I 

116TH CONGRESS 

1ST SESSION H. R. 3941 

To enhance the innovation, security, and availability of cloud computing 

services used in the Federal Government by establishing the Federal 

Risk and Authorization Management Program within the General Services Administration and by establishing a risk management, authorization, and continuous monitoring process to enable the Federal Government to leverage cloud computing services using a risk-based approach 

consistent with the Federal Information Security Modernization Act of 

2014 and cloud-based operations, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JULY 24, 2019 

Mr. CONNOLLY (for himself and Mr. MEADOWS) introduced the following bill; 

which was referred to the Committee on Oversight and Reform 

A BILL 

To enhance the innovation, security, and availability of cloud 

computing services used in the Federal Government by 

establishing the Federal Risk and Authorization Management Program within the General Services Administration and by establishing a risk management, authorization, and continuous monitoring process to enable the 

Federal Government to leverage cloud computing services 

using a risk-based approach consistent with the Federal 

Information Security Modernization Act of 2014 and 

cloud-based operations, and for other purposes. 


kjohnson on DSK79L0C42 with BILLS
2 

•HR 3941 IH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Risk and Au5 thorization Management Program Authorization Act of 

6 2019’’ or the ‘‘FedRAMP Authorization Act’’. 

7 SEC. 2. CODIFICATION OF THE FEDRAMP PROGRAM. 

8 (a) AMENDMENT.—Chapter 36 of title 44, United 

9 States Code, is amended by adding at the end the fol10 lowing new sections: 

11 ‘‘§ 3607. Federal Risk and Authorization Management 

12 Program 

13 ‘‘(a) ESTABLISHMENT.—There is established within 

14 the General Services Administration the Federal Risk and 

15 Authorization Management Program. The Administrator 

16 of General Services, in accordance with the guidelines es17 tablished pursuant to section 3612, shall establish a gov18 ernmentwide program that provides the authoritative 

19 standardized approach to security assessment and author20 ization for cloud computing products and services that 

21 process unclassified information used by agencies. 

22 ‘‘(b) COMPONENTS OF FEDRAMP.—There are estab23 lished as components of FedRAMP the Joint Authoriza24 tion Board and the Program Management Office, or such 

25 successor offices as the Administrator may determine. 


kjohnson on DSK79L0C42 with BILLS
3 

•HR 3941 IH

1 ‘‘§ 3608. FedRAMP Program Management Office 

2 ‘‘(a) GSA DUTIES.— 

3 ‘‘(1) ROLES AND RESPONSIBILITIES.—The Ad4 ministrator of General Services shall— 

5 ‘‘(A) determine the categories and charac6 teristics of information technology goods or 

7 services that are within the jurisdiction of 

8 FedRAMP and that require FedRAMP author9 ization from the Joint Authorization Board or 

10 the FedRAMP Program Management Office, 

11 including the role of cloud brokers and cloud 

12 service integrators; 

13 ‘‘(B) develop, coordinate, and implement a 

14 process for the FedRAMP Program Manage15 ment Office and the Joint Authorization Board 

16 to conduct security assessments of cloud com17 puting services, review authorizations and as18 sessments submitted by agencies pursuant to 

19 subsections (b) and (c) of section 3611, and ap20 propriate oversight of continuous monitoring of 

21 cloud computing services; 

22 ‘‘(C) oversee the administration of the 

23 Federal Secure Cloud Advisory Committee, es24 tablished pursuant to section 3615; and 

25 ‘‘(D) ensure the continuous improvement 

26 of FedRAMP. 


kjohnson on DSK79L0C42 with BILLS
4 

•HR 3941 IH

1 ‘‘(2) IMPLEMENTATION.—The Administrator 

2 shall oversee the implementation of FedRAMP, in3 cluding— 

4 ‘‘(A) appointing a Program Director to 

5 oversee the FedRAMP Program Management 

6 Office; 

7 ‘‘(B) hiring professional staff as may be 

8 necessary for the effective operation of the 

9 FedRAMP Program Management Office, and 

10 such other activities as are essential to properly 

11 perform critical functions; 

