116TH CONGRESS 

2D SESSION H. R. 3941 

AN ACT 

To enhance the innovation, security, and availability of cloud 

computing services used in the Federal Government by 

establishing the Federal Risk and Authorization Management Program within the General Services Administration and by establishing a risk management, authorization, and continuous monitoring process to enable the 

Federal Government to leverage cloud computing services 

using a risk-based approach consistent with the Federal 

Information Security Modernization Act of 2014 and 

cloud-based operations, and for other purposes. 
2 

•HR 3941 EH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Risk and Au5 thorization Management Program Authorization Act of 

6 2019’’ or the ‘‘FedRAMP Authorization Act’’. 

7 SEC. 2. CODIFICATION OF THE FEDRAMP PROGRAM. 

8 (a) AMENDMENT.—Chapter 36 of title 44, United 

9 States Code, is amended by adding at the end the fol10 lowing new sections: 

11 ‘‘§ 3607. Federal Risk and Authorization Management 

12 Program 

13 ‘‘(a) ESTABLISHMENT.—There is established within 

14 the General Services Administration the Federal Risk and 

15 Authorization Management Program. The Administrator 

16 of General Services, in accordance with the guidelines es17 tablished pursuant to section 3612, shall establish a gov18 ernmentwide program that provides the authoritative 

19 standardized approach to security assessment and author20 ization for cloud computing products and services that 

21 process unclassified information used by agencies. 

22 ‘‘(b) COMPONENTS OF FEDRAMP.—The Joint Au23 thorization Board and the FedRAMP Program Manage24 ment Office are established as components of FedRAMP. 
3 

•HR 3941 EH

1 ‘‘§ 3608. FedRAMP Program Management Office 

2 ‘‘(a) GSA DUTIES.— 

3 ‘‘(1) ROLES AND RESPONSIBILITIES.—The Ad4 ministrator of General Services shall— 

5 ‘‘(A) determine the categories and charac6 teristics of cloud computing information tech7 nology goods or services that are within the ju8 risdiction of FedRAMP and that require 

9 FedRAMP authorization from the Joint Au10 thorization Board or the FedRAMP Program 

11 Management Office; 

12 ‘‘(B) develop, coordinate, and implement a 

13 process for the FedRAMP Program Manage14 ment Office, the Joint Authorization Board, 

15 and agencies to review security assessments of 

16 cloud computing services pursuant to sub17 sections (b) and (c) of section 3611, and appro18 priate oversight of continuous monitoring of 

19 cloud computing services; and 

20 ‘‘(C) ensure the continuous improvement of 

21 FedRAMP. 

22 ‘‘(2) IMPLEMENTATION.—The Administrator 

23 shall oversee the implementation of FedRAMP, in24 cluding— 
4 

•HR 3941 EH

1 ‘‘(A) appointing a Program Director to 

2 oversee the FedRAMP Program Management 

3 Office; 

4 ‘‘(B) hiring professional staff as may be 

5 necessary for the effective operation of the 

6 FedRAMP Program Management Office, and 

7 such other activities as are essential to properly 

8 perform critical functions; 

9 ‘‘(C) entering into interagency agreements 

10 to detail personnel on a reimbursable or non-re11 imbursable basis to assist the FedRAMP Pro12 gram Management Office and the Joint Author13 ization Board in discharging the responsibilities 

14 of the Office under this section; and 

15 ‘‘(D) such other actions as the Adminis16 trator may determine necessary to carry out 

17 this section. 

18 ‘‘(b) DUTIES.—The FedRAMP Program Manage19 ment Office shall have the following duties: 

20 ‘‘(1) Provide guidance to independent assess21 ment organizations, validate the independent assess22 ments, and apply the requirements and guidelines 

23 adopted in section 3609(c)(5). 
5 

•HR 3941 EH

1 ‘‘(2) Oversee and issue guidelines regarding the 

2 qualifications, roles, and responsibilities of inde3 pendent assessment organizations. 

4 ‘‘(3) Develop templates and other materials to 

5 support the Joint Authorization Board and agencies 

6 in the authorization of cloud computing services to 

7 increase the speed, effectiveness, and transparency 

8 of the authorization process, consistent with stand9 ards defined by the National Institute of Standards 

10 and Technology. 

