H. R. 7776—1057 
‘‘(5) grant FedRAMP authorizations to cloud computing 
products and services consistent with the guidance and direc-
tion of the FedRAMP Board; 
‘‘(6) establish and maintain a public comment process for 
proposed guidance and other FedRAMP directives that may 
have a direct impact on cloud service providers and agencies 
before the issuance of such guidance or other FedRAMP direc-
tives; 
‘‘(7) coordinate with the FedRAMP Board, the Director 
of the Cybersecurity and Infrastructure Security Agency, and 
other entities identified by the Administrator, with the concur-
rence of the Director and the Secretary, to establish and regu-
larly update a framework for continuous monitoring under sec-
tion 3553; 
‘‘(8) provide a secure mechanism for storing and sharing 
necessary data, including FedRAMP authorization packages, 
to enable better reuse of such packages across agencies, 
including making available any information and data necessary 
for agencies to fulfill the requirements of section 3613; 
‘‘(9) provide regular updates to applicant cloud service pro-
viders on the status of any cloud computing product or service 
during an assessment process; 
‘‘(10) regularly review, in consultation with the FedRAMP 
Board— 
‘‘(A) the costs associated with the independent assess-
ment services described in section 3611; and 
‘‘(B) the information relating to foreign interests sub-
mitted pursuant to section 3612; 
‘‘(11) in coordination with the Director, the Secretary, and 
other stakeholders, as appropriate, determine the sufficiency 
of underlying requirements to identify and assess the prove-
nance of the software in cloud services and products; 
‘‘(12) support the Federal Secure Cloud Advisory Committee 
established pursuant to section 3616; and 
‘‘(13) take such other actions as the Administrator may 
determine necessary to carry out FedRAMP. 
‘‘(b) WEBSITE.— 
‘‘(1) IN
GENERAL.—The Administrator shall maintain a 
public website to serve as the authoritative repository for 
FedRAMP, including the timely publication and updates for 
all relevant information, guidance, determinations, and other 
materials required under subsection (a). 
‘‘(2) CRITERIA AND PROCESS FOR FEDRAMP AUTHORIZATION 
PRIORITIES.—The Administrator shall develop and make pub-
licly available on the website described in paragraph (1) the 
criteria and process for prioritizing and selecting cloud com-
puting products and services that will receive a FedRAMP 
authorization, in consultation with the FedRAMP Board and 
the Chief Information Officers Council. 
‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 
‘‘(1) IN GENERAL.—The Administrator, in coordination with 
the Secretary, shall assess and evaluate available automation 
capabilities and procedures to improve the efficiency and 
effectiveness of the issuance of FedRAMP authorizations, 
including continuous monitoring of cloud computing products 
and services.
H. R. 7776—1058 
‘‘(2) MEANS FOR AUTOMATION.—Not later than 1 year after 
the date of enactment of this section, and updated regularly 
thereafter, the Administrator shall establish a means for the 
automation of security assessments and reviews. 
‘‘(d) METRICS
FOR AUTHORIZATION.—The Administrator shall 
establish annual metrics regarding the time and quality of the 
assessments necessary for completion of a FedRAMP authorization 
process in a manner that can be consistently tracked over time 
in conjunction with the periodic testing and evaluation process 
pursuant to section 3554 in a manner that minimizes the agency 
reporting burden. 
‘‘§ 3610. FedRAMP Board 
‘‘(a) ESTABLISHMENT.—There is established a FedRAMP Board 
to provide input and recommendations to the Administrator 
regarding 
the 
requirements 
and 
guidelines 
for, 
and 
the 
prioritization of, security assessments of cloud computing products 
and services. 
‘‘(b) MEMBERSHIP.—The FedRAMP Board shall consist of not 
more than 7 senior officials or experts from agencies appointed 
by the Director, in consultation with the Administrator, from each 
of the following: 
‘‘(1) The Department of Defense. 
‘‘(2) The Department of Homeland Security. 
‘‘(3) The General Services Administration. 
‘‘(4) Such other agencies as determined by the Director, 
in consultation with the Administrator. 
‘‘(c) QUALIFICATIONS.—Members of the FedRAMP Board 
appointed under subsection (b) shall have technical expertise in 
domains relevant to FedRAMP, such as— 
‘‘(1) cloud computing; 
‘‘(2) cybersecurity; 
‘‘(3) privacy; 
‘‘(4) risk management; and 
‘‘(5) other competencies identified by the Director to support 
the secure authorization of cloud services and products. 
‘‘(d) DUTIES.—The FedRAMP Board shall— 
‘‘(1) in consultation with the Administrator, serve as a 
resource for best practices to accelerate the process for obtaining 
a FedRAMP authorization; 
‘‘(2) establish and regularly update requirements and guide-
lines for security authorizations of cloud computing products 
and services, consistent with standards and guidelines estab-
lished by the Director of the National Institute of Standards 
and Technology, to be used in the determination of FedRAMP 
authorizations; 
‘‘(3) monitor and oversee, to the greatest extent practicable, 
the processes and procedures by which agencies determine and 
validate requirements for a FedRAMP authorization, including 
periodic review of the agency determinations described in sec-
tion 3613(b); 
‘‘(4) ensure consistency and transparency between agencies 
and cloud service providers in a manner that minimizes confu-
sion and engenders trust; and 
‘‘(5) perform such other roles and responsibilities as the 
Director may assign, with concurrence from the Administrator.