12 ‘‘(C) entering into interagency agreements 

13 to detail personnel on a reimbursable or non-re14 imbursable basis to assist the FedRAMP Pro15 gram Management Office and the Joint Author16 ization Board in discharging the responsibilities 

17 of the Office under this section; 

18 ‘‘(D) adjudicating disagreements between 

19 the Joint Authorization Board and cloud service 

20 providers seeking a provisional authorization to 

21 operate through the Joint Authorization Board; 

22 and 

23 ‘‘(E) such other actions as the Adminis24 trator may determine necessary to carry out 

25 this section. 


kjohnson on DSK79L0C42 with BILLS
5 

•HR 3941 IH

1 ‘‘(b) DUTIES.—The FedRAMP Program Manage2 ment Office shall have the following duties: 

3 ‘‘(1) Establish requirements and guidelines for 

4 security assessments of cloud computing services, 

5 consistent with standards defined by the National 

6 Institute of Standards and Technology, to be used 

7 by the Joint Authorization Board and agencies. 

8 ‘‘(2) Provide guidance to independent assess9 ment organizations and oversee the execution of 

10 independent assessments in using and applying the 

11 requirements and guidelines adopted in paragraph 

12 (1). 

13 ‘‘(3) Oversee and issue guidelines regarding the 

14 qualifications, roles, and responsibilities of inde15 pendent assessment organizations. 

16 ‘‘(4) Develop templates and other materials to 

17 support the Joint Authorization Board and agencies 

18 in the authorization of cloud computing services to 

19 increase the speed, effectiveness, and transparency 

20 of the authorization process, consistent with stand21 ards defined by the National Institute of Standards 

22 and Technology. 

23 ‘‘(5) Establish and maintain a public comment 

24 process for proposed guidance before the issuance of 

25 such guidance by FedRAMP. 


kjohnson on DSK79L0C42 with BILLS
6 

•HR 3941 IH

1 ‘‘(6) Issue FedRAMP authorization for any au2 thorizations to operate issued by an agency that 

3 meets the requirements and guidelines described in 

4 paragraph (1). 

5 ‘‘(7) Establish frameworks for agencies to use 

6 authorization packages processed by the FedRAMP 

7 Program Management Office and Joint Authoriza8 tion Board. 

9 ‘‘(8) Coordinate with the Department of Home10 land Security to establish a framework for contin11 uous monitoring and reporting required of agencies 

12 pursuant to section 3554. 

13 ‘‘(9) Issue examples of security architectures to 

14 agencies and cloud computing services to better 

15 standardize and replicate secure configurations with16 in a single cloud service and among cloud services. 

17 ‘‘(10) Establish a centralized and secure reposi18 tory to collect and share necessary data, including 

19 security authorization packages, from the Joint Au20 thorization Board and agencies to enable better 

21 sharing and reuse to such packages across agencies. 

22 ‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 

23 ‘‘(1) IN GENERAL.—The FedRAMP Program 

24 Management Office shall assess and evaluate avail25 able automation capabilities and procedures to imVerDate Sep 11 2014 01:13 Aug 09, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H3941.IH H3941

kjohnson on DSK79L0C42 with BILLS
7 

•HR 3941 IH

1 prove the efficiency and effectiveness of the issuance 

2 of provisional authorizations to operate issued by the 

3 Joint Authorization Board and FedRAMP author4 izations, including better control inheritance and 

5 continuous monitoring of cloud environments and 

6 among cloud environments. 

7 ‘‘(2) MEANS FOR AUTOMATION.—Not later than 

8 1 year after the date of the enactment of this section 

9 and updated annually thereafter, the FedRAMP 

10 Program Management Office shall establish a means 

11 for the automation of security assessments and re12 views. 

