FedRAMP Program Management Office by agencies 
and a description of and progress towards meeting 
the metrics adopted by the FedRAMP Program 
Management Office pursuant to section 3608(e), as 
submitted to the Administrator by that Office. 
‘‘§ 3608. Roles and responsibilities of the FedRAMP 
Program Management Office 
‘‘(a) IMPLEMENTATION.—Upon delegation from the 
Office of Electronic Government, the Administrator shall 
oversee the implementation of FedRAMP, including— 
‘‘(1) appointing a Program Director to oversee 
the FedRAMP Program Management Office; 
‘‘(2) hiring professional staff as may be nec-
essary for the effective operation of the FedRAMP 
Program Management Office, and such other activi-
ties as are essential to properly perform critical 
functions; and 
‘‘(3) such other actions as the Administrator 
may determine necessary to carry out this section. 
‘‘(b) AUTHORITY AND DUTIES.—The FedRAMP Pro-
gram Management Office shall have the following author-
ity and duties: 
‘‘(1) Provide guidance to agencies, regarding 
compliance with requirements, guidelines, and stand-
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
ards developed by the National Institute of Stand-
ards and Technology. 
‘‘(2) Provide guidance to third party assess-
ment organizations in using and applying the re-
quirements, guidelines, and standards adopted by 
FedRAMP. 
‘‘(3) Provide guidance to agencies on appro-
priate use of and acquisition of FedRAMP approved 
services, including the role of cloud brokers and 
cloud service integrators. 
‘‘(4) In consultation with the Director and the 
Secretary of Homeland Security, issue guidance for 
agencies on monitoring and reporting on the usage 
and demand of cloud computing, use of automation, 
and use of commercial cloud services to the fullest 
extent practical. 
‘‘(5) In consultation with the Federal Chief In-
formation Officer, oversee and issue guidelines re-
garding the qualifications, roles, and responsibilities 
of third party assessment organizations, in consulta-
tion with the National Institute of Standards and 
Technology. 
‘‘(6) Develop standards and templates, includ-
ing a summary risk report template for third party 
assessment organizations that informs the security 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
assessment report to complement the existing au-
thorization package artifacts and serve as an author-
ization decision-making tool. 
‘‘(7) Coordinate with stakeholders to provide 
guidance 
and 
recommendations 
to 
FedRAMP. 
Stakeholders to include— 
‘‘(A) agency cloud customers; 
‘‘(B) cloud service providers; 
‘‘(C) third party assessment organizations; 
‘‘(D) agency Offices of Inspector General; 
and 
‘‘(E) the Government Accountability Of-
fice. 
‘‘(8) Establish and maintain a public comment 
process for newly issued or revised guidance adopted 
by FedRAMP. 
‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 
The FedRAMP Program Management Office shall assess 
and evaluate available automation procedures to accelerate 
the processing of FedRAMP applications. 
‘‘(d) METRICS FOR CERTIFICATION.—The FedRAMP 
Program Management Office shall adopt specific metrics 
regarding the time, cost, and quality of the assessments 
necessary for completion of a FedRAMP authorization 
process in a manner that can be consistently tracked over 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
time, which shall be done in conjunction with the periodic 
testing and evaluation process pursuant to subchapter II 
of chapter 35 in a manner that minimizes the agency re-
porting burden. 
‘‘§ 3609. Roles and responsibilities of the Joint Au-
thorization Board 
‘‘(a) ESTABLISHMENT.—There is established the 
Joint Authorization Board which shall consist of the Chief 
Information Officers or their designees of the Department 
of Defense, the Department of Homeland Security, and 
the General Services Administration. 
‘‘(b) ISSUANCE OF PROVISIONAL AUTHORIZATIONS 
TO OPERATE.—The Joint Authorization Board shall have 
the authority to issue provisional authorizations to operate 
to cloud service providers that meet FedRAMP security 
guidelines set forth in the Common Security Control Base-
line. 