H. R. 7776—1059 
‘‘(e) DETERMINATIONS OF DEMAND FOR CLOUD COMPUTING PROD-
UCTS AND SERVICES.—The FedRAMP Board may consult with the 
Chief Information Officers Council to establish a process, which 
may be made available on the website maintained under section 
3609(b), for prioritizing and accepting the cloud computing products 
and services to be granted a FedRAMP authorization. 
‘‘§ 3611. Independent assessment 
‘‘The Administrator may determine whether FedRAMP may 
use an independent assessment service to analyze, validate, and 
attest to the quality and compliance of security assessment mate-
rials provided by cloud service providers during the course of a 
determination of whether to use a cloud computing product or 
service. 
‘‘§ 3612. Declaration of foreign interests 
‘‘(a) IN GENERAL.—An independent assessment service that per-
forms services described in section 3611 shall annually submit 
to the Administrator information relating to any foreign interest, 
foreign influence, or foreign control of the independent assessment 
service. 
‘‘(b) UPDATES.—Not later than 48 hours after there is a change 
in foreign ownership or control of an independent assessment 
service that performs services described in section 3611, the inde-
pendent assessment service shall submit to the Administrator an 
update to the information submitted under subsection (a). 
‘‘(c) CERTIFICATION.—The Administrator may require a rep-
resentative of an independent assessment service to certify the 
accuracy and completeness of any information submitted under 
this section. 
‘‘§ 3613. Roles and responsibilities of agencies 
‘‘(a) IN
GENERAL.—In implementing the requirements of 
FedRAMP, the head of each agency shall, consistent with guidance 
issued by the Director pursuant to section 3614— 
‘‘(1) promote the use of cloud computing products and serv-
ices that meet FedRAMP security requirements and other risk- 
based performance requirements as determined by the Director, 
in consultation with the Secretary; 
‘‘(2) confirm whether there is a FedRAMP authorization 
in the secure mechanism provided under section 3609(a)(8) 
before beginning the process of granting a FedRAMP authoriza-
tion for a cloud computing product or service; 
‘‘(3) to the extent practicable, for any cloud computing 
product or service the agency seeks to authorize that has 
received a FedRAMP authorization, use the existing assess-
ments of security controls and materials within any FedRAMP 
authorization package for that cloud computing product or 
service; and 
‘‘(4) provide to the Director data and information required 
by the Director pursuant to section 3614 to determine how 
agencies are meeting metrics established by the Administrator. 
‘‘(b) 
ATTESTATION.—Upon 
completing 
an 
assessment 
or 
authorization activity with respect to a particular cloud computing 
product or service, if an agency determines that the information 
and data the agency has reviewed under paragraph (2) or (3) 
of subsection (a) is wholly or substantially deficient for the purposes
H. R. 7776—1060 
of performing an authorization of the cloud computing product 
or service, the head of the agency shall document as part of the 
resulting FedRAMP authorization package the reasons for this 
determination. 
‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE REQUIRED.— 
Upon issuance of an agency authorization to operate based on 
a FedRAMP authorization, the head of the agency shall provide 
a copy of its authorization to operate letter and any supplementary 
information required pursuant to section 3609(a) to the Adminis-
trator. 
‘‘(d) SUBMISSION OF POLICIES REQUIRED.—Not later than 180 
days after the date on which the Director issues guidance in accord-
ance with section 3614(1), the head of each agency, acting through 
the chief information officer of the agency, shall submit to the 
Director all agency policies relating to the authorization of cloud 
computing products and services. 
‘‘(e) PRESUMPTION OF ADEQUACY.— 
‘‘(1) IN GENERAL.—The assessment of security controls and 
materials within the authorization package for a FedRAMP 
authorization shall be presumed adequate for use in an agency 
authorization to operate cloud computing products and services. 
‘‘(2) INFORMATION SECURITY REQUIREMENTS.—The presump-
tion under paragraph (1) does not modify or alter— 
‘‘(A) the responsibility of any agency to ensure compli-
ance with subchapter II of chapter 35 for any cloud com-
puting product or service used by the agency; or 
‘‘(B) the authority of the head of any agency to make 
a determination that there is a demonstrable need for 
additional security requirements beyond the security 
requirements included in a FedRAMP authorization for 
a particular control implementation. 
‘‘§ 3614. Roles and responsibilities of the Office of Manage-
ment and Budget 
‘‘The Director shall— 
‘‘(1) in consultation with the Administrator and the Sec-
retary, issue guidance that— 
‘‘(A) specifies the categories or characteristics of cloud 
computing products and services that are within the scope 
of FedRAMP; 
‘‘(B) includes requirements for agencies to obtain a 
FedRAMP authorization when operating a cloud computing 
product or service described in subparagraph (A) as a Fed-
eral information system; and 
‘‘(C) encompasses, to the greatest extent practicable, 
all necessary and appropriate cloud computing products 
and services; 
‘‘(2) issue guidance describing additional responsibilities 
of FedRAMP and the FedRAMP Board to accelerate the adop-
tion of secure cloud computing products and services by the 
Federal Government; 
‘‘(3) in consultation with the Administrator, establish a 
process to periodically review FedRAMP authorization packages 
to support the secure authorization and reuse of secure cloud 
products and services;