11 ‘‘(4) Establish and maintain a public comment 

12 process for proposed guidance before the issuance of 

13 such guidance by FedRAMP. 

14 ‘‘(5) Issue FedRAMP authorization for any au15 thorizations to operate issued by an agency that 

16 meets the requirements and guidelines described in 

17 paragraph (1). 

18 ‘‘(6) Establish frameworks for agencies to use 

19 authorization packages processed by the FedRAMP 

20 Program Management Office and Joint Authoriza21 tion Board. 

22 ‘‘(7) Coordinate with the Secretary of Defense 

23 and the Secretary of Homeland Security to establish 

24 a framework for continuous monitoring and report25 ing required of agencies pursuant to section 3553. 
6 

•HR 3941 EH

1 ‘‘(8) Establish a centralized and secure reposi2 tory to collect and share necessary data, including 

3 security authorization packages, from the Joint Au4 thorization Board and agencies to enable better 

5 sharing and reuse to such packages across agencies. 

6 ‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 

7 ‘‘(1) IN GENERAL.—The FedRAMP Program 

8 Management Office shall assess and evaluate avail9 able automation capabilities and procedures to im10 prove the efficiency and effectiveness of the issuance 

11 of provisional authorizations to operate issued by the 

12 Joint Authorization Board and FedRAMP author13 izations, including continuous monitoring of cloud 

14 environments and among cloud environments. 

15 ‘‘(2) MEANS FOR AUTOMATION.—Not later than 

16 1 year after the date of the enactment of this section 

17 and updated annually thereafter, the FedRAMP 

18 Program Management Office shall establish a means 

19 for the automation of security assessments and re20 views. 

21 ‘‘(d) METRICS FOR AUTHORIZATION.—The 

22 FedRAMP Program Management Office shall establish 

23 annual metrics regarding the time and quality of the as24 sessments necessary for completion of a FedRAMP au25 thorization process in a manner that can be consistently 
7 

•HR 3941 EH

1 tracked over time in conjunction with the periodic testing 

2 and evaluation process pursuant to section 3554 in a man3 ner that minimizes the agency reporting burden. 

4 ‘‘§ 3609. Joint Authorization Board 

5 ‘‘(a) ESTABLISHMENT.—There is established the 

6 Joint Authorization Board which shall consist of cloud 

7 computing experts, appointed by the Director in consulta8 tion with the Administrator, from each of the following: 

9 ‘‘(1) The Department of Defense. 

10 ‘‘(2) The Department of Homeland Security. 

11 ‘‘(3) The General Services Administration. 

12 ‘‘(4) Such other agencies as determined by the 

13 Director, in consultation with the Administrator. 

14 ‘‘(b) ISSUANCE OF PROVISIONAL AUTHORIZATIONS

15 TO OPERATE.—The Joint Authorization Board shall con16 duct security assessments of cloud computing services and 

17 issue provisional authorizations to operate to cloud service 

18 providers that meet FedRAMP security guidelines set 

19 forth in section 3608(b)(1). 

20 ‘‘(c) DUTIES.—The Joint Authorization Board 

21 shall— 

22 ‘‘(1) develop and make publicly available on a 

23 website, determined by the Administrator, criteria 

24 for prioritizing and selecting cloud computing serv-
8 

•HR 3941 EH

1 ices to be assessed by the Joint Authorization 

2 Board; 

3 ‘‘(2) provide regular updates on the status of 

4 any cloud computing service during the assessment 

5 and authorization process of the Joint Authorization 

6 Board; 

7 ‘‘(3) review and validate cloud computing serv8 ices and independent assessment organization secu9 rity packages or any documentation determined to 

10 be necessary by the Joint Authorization Board to 

11 evaluate the system security of a cloud computing 

12 service; 

13 ‘‘(4) in consultation with the FedRAMP Pro14 gram Management Office, serve as a resource for 

15 best practices to accelerate the FedRAMP process; 

16 ‘‘(5) establish requirements and guidelines for 

17 security assessments of cloud computing services, 

18 consistent with standards defined by the National 

19 Institute of Standards and Technology, to be used 

20 by the Joint Authorization Board and agencies; 

21 ‘‘(6) perform such other roles and responsibil22 ities as the Administrator may assign, in consulta23 tion with the FedRAMP Program Management Of24 fice and members of the Joint Authorization Board; 

25 and 
9 

•HR 3941 EH

1 ‘‘(7) establish metrics and goals for reviews and 

2 activities associated with issuing provisional author3 izations to operate and provide to the FedRAMP 

4 Program Management Office. 

5 ‘‘(d) DETERMINATIONS OF DEMAND FOR CLOUD

6 COMPUTING SERVICES.—The Joint Authorization Board 

7 shall consult with the Chief Information Officers Council 

8 established in section 3603 to establish a process for 

9 prioritizing and accepting the cloud computing services to 

10 be granted a provisional authorization to operate through 

11 the Joint Authorization Board, which shall be made avail12 able on a public website. 