13 ‘‘(d) METRICS FOR AUTHORIZATION.—The 

14 FedRAMP Program Management Office shall establish 

15 annual metrics regarding the time and quality of the as16 sessments necessary for completion of a FedRAMP au17 thorization process in a manner that can be consistently 

18 tracked over time in conjunction with the periodic testing 

19 and evaluation process pursuant to section 3553 in a man20 ner that minimizes the agency reporting burden. 

21 ‘‘§ 3609. Joint Authorization Board 

22 ‘‘(a) ESTABLISHMENT.—There is established the 

23 Joint Authorization Board which shall consist of 3 secu24 rity experts, appointed by the Director in consultation 

25 with the Administrator, from each of the following: 


kjohnson on DSK79L0C42 with BILLS
8 

•HR 3941 IH

1 ‘‘(1) The Department of Defense. 

2 ‘‘(2) The Department of Homeland Security. 

3 ‘‘(3) The General Services Administration. 

4 ‘‘(b) ISSUANCE OF PROVISIONAL AUTHORIZATIONS

5 TO OPERATE.—The Joint Authorization Board shall con6 duct security assessments of cloud computing services and 

7 issue provisional authorizations to operate to cloud service 

8 providers that meet FedRAMP security guidelines set 

9 forth in section 3608(b)(1). 

10 ‘‘(c) DUTIES.—The Joint Authorization Board 

11 shall— 

12 ‘‘(1) develop and make publicly available on a 

13 website, determined by the Administrator, criteria 

14 for prioritizing and selecting cloud computing serv15 ices to be assessed by the Joint Authorization Board 

16 and to provide regular updates on the status of any 

17 cloud computing service during the assessment and 

18 authorization process of the Joint Authorization 

19 Board; 

20 ‘‘(2) review and validate cloud computing serv21 ices and independent assessment organization au22 thorization packages; 

23 ‘‘(3) in consultation with the FedRAMP Pro24 gram Management Office, serve as a resource for 

25 best practices to accelerate the FedRAMP process; 


kjohnson on DSK79L0C42 with BILLS
9 

•HR 3941 IH

1 ‘‘(4) perform such other roles and responsibil2 ities as the Administrator may assign, in consulta3 tion with the FedRAMP Program Management Of4 fice and members of the Joint Authorization Board; 

5 and 

6 ‘‘(5) establish metrics and goals for reviews and 

7 activities associated with issuing provisional author8 izations to operate. 

9 ‘‘(d) DETERMINATIONS OF DEMAND FOR CLOUD

10 COMPUTING SERVICES.—The Joint Authorization Board 

11 shall consult with the head of each agency to establish a 

12 process for prioritizing and accepting the cloud computing 

13 services to be granted a provisional authorization to oper14 ate through the Joint Authorization Board, which shall 

15 be made available on a public website. 

16 ‘‘(e) DETAIL OF PERSONNEL.—To assist the Joint 

17 Authorization Board in discharging the responsibilities 

18 under this section, personnel of agencies may be detailed 

19 to the Joint Authorization Board for the performance of 

20 duties described under subsection (c). 

21 ‘‘§ 3610. Independent assessment organizations 

22 ‘‘(a) REQUIREMENTS FOR ACCREDITATION.—The 

23 Administrator, in consultation with the Joint Authoriza24 tion Board, shall determine the requirements for certifi25 cation of independent assessment organizations. Such reVerDate Sep 11 2014 01:13 Aug 09, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H3941.IH H3941

kjohnson on DSK79L0C42 with BILLS
10 

•HR 3941 IH

1 quirements may include developing or requiring certifi2 cation programs for individuals employed by the inde3 pendent assessment organizations who lead FedRAMP as4 sessment teams. 

5 ‘‘(b) ASSESSMENT.—Accredited independent assess6 ment organizations may assess, validate, and attest to the 

7 quality and compliance of security assessment materials 

8 provided by cloud service providers. 