‘‘(c) DUTIES.—The Joint Authorization Board 
shall— 
‘‘(1) review and validate cloud service provider 
and third party assessment organization security as-
sessment packages; 
‘‘(2) in consultation with the FedRAMP Pro-
gram Management Office, serve as a resource for 
best practices to accelerate the FedRAMP process; 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
‘‘(3) obtain such professional staff as may be 
necessary for the effective operation of FedRAMP 
and such other activities as are essential to properly 
perform critical functions; 
‘‘(4) such other roles and responsibilities as the 
FedRAMP Program Management Office may assign, 
as agreed to by the FedRAMP Program Manage-
ment Office and members of the Joint Authorization 
Board; and 
‘‘(5) appoint technical representatives respon-
sible for FedRAMP activities within each Joint Au-
thorization Board agency. 
‘‘§ 3610. Roles and responsibilities of third party as-
sessment organizations 
‘‘(a) REQUIREMENTS
FOR
CERTIFICATION.—The 
FedRAMP Program Management Office, in consultation 
with the Joint Authorization Board, shall determine the 
requirements for certification of third party assessment 
organizations. Such requirements may include developing 
or requiring certification programs for individuals em-
ployed by the third party assessment organizations who 
lead FedRAMP assessment teams. 
‘‘(b) ASSESSMENT.—Accredited third party assess-
ment organizations shall assess, validate, and attest to the 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
quality and compliance of security assessment materials 
provided by cloud service providers. 
‘‘(c) SUMMARY
RISK
REPORT.—Accredited third 
party assessment organizations shall develop a risk report 
that summarizes the security assessment report to com-
plement the existing authorization package artifacts and 
serve as an authorization decision making tool. 
‘‘§ 3611. Roles and responsibilities of agencies 
‘‘(a) IN GENERAL.—In implementing and enforcing 
the requirements of FedRAMP, Federal agency cloud cus-
tomers shall— 
‘‘(1) create policies to implement FedRAMP re-
quirements; 
‘‘(2) issue agency-specific authorizations to op-
erate for Federal cloud computing services in com-
pliance with subchapter II of chapter 35; 
‘‘(3) be in compliance with any FedRAMP re-
quirements, unless a waiver is issued by the Direc-
tor; 
‘‘(4) provide data to the Director on how agen-
cies are meeting metrics as defined by the 
FedRAMP Program Management Office pursuant to 
section 3614(b); and 
‘‘(5) if applicable, ensure that any contract is in 
compliance with FedRAMP requirements. 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
‘‘(b) SUBMISSION
OF POLICIES REQUIRED.—Not 
later than 6 months after the date of the enactment of 
this section, Federal agency cloud customers shall submit 
to the Director the policies created pursuant to subsection 
(a)(1) for review and approval. 
‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE 
REQUIRED.—Upon issuance of an authorization to oper-
ate, the head of the relevant agency shall provide a copy 
of the authorization to operate letter to the FedRAMP 
Program Management Office and the cloud service pro-
vider to enable the FedRAMP Program Management Of-
fice to track and assess all forms of authorizations to oper-
ate on a Governmentwide basis. 
‘‘(d) PRESUMPTION OF ADEQUACY.—Any provisional 
authorization to operate issued by the Joint Authorization 
Board shall be considered to be presumptively adequate 
by agencies, subject to technical or programmatic rebuttal 
by an agency that disagrees with adequacy or sufficiency 
of the certification. This rebuttable presumption of ade-
quacy shall not derogate, modify, or alter the responsi-
bility of any agency to ensure compliance with the sub-
chapter II of chapter 35 for any Federal cloud computing 
services that the agency deploys. 
‘‘(e) WAIVER OR EXCEPTION.—The Chief Informa-
tion Officer of each agency may request a waiver or excep-
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
tion to specific FedRAMP requirements. Such request for 
waiver shall be in accordance with the determinations and 
finding issued under section 3612(2). The determination 
and findings shall be submitted to the FedRAMP Program 
Management Office and the Director, along with such sup-
porting articles as may be required under guidelines issued 
by FedRAMP. 
‘‘(f) AGENCY REPORTS REQUIRED.—Not later than 
90 days after the date of which any guidance is issued 
pursuant to section 3608(b)(4) from the FedRAMP Pro-
gram Management Office, the head of each agency shall 
submit to the Director a report on cloud computing usage 
and the potential demand for cloud computing. 