13 ‘‘(e) DETAIL OF PERSONNEL.—To assist the Joint 

14 Authorization Board in discharging the responsibilities 

15 under this section, personnel of agencies may be detailed 

16 to the Joint Authorization Board for the performance of 

17 duties described under subsection (c). 

18 ‘‘§ 3610. Independent assessment organizations 

19 ‘‘(a) REQUIREMENTS FOR ACCREDITATION.—The 

20 Joint Authorization Board shall determine the require21 ments for certification of independent assessment organi22 zations pursuant to section 3609. Such requirements may 

23 include developing or requiring certification programs for 

24 individuals employed by the independent assessment orga25 nizations who lead FedRAMP assessment teams. 
10 

•HR 3941 EH

1 ‘‘(b) ASSESSMENT.—Accredited independent assess2 ment organizations may assess, validate, and attest to the 

3 quality and compliance of security assessment materials 

4 provided by cloud service providers. 

5 ‘‘§ 3611. Roles and responsibilities of agencies 

6 ‘‘(a) IN GENERAL.—In implementing the require7 ments of FedRAMP, the head of each agency shall, con8 sistent with guidance issued by the Director pursuant to 

9 section 3612— 

10 ‘‘(1) create policies to ensure cloud computing 

11 services used by the agency meet FedRAMP security 

12 requirements and other risk-based performance re13 quirements as defined by the Director; 

14 ‘‘(2) issue agency-specific authorizations to op15 erate for cloud computing services in compliance 

16 with section 3554; 

17 ‘‘(3) confirm whether there is a provisional au18 thorization to operate in the cloud security reposi19 tory established under section 3608(b)(10) issued by 

20 the Joint Authorization Board or a FedRAMP au21 thorization issued by the FedRAMP Program Man22 agement Office before beginning an agency author23 ization for a cloud computing product or service; 

24 ‘‘(4) to the extent practicable, for any cloud 

25 computing product or service the agency seeks to au-
11 

•HR 3941 EH

1 thorize that has received either a provisional author2 ization to operate by the Joint Authorization Board 

3 or a FedRAMP authorization by the FedRAMP Pro4 gram Management Office, use the existing assess5 ments of security controls and materials within the 

6 authorization package; and 

7 ‘‘(5) provide data and information required to 

8 the Director pursuant to section 3612 to determine 

9 how agencies are meeting metrics as defined by the 

10 FedRAMP Program Management Office. 

11 ‘‘(b) SUBMISSION OF POLICIES REQUIRED.—Not 

12 later than 6 months after the date of the enactment of 

13 this section, the head of each agency shall submit to the 

14 Director the policies created pursuant to subsection (a)(1) 

15 for review and approval. 

16 ‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE

17 REQUIRED.—Upon issuance of an authorization to oper18 ate or a provisional authorization to operate issued by an 

19 agency, the head of each agency shall provide a copy of 

20 the authorization to operate letter and any supplementary 

21 information required pursuant to section 3608(b) to the 

22 FedRAMP Program Management Office. 

23 ‘‘(d) PRESUMPTION OF ADEQUACY.— 

24 ‘‘(1) IN GENERAL.—The assessment of security 

25 controls and materials within the authorization 
12 

•HR 3941 EH

1 package for provisional authorizations to operate 

2 issued by the Joint Authorization Board and agency 

3 authorizations to operate that receive FedRAMP au4 thorization from the FedRAMP Program Manage5 ment Office shall be presumed adequate for use in 

6 agency authorizations of cloud computing products 

7 and services. 

8 ‘‘(2) INFORMATION SECURITY REQUIRE9 MENTS.—The presumption under paragraph (1) 

10 does not modify or alter the responsibility of any 

11 agency to ensure compliance with subchapter II of 

12 chapter 35 for any cloud computing products or 

13 services used by the agency. 