9 ‘‘§ 3611. Roles and responsibilities of agencies 

10 ‘‘(a) IN GENERAL.—In implementing the require11 ments of FedRAMP, the head of each agency shall, con12 sistent with guidance issued by the Director pursuant to 

13 section 3612— 

14 ‘‘(1) create policies to ensure cloud computing 

15 services used by the agency meet FedRAMP security 

16 requirements and other risk-based performance re17 quirements as defined by the Director; 

18 ‘‘(2) issue agency-specific authorizations to op19 erate for cloud computing services in compliance 

20 with section 3553; 

21 ‘‘(3) confirm whether there is a provisional au22 thorization to operate in the cloud security reposi23 tory established under section 3608(b)(10) issued by 

24 the Joint Authorization Board or a FedRAMP au25 thorization issued by the FedRAMP Program ManVerDate Sep 11 2014 01:13 Aug 09, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H3941.IH H3941

kjohnson on DSK79L0C42 with BILLS
11 

•HR 3941 IH

1 agement Office before beginning an agency author2 ization for a cloud computing product or service; 

3 ‘‘(4) to the extent practicable, for any cloud 

4 computing product or service the agency seeks to au5 thorize that has received either a provisional author6 ization to operate by the Joint Authorization Board 

7 or a FedRAMP authorization by the FedRAMP Pro8 gram Management Office, use the existing assess9 ments of security controls and materials within the 

10 authorization package; and 

11 ‘‘(5) provide data and information required to 

12 the Director pursuant to section 3612 to determine 

13 how agencies are meeting metrics as defined by the 

14 FedRAMP Program Management Office. 

15 ‘‘(b) SUBMISSION OF POLICIES REQUIRED.—Not 

16 later than 6 months after the date of the enactment of 

17 this section, the head of each agency shall submit to the 

18 Director the policies created pursuant to subsection (a)(1) 

19 for review and approval. 

20 ‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE

21 REQUIRED.—Upon issuance of an authorization to oper22 ate, the head of each agency shall provide a copy of the 

23 authorization to operate letter and any supplementary in24 formation required pursuant to section 3608(b) to the 

25 FedRAMP Program Management Office. 


kjohnson on DSK79L0C42 with BILLS
12 

•HR 3941 IH

1 ‘‘(d) PRESUMPTION OF ADEQUACY.— 

2 ‘‘(1) IN GENERAL.—The assessment of security 

3 controls and materials within the authorization 

4 package for provisional authorizations to operate 

5 issued by the Joint Authorization Board and agency 

6 authorizations to operate that receive FedRAMP au7 thorization from the Program Management Office 

8 shall be presumed adequate for use in agency au9 thorizations of cloud computing products and serv10 ices. 

11 ‘‘(2) INFORMATION SECURITY REQUIRE12 MENTS.—The presumption under paragraph (1) 

13 does not modify or alter the responsibility of any 

14 agency to ensure compliance with subchapter II of 

15 chapter 35 for any cloud computing products or 

16 services used by the agency. 

17 ‘‘§ 3612. Roles and responsibilities of the Office of 

18 Management and Budget 

19 ‘‘The Director shall have the following duties: 

20 ‘‘(1) Issue guidance to ensure that an agency 

21 does not operate a Federal Government cloud com22 puting service using Government data without 

23 issuing an authorization to operate issued by the 

24 agency that meets the requirements of subchapter II 

25 of chapter 35 and FedRAMP. 


kjohnson on DSK79L0C42 with BILLS
13 

•HR 3941 IH

1 ‘‘(2) Ensure agencies are in compliance with 

2 any guidance or other requirements issued related to 

3 FedRAMP. 

4 ‘‘(3) Review, analyze, and update guidance on 

5 the adoption, security, and use of cloud computing 

6 services used by agencies. 

7 ‘‘(4) Ensure the Joint Authorization Board is 

8 in compliance with section 3609(c). 

9 ‘‘(5) Promulgate regulations on the role of 

10 FedRAMP authorization in agency acquisition of 

11 cloud computing products and services that process 

12 unclassified information. 

13 ‘‘§ 3613. Authorization of appropriations for 

14 FedRAMP 

15 ‘‘There is authorized to be appropriated $25,000,000 

16 each year for the FedRAMP Program Management Office 

17 and the Joint Authorization Board. 

