 

3 ‘‘(2) DEADLINE FOR APPOINTMENT.—Each mem4 ber of the Committee shall be appointed not later than 

5 30 days after the date of the enactment of this Act. 

6 ‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 

7 ‘‘(A) IN GENERAL.—Each non-Federal 

8 member of the Committee shall be appointed for 

9 a term of 3 years, except that the initial terms 

10 for members may be staggered 1, 2, or 3 year 

11 terms to establish a rotation in which one-third 

12 of the members are selected each year. Any such 

13 member may be appointed for not more than 2 

14 consecutive terms. 

15 ‘‘(B) VACANCIES.—Any vacancy in the 

16 Committee shall not affect its powers, but shall 

17 be filled in the same manner in which the origi18 nal appointment was made. Any member ap19 pointed to fill a vacancy occurring before the ex20 piration of the term for which the member’s 

21 predecessor was appointed shall be appointed 

22 only for the remainder of that term. A member 

23 may serve after the expiration of that member’s 

24 term until a successor has taken office. 

25 ‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 


kjohnson on DSK79L0C42PROD with BILLS
20 

•HR 3941 RH

1 ‘‘(1) MEETINGS.—The Committee shall hold not 

2 fewer than 3 meetings in a calendar year, at such 

3 time and place as determined by the Chair. 

4 ‘‘(2) INITIAL MEETING.—Not later than 120 days 

5 after the date of the enactment of this section, the 

6 Committee shall meet and begin the operations of the 

7 Committee. 

8 ‘‘(3) RULES OF PROCEDURE.—The Committee 

9 may establish rules for the conduct of the business of 

10 the Committee, if such rules are not inconsistent with 

11 this section or other applicable law. 

12 ‘‘(d) EMPLOYEE STATUS.— 

13 ‘‘(1) IN GENERAL.—A member of the Committee 

14 (other than a member who is appointed to the Com15 mittee in connection with another Federal appoint16 ment) shall not be considered an employee of the Fed17 eral Government by reason of any service as such a 

18 member, except for the purposes of section 5703 of 

19 title 5, relating to travel expenses. 

20 ‘‘(2) PAY NOT PERMITTED.—A member of the 

21 Committee covered by paragraph (1) may not receive 

22 pay by reason of service on the panel. 

23 ‘‘(e) APPLICABILITY TO THE FEDERAL ADVISORY COM24 MITTEE ACT.—Notwithstanding any other provision of law, 

25 the Federal Advisory Committee Act (5 U.S.C. App.) shall 


kjohnson on DSK79L0C42PROD with BILLS
21 

•HR 3941 RH

1 apply to the Committee, except that section 14 of such Act 

2 shall not apply. 

3 ‘‘(f) HEARINGS AND EVIDENCE.—The Committee, or 

4 on the authority of the Committee, any subcommittee, may, 

5 for the purposes of carrying out this section, hold hearings, 

6 sit and act at such times and places, take testimony, receive 

7 evidence, and administer oaths. 

8 ‘‘(g) CONTRACTING.—The Committee, may, to such ex9 tent and in such amounts as are provided in appropriation 

10 Acts, enter into contracts to enable the Committee to dis11 charge its duties under this section. 

12 ‘‘(h) INFORMATION FROM FEDERAL AGENCIES.— 

13 ‘‘(1) IN GENERAL.—The Committee is authorized 

14 to secure directly from any executive department, bu15 reau, agency, board, commission, office, independent 

16 establishment, or instrumentality of the Government, 

17 information, suggestions, estimates, and statistics for 

18 the purposes of the Committee. Each department, bu19 reau, agency, board, commission, office, independent 

20 establishment, or instrumentality shall, to the extent 

21 authorized by law, furnish such information, sugges22 tions, estimates, and statistics directly to the Com23 mittee, upon request made by the Chair, the Chair of 

24 any subcommittee created by a majority of the ComVerDate Sep 11 2014 21:44 Feb 05, 2020 Jkt 099200 PO 00000 Frm 00021 Fmt 6652 Sfmt 6203 E:\BILLS\H3941.RH H3941

kjohnson on DSK79L0C42PROD with BILLS
22 

•HR 3941 RH

1 mittee, or any member designated by a majority of 

2 the Committee. 

3 ‘‘(2) RECEIPT, HANDLING, STORAGE, AND DIS4 SEMINATION.—Information may only be received, 

5 handled, stored, and disseminated by members of the 

6 Committee and its staff consistent with all applicable 

7 statutes, regulations, and Executive orders. 

8 ‘‘(i) ASSISTANCE FROM AGENCIES.— 

9 ‘‘(1) OTHER DEPARTMENTS AND AGENCIES.—In 

10 addition to the administration of the Committee by 

11 the General Services Administration, other agencies 

12 may provide to the Committee such services, funds, 

13 facilities, staff, and other support services as the head 

14 of the agency determines to be advisable and as is au15 thorized by law. 

16 ‘‘(2) DETAIL OF EMPLOYEES.—Any Federal Gov17 ernment employee may be detailed to the Committee 

18 without reimbursement from the Committee, and such 

19 detailee shall retain the rights, status, and privileges 

20 of his or her regular employment without interrup21 tion. 

22 ‘‘(j) POSTAL SERVICES.—The Committee may use the 

23 United States mails in the same manner and under the 

24 same conditions as agencies. 


kjohnson on DSK79L0C42PROD with BILLS
23 

•HR 3941 RH

1 ‘‘(k) EXPERT AND CONSULTANT SERVICES.—The Com2 mittee is authorized to procure the services of experts and 

3 consultants in accordance with section 3109 of title 5, but 

4 at rates not to exceed the daily rate paid a person occu5 pying a position at Level IV of the Executive Schedule 

6 under section 5315 of title 5. 