14 ‘‘§ 3612. Roles and responsibilities of the Office of 

15 Management and Budget 

16 ‘‘The Director shall have the following duties: 

17 ‘‘(1) Issue guidance to ensure that an agency 

18 does not operate a Federal Government cloud com19 puting service using Government data without an 

20 authorization to operate issued by the agency that 

21 meets the requirements of subchapter II of chapter 

22 35 and FedRAMP. 

23 ‘‘(2) Ensure agencies are in compliance with 

24 any guidance or other requirements issued related to 

25 FedRAMP. 
13 

•HR 3941 EH

1 ‘‘(3) Review, analyze, and update guidance on 

2 the adoption, security, and use of cloud computing 

3 services used by agencies. 

4 ‘‘(4) Ensure the Joint Authorization Board is 

5 in compliance with section 3609(c). 

6 ‘‘(5) Adjudicate disagreements between the 

7 Joint Authorization Board and cloud service pro8 viders seeking a provisional authorization to operate 

9 through the Joint Authorization Board. 

10 ‘‘(6) Promulgate regulations on the role of 

11 FedRAMP authorization in agency acquisition of 

12 cloud computing products and services that process 

13 unclassified information. 

14 ‘‘§ 3613. Authorization of appropriations for 

15 FEDRAMP 

16 ‘‘There is authorized to be appropriated $20,000,000 

17 each year for the FedRAMP Program Management Office 

18 and the Joint Authorization Board. 

19 ‘‘§ 3614. Reports to Congress 

20 ‘‘Not later than 12 months after the date of the en21 actment of this section, and annually thereafter, the Di22 rector shall submit to the Committee on Oversight and 

23 Reform of the House of Representatives and the Com24 mittee on Homeland Security and Governmental Affairs 

25 of the Senate a report that includes the following: 
14 

•HR 3941 EH

1 ‘‘(1) The status, efficiency, and effectiveness of 

2 FedRAMP Program Management Office and agen3 cies during the preceding year in supporting the 

4 speed, effectiveness, sharing, reuse, and security of 

5 authorizations to operate for cloud computing prod6 ucts and services, including progress towards meet7 ing the metrics adopted by the FedRAMP Program 

8 Management Office pursuant to section 3608(d) and 

9 the Joint Authorization Board pursuant to section 

10 3609(c)(5). 

11 ‘‘(2) Data on agency use of provisional author12 izations to operate issued by the Joint Authorization 

13 Board and agency sponsored authorizations that re14 ceive FedRAMP authorization by the FedRAMP 

15 Program Management Office. 

16 ‘‘(3) The length of time for the Joint Author17 ization Board to review applications for and issue 

18 provisional authorizations to operate. 

19 ‘‘(4) The length of time for the FedRAMP Pro20 gram Management Office to review agency applica21 tions for and issue FedRAMP authorization. 

22 ‘‘(5) The number of provisional authorizations 

23 to operate issued by the Joint Authorization Board 

24 and FedRAMP authorizations issued by the 
15 

•HR 3941 EH

1 FedRAMP Program Management Office for the pre2 vious year. 

3 ‘‘(6) A review of progress made during the pre4 ceding year in advancing automation techniques to 

5 securely automate FedRAMP processes and to accel6 erate reporting as described in this section. 

7 ‘‘(7) The number and characteristics of author8 ized cloud computing services in use at each agency 

9 consistent with guidance provided by the Director in 

10 section 3612. 

11 ‘‘§ 3615. Federal Secure Cloud Advisory Committee 

12 ‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 

13 ‘‘(1) ESTABLISHMENT.—There is established a 

14 Federal Secure Cloud Advisory Committee (referred 

15 to in this section as the ‘Committee’) to ensure ef16 fective and ongoing coordination of agency adoption, 

17 use, authorization, monitoring, acquisition, and secu18 rity of cloud computing products and services to en19 able agency mission and administrative priorities. 

20 ‘‘(2) PURPOSES.—The purposes of the Com21 mittee are the following: 

22 ‘‘(A) To examine the operations of 

23 FedRAMP and determine ways that authoriza24 tion processes can continuously be improved, in25 cluding the following: 
16 

•HR 3941 EH

1 ‘‘(i) Measures to increase agency re2 use of provisional authorizations to operate 

3 issued by the Joint Authorization Board. 