18 ‘‘§ 3614. Reports to Congress 

19 ‘‘Not later than 12 months after the date of the en20 actment of this section, and annually thereafter, the Di21 rector shall submit to the Committee on Oversight and 

22 Reform of the House of Representatives and the Com23 mittee on Homeland Security and Governmental Affairs 

24 of the Senate a report that includes the following: 


kjohnson on DSK79L0C42 with BILLS
14 

•HR 3941 IH

1 ‘‘(1) The status, efficiency, and effectiveness of 

2 FedRAMP and agencies during the preceding year 

3 in supporting the speed, effectiveness, sharing, 

4 reuse, and security of authorizations to operate for 

5 cloud computing products and services, including 

6 progress towards meeting the metrics adopted by the 

7 FedRAMP Program Management Office pursuant to 

8 section 3608(d) and the Joint Authorization Board 

9 pursuant to section 3609(c)(5). 

10 ‘‘(2) Data on agency use of provisional author11 izations to operate issued by the Joint Authorization 

12 Board and agency sponsored authorizations that re13 ceive FedRAMP authorization by the FedRAMP 

14 Program Management Office. 

15 ‘‘(3) The length of time for the Joint Author16 ization Board to review applications for and issue 

17 provisional authorizations to operate. 

18 ‘‘(4) The length of time for the FedRAMP Pro19 gram Management Office to review agency applica20 tions for and issue FedRAMP authorization. 

21 ‘‘(5) The number of provisional authorizations 

22 to operate issued by each the Joint Authorization 

23 Board and FedRAMP authorizations issued by the 

24 FedRAMP Program Management Office for the pre25 vious year. 


kjohnson on DSK79L0C42 with BILLS
15 

•HR 3941 IH

1 ‘‘(6) A review of progress made during the pre2 ceding year in advancing automation techniques to 

3 securely automate FedRAMP processes and to accel4 erate reporting as described in this section. 

5 ‘‘(7) The number and characteristics of author6 ized cloud computing services in use at each agency 

7 consistent with guidance provided by the Director in 

8 section 3612. 

9 ‘‘§ 3615. Federal Secure Cloud Advisory Committee 

10 ‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 

11 ‘‘(1) ESTABLISHMENT.—The Administrator 

12 shall establish within the General Services Adminis13 tration the Federal Secure Cloud Advisory (referred 

14 to in this section as the ‘Committee’) to ensure ef15 fective and ongoing coordination of agency adoption, 

16 use, authorization, monitoring, acquisition, and secu17 rity of cloud computing products and services to en18 able agency mission and administrative priorities. 

19 ‘‘(2) PURPOSES.—The purposes of the Com20 mittee are to: 

21 ‘‘(A) Examine the operations of FedRAMP 

22 and determine ways that authorization proc23 esses can continuously be improved. 


kjohnson on DSK79L0C42 with BILLS
16 

•HR 3941 IH

1 ‘‘(B) Collect information and feedback on 

2 agency compliance with and implementation of 

3 FedRAMP requirements. 

4 ‘‘(C) Serve as a forum that facilitates com5 munication and collaboration among the 

6 FedRAMP stakeholder community. 

7 ‘‘(3) DUTIES.—The duties of the Committee 

8 are, at a minimum, the following: 

9 ‘‘(A) Provide advice and recommendations 

10 to the Administrator, the Joint Authorization 

11 Board, and to agencies on technical, financial, 

12 programmatic, and operational matters regard13 ing secure adoption of cloud computing services. 

14 ‘‘(B) Submit reports as required. 

15 ‘‘(b) MEMBERS.— 

16 ‘‘(1) COMPOSITION.—The Committee shall be 

17 comprised of not more than 15 members who are 

18 qualified representatives from the public and private 

19 sectors, appointed by the Administrator, in consulta20 tion with the Administrator of the Office of Elec21 tronic Government, as follows: 

22 ‘‘(A) The Administrator or the Administra23 tor’s designee, who shall be the Chair of the 

24 Committee. 


kjohnson on DSK79L0C42 with BILLS
17 

•HR 3941 IH

1 ‘‘(B) At least 1 representative each from 

2 the Cybersecurity and Infrastructure Security 

3 Agency and the National Institute of Standards 

4 and Technology. 

