I 
117TH CONGRESS 
1ST SESSION 
H. R. 21 
To enhance the innovation, security, and availability of cloud computing 
products and services used in the Federal Government by establishing 
the Federal Risk and Authorization Management Program within the 
General Services Administration and by establishing a risk management, 
authorization, and continuous monitoring process to enable the Federal 
Government to leverage cloud computing products and services using 
a risk-based approach consistent with the Federal Information Security 
Modernization Act of 2014 and cloud-based operations, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 4, 2021 
Mr. CONNOLLY (for himself, Mr. COMER, and Mr. HICE of Georgia) intro-
duced the following bill; which was referred to the Committee on Over-
sight and Reform 
A BILL 
To enhance the innovation, security, and availability of cloud 
computing products and services used in the Federal 
Government by establishing the Federal Risk and Au-
thorization Management Program within the General 
Services Administration and by establishing a risk man-
agement, authorization, and continuous monitoring proc-
ess to enable the Federal Government to leverage cloud 
computing products and services using a risk-based ap-
proach consistent with the Federal Information Security 
Modernization Act of 2014 and cloud-based operations, 
and for other purposes. 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Risk and Au-
thorization Management Program Authorization Act of 
2021’’ or the ‘‘FedRAMP Authorization Act’’. 
SEC. 2. CODIFICATION OF THE FEDRAMP PROGRAM. 
(a) AMENDMENT.—Chapter 36 of title 44, United 
States Code, is amended by adding at the end the fol-
lowing new sections: 
‘‘§ 3607. Federal Risk and Authorization Management 
Program 
‘‘(a) ESTABLISHMENT.—There is established within 
the General Services Administration the Federal Risk and 
Authorization Management Program. The Administrator 
of General Services, in accordance with section 3612, shall 
establish a governmentwide program that provides the au-
thoritative standardized approach to security assessment 
and authorization for cloud computing products and serv-
ices that process unclassified information used by agen-
cies. 
‘‘(b) COMPONENTS OF FEDRAMP.—The Joint Au-
thorization Board and the FedRAMP Program Manage-
ment Office are established as components of FedRAMP. 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
‘‘§ 3608. FedRAMP Program Management Office 
‘‘(a) GSA DUTIES.— 
‘‘(1) ROLES AND RESPONSIBILITIES.—The Ad-
ministrator of General Services shall— 
‘‘(A) determine the categories and charac-
teristics of cloud computing products and serv-
ices that are within the jurisdiction of 
FedRAMP and that require a FedRAMP au-
thorization or a FedRAMP provisional author-
ization; 
‘‘(B) develop, coordinate, and implement a 
process for the FedRAMP Program Manage-
ment Office, the Joint Authorization Board, 
and agencies to review security assessments of 
cloud computing products and services pursuant 
to subsections (b) and (c) of section 3611, and 
appropriate oversight of continuous monitoring 
of cloud computing products and services; and 
‘‘(C) ensure the continuous improvement of 
FedRAMP. 
‘‘(2) IMPLEMENTATION.—The Administrator 
shall oversee the implementation of FedRAMP, in-
cluding— 
‘‘(A) appointing a Program Director to 
oversee the FedRAMP Program Management 
Office; 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) hiring professional staff as may be 
necessary for the effective operation of the 
FedRAMP Program Management Office, and 
such other activities as are essential to properly 
perform critical functions; 
‘‘(C) entering into interagency agreements 
to detail personnel on a reimbursable or non-re-
imbursable basis to assist the FedRAMP Pro-
gram Management Office and the Joint Author-
ization Board in discharging the responsibilities 
of the Office under this section; and 
‘‘(D) such other actions as the Adminis-
trator may determine necessary to carry out 
this section. 
‘‘(b) DUTIES.—The FedRAMP Program Manage-
ment Office shall have the following duties: 
‘‘(1) Provide guidance to independent assess-
ment organizations, validate the independent assess-
ments, and apply the requirements and guidelines 
adopted in section 3609(c)(5). 