4 ‘‘(ii) Proposed actions that can be 

5 adopted to reduce the cost of provisional 

6 authorizations to operate and FedRAMP 

7 authorizations for cloud service providers. 

8 ‘‘(iii) Measures to increase the num9 ber of provisional authorizations to operate 

10 or FedRAMP authorizations for cloud 

11 computing services offered by small busi12 nesses (as defined by section 3(a) of the 

13 Small Business Act (15 U.S.C. 632(a)). 

14 ‘‘(B) Collect information and feedback on 

15 agency compliance with and implementation of 

16 FedRAMP requirements. 

17 ‘‘(C) Serve as a forum that facilitates com18 munication and collaboration among the 

19 FedRAMP stakeholder community. 

20 ‘‘(3) DUTIES.—The duties of the Committee 

21 are, at a minimum, the following: 

22 ‘‘(A) Provide advice and recommendations 

23 to the Administrator, the Joint Authorization 

24 Board, and to agencies on technical, financial, 
17 

•HR 3941 EH

1 programmatic, and operational matters regard2 ing secure adoption of cloud computing services. 

3 ‘‘(B) Submit reports as required. 

4 ‘‘(b) MEMBERS.— 

5 ‘‘(1) COMPOSITION.—The Committee shall be 

6 comprised of not more than 15 members who are 

7 qualified representatives from the public and private 

8 sectors, appointed by the Administrator, in consulta9 tion with the Administrator of the Office of Elec10 tronic Government, as follows: 

11 ‘‘(A) The Administrator or the Administra12 tor’s designee, who shall be the Chair of the 

13 Committee. 

14 ‘‘(B) At least one representative each from 

15 the Cybersecurity and Infrastructure Security 

16 Agency and the National Institute of Standards 

17 and Technology. 

18 ‘‘(C) At least two officials who serve as the 

19 Chief Information Security Officer within an 

20 agency, who shall be required to maintain such 

21 a position throughout the duration of their serv22 ice on the Committee. 

23 ‘‘(D) At least one official serving as Chief 

24 Procurement Officer (or equivalent) in an agen25 cy, who shall be required to maintain such a po-
18 

•HR 3941 EH

1 sition throughout the duration of their service 

2 on the Committee. 

3 ‘‘(E) At least one individual representing 

4 an independent assessment organization. 

5 ‘‘(F) No fewer than five representatives 

6 from unique businesses that primarily provide 

7 cloud computing services or products, including 

8 at least two representatives from a small busi9 ness (as defined by section 3(a) of the Small 

10 Business Act (15 U.S.C. 632(a))). 

11 ‘‘(G) At least two other government rep12 resentatives as the Administrator determines to 

13 be necessary to provide sufficient balance, in14 sights, or expertise to the Committee. 

15 ‘‘(2) DEADLINE FOR APPOINTMENT.—Each 

16 member of the Committee shall be appointed not 

17 later than 30 days after the date of the enactment 

18 of this Act. 

19 ‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 

20 ‘‘(A) IN GENERAL.—Each non-Federal 

21 member of the Committee shall be appointed 

22 for a term of 3 years, except that the initial 

23 terms for members may be staggered 1, 2, or 

24 3 year terms to establish a rotation in which 

25 one-third of the members are selected each 
19 

•HR 3941 EH

1 year. Any such member may be appointed for 

2 not more than 2 consecutive terms. 

3 ‘‘(B) VACANCIES.—Any vacancy in the 

4 Committee shall not affect its powers, but shall 

5 be filled in the same manner in which the origi6 nal appointment was made. Any member ap7 pointed to fill a vacancy occurring before the 

8 expiration of the term for which the member’s 

9 predecessor was appointed shall be appointed 

10 only for the remainder of that term. A member 

11 may serve after the expiration of that member’s 

12 term until a successor has taken office. 

13 ‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 

14 ‘‘(1) MEETINGS.—The Committee shall hold 

15 not fewer than three meetings in a calendar year, at 

16 such time and place as determined by the Chair. 

17 ‘‘(2) INITIAL MEETING.—Not later than 120 

18 days after the date of the enactment of this section, 

19 the Committee shall meet and begin the operations 

20 of the Committee. 