5 ‘‘(C) At least 2 officials who serve as the 

6 Chief Information Security Officer within an 

7 agency, who shall be required to maintain such 

8 a position throughout the duration of their serv9 ice on the Committee. 

10 ‘‘(D) At least 1 official serving as Chief 

11 Procurement Officer (or equivalent) in an agen12 cy, who shall be required to maintain such a po13 sition throughout the duration of their service 

14 on the Committee. 

15 ‘‘(E) No fewer than 5 representatives from 

16 businesses that primarily provide cloud com17 puting services or products, including at least 2 

18 representatives from a small business (as de19 fined by section 3(a) of the Small Business Act 

20 (15 U.S.C. 632(a))). 

21 ‘‘(F) Any other representatives as the Ad22 ministrator determines to be necessary to pro23 vide sufficient balance, insights, or expertise to 

24 the Committee. 


kjohnson on DSK79L0C42 with BILLS
18 

•HR 3941 IH

1 ‘‘(2) DEADLINE FOR APPOINTMENT.—Each 

2 member of the Committee shall be appointed not 

3 later than 30 days after the date of the enactment 

4 of this Act. 

5 ‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 

6 ‘‘(A) IN GENERAL.—Each member of the 

7 Committee shall be appointed for a term of 3 

8 years, except that the initial terms for members 

9 may be staggered 1, 2, or 3 year terms to es10 tablish a rotation in which one-third of the 

11 members are selected each year. Any such 

12 member may be appointed for not more than 2 

13 consecutive terms. 

14 ‘‘(B) VACANCIES.—Any vacancy in the 

15 Committee shall not affect its powers, but shall 

16 be filled in the same manner in which the origi17 nal appointment was made. Any member ap18 pointed to fill a vacancy occurring before the 

19 expiration of the term for which the member’s 

20 predecessor was appointed shall be appointed 

21 only for the remainder of that term. A member 

22 may serve after the expiration of that member’s 

23 term until a successor has taken office. 

24 ‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 


kjohnson on DSK79L0C42 with BILLS
19 

•HR 3941 IH

1 ‘‘(1) MEETINGS.—The Committee shall hold 

2 not less than 3 meetings in a calendar year, at such 

3 time and place as determined by the Chair. 

4 ‘‘(2) INITIAL MEETING.—Not later than 120 

5 days after the date of the enactment of this section, 

6 the Committee shall meet and begin the operations 

7 of the Committee. 

8 ‘‘(3) RULES OF PROCEDURE.—The Committee 

9 may establish rules for the conduct of the business 

10 of the Committee, if such rules are not inconsistent 

11 with this section or other applicable law. 

12 ‘‘(d) TRAVEL EXPENSES.—While away from their 

13 homes or regular places of business in the performance 

14 of services for the Committee, members of the Committee 

15 shall be allowed travel expenses, including per diem in lieu 

16 of subsistence, in the same manner as persons employed 

17 intermittently in the Government service are allowed ex18 penses under section 5703(b) of title 5, United States 

19 Code. 

20 ‘‘(e) APPLICABILITY TO THE FEDERAL ADVISORY

21 COMMITTEE ACT.—Notwithstanding any other provision 

22 of law, the Federal Advisory Committee Act (5 U.S.C. 

23 App.) shall apply to the Committee, except that section 

24 14 of such Act shall not apply. 


kjohnson on DSK79L0C42 with BILLS
20 

•HR 3941 IH

1 ‘‘(f) HEARINGS AND EVIDENCE.—The Committee, or 

2 on the authority of the Committee, any subcommittee, 

3 may, for the purposes of carrying out this section, hold 

4 hearings, sit and act at such times and places, take testi5 mony, receive evidence, and administer oaths. 