‘‘(2) Oversee and issue guidelines regarding the 
necessary requirements for accreditation of third- 
party organizations seeking to be awarded accredita-
tion as independent assessment organizations, in-
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
cluding qualifications, roles, and responsibilities of 
independent assessment organizations. 
‘‘(3) Develop templates and other materials to 
support the Joint Authorization Board and agencies 
in the authorization of cloud computing products 
and services to increase the speed, effectiveness, and 
transparency of the authorization process, consistent 
with standards defined by the National Institute of 
Standards and Technology. 
‘‘(4) Establish and maintain a public comment 
process for proposed guidance before the issuance of 
such guidance by FedRAMP. 
‘‘(5) Review any authorization to operate issued 
by an agency to determine if the authorization meets 
the requirements and guidelines adopted in section 
3609(c)(5). 
‘‘(6) Establish frameworks for agencies to use 
authorization packages processed by the FedRAMP 
Program Management Office and Joint Authoriza-
tion Board. 
‘‘(7) Coordinate with the Secretary of Defense 
and the Secretary of Homeland Security to establish 
a framework for continuous monitoring under sec-
tion 3553 and agency reports required under section 
3554. 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
‘‘(8) Establish a centralized and secure reposi-
tory to collect and share necessary data, including 
security authorization packages, from the Joint Au-
thorization Board and agencies to enable better 
sharing and reuse of such packages across agencies. 
‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 
‘‘(1) IN
GENERAL.—The FedRAMP Program 
Management Office shall assess and evaluate avail-
able automation capabilities and procedures to im-
prove the efficiency and effectiveness of the issuance 
of FedRAMP authorizations and FedRAMP provi-
sional authorizations, including continuous moni-
toring of cloud computing products and services. 
‘‘(2) MEANS FOR AUTOMATION.—Not later than 
1 year after the date of the enactment of this sec-
tion, 
and 
updated 
annually 
thereafter, 
the 
FedRAMP Program Management Office shall estab-
lish a means for the automation of security assess-
ments and reviews. 
‘‘(d) 
METRICS
FOR
AUTHORIZATION.—The 
FedRAMP Program Management Office shall establish 
annual metrics regarding the time and quality of the as-
sessments necessary for completion of a FedRAMP au-
thorization process in a manner that can be consistently 
tracked over time in conjunction with the periodic testing 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
and evaluation process pursuant to section 3554 in a man-
ner that minimizes the agency reporting burden. 
‘‘§ 3609. Joint Authorization Board 
‘‘(a) ESTABLISHMENT.—The Joint Authorization 
Board shall consist of cloud computing experts, appointed 
by the Director in consultation with the Administrator, 
from each of the following: 
‘‘(1) The Department of Defense. 
‘‘(2) The Department of Homeland Security. 
‘‘(3) The General Services Administration. 
‘‘(4) Such other agencies as determined by the 
Director, in consultation with the Administrator. 
‘‘(b) ISSUANCE
OF FEDRAMP PROVISIONAL AU-
THORIZATIONS.—The Joint Authorization Board shall 
conduct security assessments of cloud computing products 
and services and issue FedRAMP provisional authoriza-
tions to cloud service providers that meet the requirements 
and guidelines established in subsection (c)(5). 
‘‘(c) DUTIES.—The Joint Authorization Board 
shall— 
‘‘(1) develop and make publicly available on a 
website, determined by the Administrator, criteria 
for prioritizing and selecting cloud computing prod-
ucts and services to be assessed by the Joint Author-
ization Board; 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
‘‘(2) provide regular updates to applicant cloud 
service providers on the status of any cloud com-
puting product or service during the assessment and 
authorization process of the Joint Authorization 
Board; 
‘‘(3) review and validate cloud computing prod-
ucts and services and materials submitted by inde-
pendent assessment organizations or any documenta-
tion determined to be necessary by the Joint Author-
ization Board to evaluate the system security of a 
cloud computing product or service; 
‘‘(4) in consultation with the FedRAMP Pro-
gram Management Office, serve as a resource for 
best practices to accelerate the process for obtaining 
a FedRAMP authorization or FedRAMP provisional 
authorization; 
‘‘(5) establish requirements and guidelines for 
security assessments of cloud computing products 
and services, consistent with standards defined by 
the National Institute of Standards and Technology, 
to be used by the Joint Authorization Board and 
agencies; 
‘‘(6) perform such other roles and responsibil-
ities as the Administrator may assign, in consulta-
tion with the FedRAMP Program Management Of-
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
fice and members of the Joint Authorization Board; 
and 
‘‘(7) establish metrics and goals for reviews and 
activities associated with issuing FedRAMP provi-
sional authorizations and provide to the FedRAMP 
Program Management Office. 