21 ‘‘(3) RULES OF PROCEDURE.—The Committee 

22 may establish rules for the conduct of the business 

23 of the Committee, if such rules are not inconsistent 

24 with this section or other applicable law. 

25 ‘‘(d) EMPLOYEE STATUS.— 
20 

•HR 3941 EH

1 ‘‘(1) IN GENERAL.—A member of the Com2 mittee (other than a member who is appointed to the 

3 Committee in connection with another Federal ap4 pointment) shall not be considered an employee of 

5 the Federal Government by reason of any service as 

6 such a member, except for the purposes of section 

7 5703 of title 5, relating to travel expenses. 

8 ‘‘(2) PAY NOT PERMITTED.—A member of the 

9 Committee covered by paragraph (1) may not receive 

10 pay by reason of service on the panel. 

11 ‘‘(e) APPLICABILITY TO THE FEDERAL ADVISORY

12 COMMITTEE ACT.—Notwithstanding any other provision 

13 of law, the Federal Advisory Committee Act (5 U.S.C. 

14 App.) shall apply to the Committee, except that section 

15 14 of such Act shall not apply. 

16 ‘‘(f) HEARINGS AND EVIDENCE.—The Committee, or 

17 on the authority of the Committee, any subcommittee, 

18 may, for the purposes of carrying out this section, hold 

19 hearings, sit and act at such times and places, take testi20 mony, receive evidence, and administer oaths. 

21 ‘‘(g) CONTRACTING.—The Committee, may, to such 

22 extent and in such amounts as are provided in appropria23 tion Acts, enter into contracts to enable the Committee 

24 to discharge its duties under this section. 

25 ‘‘(h) INFORMATION FROM FEDERAL AGENCIES.— 
21 

•HR 3941 EH

1 ‘‘(1) IN GENERAL.—The Committee is author2 ized to secure directly from any executive depart3 ment, bureau, agency, board, commission, office, 

4 independent establishment, or instrumentality of the 

5 Government, information, suggestions, estimates, 

6 and statistics for the purposes of the Committee. 

7 Each department, bureau, agency, board, commis8 sion, office, independent establishment, or instru9 mentality shall, to the extent authorized by law, fur10 nish such information, suggestions, estimates, and 

11 statistics directly to the Committee, upon request 

12 made by the Chair, the Chair of any subcommittee 

13 created by a majority of the Committee, or any 

14 member designated by a majority of the Committee. 

15 ‘‘(2) RECEIPT, HANDLING, STORAGE, AND DIS16 SEMINATION.—Information may only be received, 

17 handled, stored, and disseminated by members of 

18 the Committee and its staff consistent with all appli19 cable statutes, regulations, and Executive orders. 

20 ‘‘(i) DETAIL OF EMPLOYEES.—Any Federal Govern21 ment employee may be detailed to the Committee without 

22 reimbursement from the Committee, and such detailee 

23 shall retain the rights, status, and privileges of his or her 

24 regular employment without interruption. 
22 

•HR 3941 EH

1 ‘‘(j) POSTAL SERVICES.—The Committee may use 

2 the United States mails in the same manner and under 

3 the same conditions as agencies. 

4 ‘‘(k) EXPERT AND CONSULTANT SERVICES.—The 

5 Committee is authorized to procure the services of experts 

6 and consultants in accordance with section 3109 of title 

7 5, but at rates not to exceed the daily rate paid a person 

8 occupying a position at Level IV of the Executive Schedule 

9 under section 5315 of title 5. 

10 ‘‘(l) REPORTS.— 

11 ‘‘(1) INTERIM REPORTS.—The Committee may 

12 submit to the Administrator and Congress interim 

13 reports containing such findings, conclusions, and 

14 recommendations as have been agreed to by the 

15 Committee. 

16 ‘‘(2) ANNUAL REPORTS.—Not later than 18 

17 months after the date of the enactment of this sec18 tion, and annually thereafter, the Committee shall 

19 submit to the Administrator and Congress a final re20 port containing such findings, conclusions, and rec21 ommendations as have been agreed to by the Com22 mittee. 
23 

•HR 3941 EH

1 ‘‘§ 3616. Definitions 

2 ‘‘(a) IN GENERAL.—Except as provided under sub3 section (b), the definitions under sections 3502 and 3552 

4 apply to sections 3607 through this section. 