6 ‘‘(g) CONTRACTING.—The Committee, may, to such 

7 extent and in such amounts as are provided in appropria8 tion Acts, enter into contracts to enable the Committee 

9 to discharge its duties under this section. 

10 ‘‘(h) INFORMATION FROM FEDERAL AGENCIES.— 

11 ‘‘(1) IN GENERAL.—The Committee is author12 ized to secure directly from any executive depart13 ment, bureau, agency, board, commission, office, 

14 independent establishment, or instrumentality of the 

15 Government, information, suggestions, estimates, 

16 and statistics for the purposes of the Committee. 

17 Each department, bureau, agency, board, commis18 sion, office, independent establishment, or instru19 mentality shall, to the extent authorized by law, fur20 nish such information, suggestions, estimates, and 

21 statistics directly to the Committee, upon request 

22 made by the Chair, the Chair of any subcommittee 

23 created by a majority of the Committee, or any 

24 member designated by a majority of the Committee. 


kjohnson on DSK79L0C42 with BILLS
21 

•HR 3941 IH

1 ‘‘(2) RECEIPT, HANDLING, STORAGE, AND DIS2 SEMINATION.—Information may only be received, 

3 handled, stored, and disseminated by members of 

4 the Committee and its staff consistent with all appli5 cable statutes, regulations, and Executive orders. 

6 ‘‘(i) ASSISTANCE FROM AGENCIES.— 

7 ‘‘(1) OTHER DEPARTMENTS AND AGENCIES.— 

8 In addition to the administration of the Committee 

9 by the General Services Administration, other agen10 cies may provide to the Committee such services, 

11 funds, facilities, staff, and other support services as 

12 the head of the agency determines to be advisable 

13 and as is authorized by law. 

14 ‘‘(2) DETAIL OF EMPLOYEES.—Any Federal 

15 Government employee may be detailed to the Com16 mittee without reimbursement from the Committee, 

17 and such detailee shall retain the rights, status, and 

18 privileges of his or her regular employment without 

19 interruption. 

20 ‘‘(j) GIFTS.—The Committee may accept, use, and 

21 dispose of gifts or donations of services or property. 

22 ‘‘(k) POSTAL SERVICES.—The Committee may use 

23 the United States mails in the same manner and under 

24 the same conditions as agencies. 


kjohnson on DSK79L0C42 with BILLS
22 

•HR 3941 IH

1 ‘‘(l) EXPERT AND CONSULTANT SERVICES.—The 

2 Committee is authorized to procure the services of experts 

3 and consultants in accordance with section 3109 of title 

4 5, but at rates not to exceed the daily rate paid a person 

5 occupying a position at Level IV of the Executive Schedule 

6 under section 5315 of title 5. 

7 ‘‘(m) VOLUNTEER SERVICES.—Notwithstanding sec8 tion 1342 of title 31, the Committee may accept and use 

9 voluntary and uncompensated services as the Committee 

10 determines necessary. 

11 ‘‘(n) REPORTS.— 

12 ‘‘(1) INTERIM REPORTS.—The Committee may 

13 submit to the Administrator and Congress interim 

14 reports containing such findings, conclusions, and 

15 recommendations as have been agreed to by the 

16 Committee. 

17 ‘‘(2) ANNUAL REPORTS.—Not later than 18 

18 months after the date of the enactment of this sec19 tion, and annually thereafter, the Committee shall 

20 submit to the Administrator and Congress a final re21 port containing such findings, conclusions, and rec22 ommendations as have been agreed to by the Com23 mittee. 

24 ‘‘(o) SUNSET PROVISION.—The authority and obliga25 tions established by this section shall terminate on the 


kjohnson on DSK79L0C42 with BILLS
23 

•HR 3941 IH

1 date that is five years after the date of the enactment of 

2 this section. 

3 ‘‘§ 3616. Definitions 

4 ‘‘(a) IN GENERAL.—Except as provided under sub5 section (b), the definitions under sections 3502 and 3552 

6 apply to sections 3607 through this section. 