‘‘(d) DETERMINATIONS
OF DEMAND
FOR CLOUD 
COMPUTING PRODUCTS AND SERVICES.—The Joint Au-
thorization Board shall consult with the Chief Information 
Officers Council established in section 3603 to establish 
a process, that shall be made available on a public website, 
for prioritizing and accepting the cloud computing prod-
ucts and services to be granted a FedRAMP provisional 
authorization. 
‘‘(e) DETAIL OF PERSONNEL.—To assist the Joint 
Authorization Board in discharging the responsibilities 
under this section, personnel of agencies may be detailed 
to the Joint Authorization Board for the performance of 
duties described under subsection (c). 
‘‘§ 3610. Independent assessment organizations 
‘‘(a) REQUIREMENTS
FOR
ACCREDITATION.—The 
Joint Authorization Board shall determine the require-
ments for the accreditation of a third-party organization 
seeking to be accredited as an independent assessment or-
ganization, ensuring adequate implementation of section 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
3609. Such requirements may include developing or re-
quiring certification programs for individuals employed by 
the third-party organization seeking accreditation. The 
Program Director of the FedRAMP Program Manage-
ment Office shall accredit any third-party organization 
that meets the requirements for accreditation. 
‘‘(b) ASSESSMENT.—An independent assessment or-
ganization may assess, validate, and attest to the quality 
and compliance of security assessment materials provided 
by cloud service providers as part of the FedRAMP au-
thorization or the FedRAMP provisional authorization 
process. 
‘‘§ 3611. Roles and responsibilities of agencies 
‘‘(a) IN GENERAL.—In implementing the require-
ments of FedRAMP, the head of each agency shall, con-
sistent with guidance issued by the Director pursuant to 
section 3612— 
‘‘(1) create policies to ensure cloud computing 
products and services used by the agency meet 
FedRAMP security requirements and other risk- 
based performance requirements as defined by the 
Director; 
‘‘(2) issue agency-specific authorizations to op-
erate for cloud computing services in compliance 
with section 3554; 
VerDate Sep 11 2014 
03:41 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
‘‘(3) confirm whether there is a FedRAMP au-
thorization or FedRAMP provisional authorization 
in the cloud security repository established under 
section 3608(b)(8) before beginning the process to 
award a FedRAMP authorization or a FedRAMP 
provisional authorization for a cloud computing 
product or service; 
‘‘(4) to the extent practicable, for any cloud 
computing product or service the agency seeks to au-
thorize that has received a FedRAMP authorization 
or FedRAMP provisional authorization, use the ex-
isting assessments of security controls and materials 
within the authorization package; and 
‘‘(5) provide data and information required to 
the Director pursuant to section 3612 to determine 
how agencies are meeting metrics as defined by the 
FedRAMP Program Management Office. 
‘‘(b) SUBMISSION
OF POLICIES REQUIRED.—Not 
later than 6 months after the date of the enactment of 
this section, the head of each agency shall submit to the 
Director the policies created pursuant to subsection (a)(1) 
for review and approval. 
‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE 
REQUIRED.—Upon issuance of an agency authorization to 
operate, the head of the agency shall provide a copy of 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
the authorization to operate letter and any supplementary 
information required pursuant to section 3608(b) to the 
FedRAMP Program Management Office. 
‘‘(d) PRESUMPTION OF ADEQUACY.— 
‘‘(1) IN GENERAL.—The assessment of security 
controls and materials within the authorization 
package 
for 
a 
FedRAMP 
authorization 
or 
FedRAMP provisional authorization shall be pre-
sumed adequate for use in an agency authorization 
to operate cloud computing products and services. 