5 ‘‘(b) ADDITIONAL DEFINITIONS.—In sections 3607 

6 through this section: 

7 ‘‘(1) ADMINISTRATOR.—The term ‘Adminis8 trator’ means the Administrator of General Services. 

9 ‘‘(2) AUTHORIZATION PACKAGE.—The term 

10 ‘authorization package’— 

11 ‘‘(A) means the essential information used 

12 to determine whether to authorize the operation 

13 of an information system or the use of a des14 ignated set of common controls; and 

15 ‘‘(B) at a minimum, includes the informa16 tion system security plan, privacy plan, security 

17 control assessment, privacy control assessment, 

18 and any relevant plans of action and milestones. 

19 ‘‘(3) CLOUD COMPUTING.—The term ‘cloud 

20 computing’ has the meaning given that term by the 

21 National Institutes of Standards and Technology in 

22 NIST Special Publication 800–145 and any amend23 atory or superseding document thereto. 

24 ‘‘(4) CLOUD SERVICE PROVIDER.—The term 

25 ‘cloud service provider’ means an entity offering 

26 cloud computing services to agencies. 
24 

•HR 3941 EH

1 ‘‘(5) DIRECTOR.—The term ‘Director’ means 

2 the Director of the Office of Management and Budg3 et. 

4 ‘‘(6) FEDRAMP.—The term ‘FedRAMP’ means 

5 the Federal Risk and Authorization Management 

6 Program established under section 3607(a). 

7 ‘‘(7) FEDRAMP AUTHORIZATION.—The term 

8 ‘FedRAMP authorization’ means a cloud computing 

9 product or service that has received an agency au10 thorization to operate and has been approved by the 

11 FedRAMP Program Management Office to meet re12 quirements and guidelines established by the 

13 FedRAMP Program Management Office. 

14 ‘‘(8) FEDRAMP PROGRAM MANAGEMENT OF15 FICE.—The term ‘FedRAMP Program Management 

16 Office’ means the office that administers FedRAMP 

17 established under section 3608. 

18 ‘‘(9) INDEPENDENT ASSESSMENT ORGANIZA19 TION.—The term ‘independent assessment organiza20 tion’ means a third-party organization accredited by 

21 the Program Director of the FedRAMP Program 

22 Management Office to undertake conformity assess23 ments of cloud service providers. 

24 ‘‘(10) JOINT AUTHORIZATION BOARD.—The 

25 term ‘Joint Authorization Board’ means the Joint 
25 

•HR 3941 EH

1 Authorization Board established under section 

2 3609.’’. 

3 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

4 The table of sections for chapter 36 of title 44, United 

5 States Code, is amended by adding at the end the fol6 lowing new items: 

‘‘3607. Federal Risk and Authorization Management Program. 

‘‘3608. FedRAMP Program Management Office. 

‘‘3609. Joint Authorization Board. 

‘‘3610. Independent assessment organizations. 

‘‘3611. Roles and responsibilities of agencies. 

‘‘3612. Roles and responsibilities of the Office of Management and Budget. 

‘‘3613. Authorization of appropriations for FEDRAMP. 

‘‘3614. Reports to Congress. 

‘‘3615. Federal Secure Cloud Advisory Committee. 

‘‘3616. Definitions.’’. 

7 (c) SUNSET.—This Act and any amendment made by 

8 this Act shall be repealed on the date that is 10 years 

9 after the date of the enactment of this Act. 

10 (d) RULE OF CONSTRUCTION.—Nothing in this Act 

11 or any amendment made by this Act shall be construed 

12 as altering or impairing the authorities of the Director of 

13 the Office of Management and Budget or the Secretary 

14 of Homeland Security under subchapter II of chapter 35 

15 of title 44, United States Code. 

Passed the House of Representatives February 5, 

2020. 

Attest: 

Clerk. 
116TH CONGRESS 

2D SESSION H. R. 3941 

AN ACT 

To enhance the innovation, security, and availations, and for other purposes. Modernization Act of 2014 and cloud-based oper- consistent with the Federal Information Security computing services using a risk-based approach able the Federal Government to leverage cloud tion, and continuous monitoring process to en- by establishing a risk management, authoriza- within the General Services Administration and Risk and Authorization Management Program Federal Government by establishing the Federal ability of cloud computing services used in the