7 ‘‘(b) ADDITIONAL DEFINITIONS.—In sections 3607 

8 through this section: 

9 ‘‘(1) ADMINISTRATOR.—The term ‘Adminis10 trator’ means the Administrator of General Services. 

11 ‘‘(2) AUTHORIZATION PACKAGE.—The term 

12 ‘authorization package’— 

13 ‘‘(A) means the essential information used 

14 to determine whether to authorize the operation 

15 of an information system or the use of a des16 ignated set of common controls; and 

17 ‘‘(B) at a minimum, includes the informa18 tion system security plan, privacy plan, security 

19 control assessment, privacy control assessment, 

20 and any relevant plans of action and milestones. 

21 ‘‘(3) CLOUD BROKER.—The term ‘cloud broker’ 

22 means an entity that manages the use, performance, 

23 and delivery of cloud computing services and nego24 tiates relationships between cloud service providers 

25 and cloud consumers. 


kjohnson on DSK79L0C42 with BILLS
24 

•HR 3941 IH

1 ‘‘(4) CLOUD COMPUTING.—The term ‘cloud 

2 computing’ has the meaning given that term by the 

3 National Institutes of Standards and Technology in 

4 NIST Special Publication 800–145 and any amend5 atory or superseding document thereto. 

6 ‘‘(5) CLOUD SERVICE PROVIDER.—The term 

7 ‘cloud service provider’ means a non-Federal entity 

8 offering cloud computing services to agencies. 

9 ‘‘(6) FEDRAMP.—The term ‘FedRAMP’ 

10 means the Federal Risk and Authorization Manage11 ment Program established under section 3607(a). 

12 ‘‘(7) FEDRAMP AUTHORIZATION.—The term 

13 ‘FedRAMP authorization’ means a cloud computing 

14 product or service that has received an agency au15 thorization to operate and has been certified by the 

16 FedRAMP Program Management Office to meet re17 quirements and guidelines established by the 

18 FedRAMP Program Management Office. 

19 ‘‘(8) FEDRAMP PROGRAM MANAGEMENT OF20 FICE.—The term ‘FedRAMP Program Management 

21 Office’ means the office that administers FedRAMP. 

22 ‘‘(9) INDEPENDENT ASSESSMENT ORGANIZA23 TION.—The term ‘independent assessment organiza24 tion’ means a third-party organization accredited by 

25 the Program Director of the FedRAMP Program 


kjohnson on DSK79L0C42 with BILLS
25 

•HR 3941 IH

1 Management Office to undertake conformity assess2 ments of cloud service providers. 

3 ‘‘(10) JOINT AUTHORIZATION BOARD.—The 

4 term ‘Joint Authorization Board’ means the Joint 

5 Authorization Board established under section 3609. 

6 ‘‘(11) SECURITY ARCHITECTURE.—The term 

7 ‘security architecture’ means a set of physical and 

8 logical security-relevant representations of system 

9 architecture that conveys information about how the 

10 system is partitioned into security domains and 

11 makes use of security-relevant elements to enforce 

12 security policies within and between security do13 mains based on how data and information must be 

14 protected.’’. 

15 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

16 The table of sections for chapter 36 of title 44, United 

17 States Code, is amended by adding at the end the fol18 lowing new items: 

‘‘3607. Federal Risk and Authorization Management Program. 

‘‘3608. FedRAMP Program Management Office. 

‘‘3609. Joint Authorization Board. 

‘‘3610. Independent assessment organizations. 

‘‘3611. Roles and responsibilities of agencies. 

‘‘3612. Roles and responsibilities of the Office of Management and Budget. 

‘‘3613. Authorization of appropriations for FedRAMP. 

‘‘3614. Reports to Congress. 

‘‘3615. Federal Secure Cloud Advisory Committee. 

‘‘3616. Definitions.’’. 

Æ 


kjohnson on DSK79L0C42 with BILLS