‘‘(2) 
INFORMATION
SECURITY
REQUIRE-
MENTS.—The presumption under paragraph (1) 
does not modify or alter the responsibility of any 
agency to ensure compliance with subchapter II of 
chapter 35 for any cloud computing products or 
services used by the agency. 
‘‘§ 3612. Roles and responsibilities of the Office of 
Management and Budget 
‘‘The Director shall have the following duties: 
‘‘(1) Issue guidance to ensure that an agency 
does not operate a Federal Government cloud com-
puting product or service using Government data 
without an authorization to operate issued by the 
agency that meets the requirements of subchapter II 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
of chapter 35 and the FedRAMP authorization or 
FedRAMP provisional authorization. 
‘‘(2) Ensure agencies are in compliance with 
any guidance or other requirements issued related to 
FedRAMP. 
‘‘(3) Review, analyze, and update guidance on 
the adoption, security, and use of cloud computing 
services used by agencies. 
‘‘(4) Ensure the Joint Authorization Board is 
in compliance with section 3609(c). 
‘‘(5) Adjudicate disagreements between the 
Joint Authorization Board and cloud service pro-
viders seeking a FedRAMP provisional authoriza-
tion. 
‘‘(6) Promulgate regulations on the role of 
FedRAMP authorizations and FedRAMP provisional 
authorizations in agency acquisition of cloud com-
puting products and services that process unclassi-
fied information. 
‘‘§ 3613. 
Authorization 
of 
appropriations 
for 
FEDRAMP 
‘‘There is authorized to be appropriated $20,000,000 
each year for the FedRAMP Program Management Office 
and the Joint Authorization Board. 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
‘‘§ 3614. Reports to Congress; GAO Report 
‘‘(a) REPORTS TO CONGRESS.—Not later than 12 
months after the date of the enactment of this section, 
and annually thereafter, the Director shall submit to the 
Committee on Oversight and Reform of the House of Rep-
resentatives and the Committee on Homeland Security 
and Governmental Affairs of the Senate a report that in-
cludes the following: 
‘‘(1) The status, efficiency, and effectiveness of 
FedRAMP Program Management Office and agen-
cies during the preceding year in supporting the 
speed, effectiveness, sharing, reuse, and security of 
authorizations to operate for cloud computing prod-
ucts and services, including progress towards meet-
ing the metrics adopted by the FedRAMP Program 
Management Office pursuant to section 3608(d) and 
the Joint Authorization Board pursuant to section 
3609(c)(5). 
‘‘(2) Data on FedRAMP authorizations and 
FedRAMP provisional authorizations. 
‘‘(3) The average length of time for the Joint 
Authorization Board to review applications for and 
issue FedRAMP provisional authorizations. 
‘‘(4) The average length of time for the 
FedRAMP Program Management Office to review 
authorizations to operate. 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS
‘‘(5) The number of FedRAMP authorizations 
and FedRAMP provisional authorizations issued for 
the previous year. 
‘‘(6) A review of progress made during the pre-
ceding year in advancing automation techniques to 
securely automate FedRAMP processes and to accel-
erate reporting as described in this section. 
‘‘(7) The number and characteristics of author-
ized cloud computing products and services in use at 
each agency consistent with guidance provided by 
the Director in section 3612. 
‘‘(8) The cost incurred by agencies and cloud 
service 
providers 
related 
to 
the 
issuance 
of 
FedRAMP authorizations and FedRAMP provisional 
authorizations, including information responsive to 
the report required in subsection (b). 
‘‘(b) GAO REPORT.—Not later than 6 months after 
the date of the enactment of this section, the Comptroller 
General of the United States shall publish a report that 
includes an assessment of the cost incurred by agencies 
and cloud service providers related to the issuance of 
FedRAMP authorizations and FedRAMP provisional au-
thorizations. 
‘‘§ 3615. Federal Secure Cloud Advisory Committee 
‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 
VerDate Sep 11 2014 
03:00 Jan 05, 2021
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H21.IH
H21
kjohnson on DSK79L0C42PROD with BILLS