7 ‘‘(l) REPORTS.— 

8 ‘‘(1) INTERIM REPORTS.—The Committee may 

9 submit to the Administrator and Congress interim re10 ports containing such findings, conclusions, and rec11 ommendations as have been agreed to by the Com12 mittee. 

13 ‘‘(2) ANNUAL REPORTS.—Not later than 18 

14 months after the date of the enactment of this section, 

15 and annually thereafter, the Committee shall submit 

16 to the Administrator and Congress a final report con17 taining such findings, conclusions, and recommenda18 tions as have been agreed to by the Committee. 

19 ‘‘§ 3616. Definitions 

20 ‘‘(a) IN GENERAL.—Except as provided under sub21 section (b), the definitions under sections 3502 and 3552 

22 apply to sections 3607 through this section. 

23 ‘‘(b) ADDITIONAL DEFINITIONS.—In sections 3607 

24 through this section: 


kjohnson on DSK79L0C42PROD with BILLS
24 

•HR 3941 RH

1 ‘‘(1) ADMINISTRATOR.—The term ‘Adminis2 trator’ means the Administrator of General Services. 

3 ‘‘(2) AUTHORIZATION PACKAGE.—The term ‘au4 thorization package’— 

5 ‘‘(A) means the essential information used 

6 to determine whether to authorize the operation 

7 of an information system or the use of a des8 ignated set of common controls; and 

9 ‘‘(B) at a minimum, includes the informa10 tion system security plan, privacy plan, security 

11 control assessment, privacy control assessment, 

12 and any relevant plans of action and milestones. 

13 ‘‘(3) CLOUD COMPUTING.—The term ‘cloud com14 puting’ has the meaning given that term by the Na15 tional Institutes of Standards and Technology in 

16 NIST Special Publication 800–145 and any amend17 atory or superseding document thereto. 

18 ‘‘(4) CLOUD SERVICE PROVIDER.—The term 

19 ‘cloud service provider’ means an entity offering cloud 

20 computing services to agencies. 

21 ‘‘(5) DIRECTOR.—The term ‘Director’ means the 

22 Director of the Office of Management and Budget. 

23 ‘‘(6) FEDRAMP.—The term ‘FedRAMP’ means 

24 the Federal Risk and Authorization Management Pro25 gram established under section 3607(a). 


kjohnson on DSK79L0C42PROD with BILLS
25 

•HR 3941 RH

1 ‘‘(7) FEDRAMP AUTHORIZATION.—The term 

2 ‘FedRAMP authorization’ means a cloud computing 

3 product or service that has received an agency author4 ization to operate and has been approved by the 

5 FedRAMP Program Management Office to meet re6 quirements and guidelines established by the 

7 FedRAMP Program Management Office. 

8 ‘‘(8) FEDRAMP PROGRAM MANAGEMENT OF9 FICE.—The term ‘FedRAMP Program Management 

10 Office’ means the office that administers FedRAMP 

11 established under section 3608. 

12 ‘‘(9) INDEPENDENT ASSESSMENT ORGANIZA13 TION.—The term ‘independent assessment organiza14 tion’ means a third-party organization accredited by 

15 the Program Director of the FedRAMP Program 

16 Management Office to undertake conformity assess17 ments of cloud service providers. 

18 ‘‘(10) JOINT AUTHORIZATION BOARD.—The term 

19 ‘Joint Authorization Board’ means the Joint Author20 ization Board established under section 3609.’’. 

21 (b) TECHNICAL AND CONFORMING AMENDMENT.—The 

22 table of sections for chapter 36 of title 44, United States 

23 Code, is amended by adding at the end the following new 

24 items: 

‘‘3607. Federal Risk and Authorization Management Program. 

‘‘3608. FedRAMP Program Management Office. 

‘‘3609. Joint Authorization Board. 


kjohnson on DSK79L0C42PROD with BILLS
26 

•HR 3941 RH

‘‘3610. Independent assessment organizations. 

‘‘3611. Roles and responsibilities of agencies. 

‘‘3612. Roles and responsibilities of the Office of Management and Budget. 

‘‘3613. Authorization of appropriations for FEDRAMP. 

‘‘3614. Reports to Congress. 

‘‘3615. Federal Secure Cloud Advisory Committee. 

‘‘3616. Definitions.’’. 

1 (c) SUNSET.—This Act and any amendment made by 

2 this Act shall be repealed on the date that is 10 years after 

3 the date of the enactment of this Act. 

4 (d) RULE OF CONSTRUCTION.—Nothing in this Act or 

5 any amendment made by this Act shall be construed as al6 tering or impairing the authorities of the Director of the 

7 Office of Management and Budget or the Secretary of 

8 Homeland Security under subchapter II of chapter 35 of 

9 title 44, United States Code. 


kjohnson on DSK79L0C42PROD with BILLS

kjohnson on DSK79L0C42PROD with BILLS
Union Calendar No. 315 

116TH CONGRESS 

2D SESSION H. R. 3941 

[Report No. 116–391] 

A BILL 

To enhance the innovation, security, and availations, and for other purposes. Modernization Act of 2014 and cloud-based oper- consistent with the Federal Information Security computing services using a risk-based approach able the Federal Government to leverage cloud tion, and continuous monitoring process to en- by establishing a risk management, authoriza- within the General Services Administration and Risk and Authorization Management Program Federal Government by establishing the Federal ability of cloud computing services used in the 

FEBRUARY 5, 2020 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


kjohnson on DSK79L0C42PROD with BILLS