‘‘§ 3612. Roles and Responsibilities of the Office of 
Management and Budget 
‘‘The Director shall have the following duties: 
‘‘(1) Highlight current guidance or issue new 
guidance to ensure that an agency does not operate 
a Federal Government cloud computing service using 
Government data without issuing an authorization to 
operate issued by the agency that meets the require-
ments of subchapter II of chapter 35 and 
FedRAMP. 
‘‘(2) Issue guidance and templates for agency 
determinations and findings for waivers to the re-
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
quirements of FedRAMP (any request by an agency 
for such a waiver must set forth unique agency-spe-
cific technical, operational, or managerial require-
ments necessary for agency operations). 
‘‘(3) Define alternatives and agency best prac-
tices for compliance with the Trusted Internet Con-
nection for agencies connecting to a cloud service 
provider. 
‘‘(4) Grant waivers or exceptions to specific 
FedRAMP requirements as may be necessary by the 
submission of agency determinations and findings 
that meet the OMB guidelines for FedRAMP waiv-
ers pursuant to paragraph (2). 
‘‘(5) Ensure agencies are in compliance with 
any guidance or other requirements issued related to 
FedRAMP. 
‘‘§ 3613. Funding of FedRAMP 
‘‘The FedRAMP Program Management Office may, 
to the extent deemed appropriate by the Administrator 
and in consultation with the Director, use funds contained 
within the Acquisition Services Fund described under sec-
tion 321 of title 40 or such other funds as may be avail-
able for the operations of FedRAMP. 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
‘‘§ 3614. Reporting 
‘‘(a) IN GENERAL.—Not later than 18 months after 
the date of the enactment of this section, and annually 
thereafter, the Director shall submit to the Committee on 
Oversight and Government Reform of the House of Rep-
resentatives and the Committee on Homeland Security 
and Government Affairs of the Senate a report that in-
cludes the following: 
‘‘(1) The status, efficiency, and effectiveness of 
FedRAMP during the preceding year in authorizing 
and recertifying secure cloud solutions for Federal 
agency cloud customers. 
‘‘(2) The length of time for Federal agency 
cloud customers to issue authorizations to operate 
during the preceding year. 
‘‘(3) Agency requests for FedRAMP waivers. 
‘‘(4) Progress during the preceding year in ad-
vancing automation techniques to securely automate 
FedRAMP processes and to accelerate reporting as 
described in this section. 
‘‘(5) Number of cloud computing systems in use 
at each agency and the number of cloud computing 
authorizations to operate. 
‘‘(b) GAO REPORT.—Not later than 2 years after the 
date of enactment of this section, and every three years 
thereafter, the Comptroller General shall submit to the 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
Oversight and Government Reform Committee of the 
House of Representatives and the Homeland Security and 
Governmental Affairs Committee of the Senate an assess-
ment of FedRAMP, third party assessment organizations, 
and Federal agency cloud customers, including the fol-
lowing: 
‘‘(1) An evaluation of the impact and con-
tinuing need for specific cloud security controls. 
‘‘(2) A review of the adequacy of resources to 
run FedRAMP. 
‘‘(3) The development of reusability and the po-
tential for the use and adoption of reciprocal stand-
ards, whether from Government or the private sec-
tor, as substitutes for specific security controls in 
use by the FedRAMP Project Management Office. 
‘‘§ 3615. Definitions 
‘‘(a) IN GENERAL.—Except as provided under para-
graph (2), the definitions under sections 3502 and 3552 
apply to sections 3607 through 3614. 
‘‘(b) ADDITIONAL DEFINITIONS.—In sections 3607 
through 3614: 
‘‘(1) ADMINISTRATOR.—The term ‘Adminis-
trator’ means the Administrator of General Services. 
‘‘(2) CLOUD BROKER.—The term ‘cloud broker’ 
means an entity that manages the use, performance, 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
and delivery of cloud computing services and nego-
tiates relationships between cloud service providers 
and cloud consumers. 
‘‘(3) CLOUD
COMPUTING.—The term ‘cloud 
computing’ means a model for enabling ubiquitous, 
convenient, on-demand network access to a shared 
pool of configurable computing resources (such as 
networks, servers, storage, applications, and serv-
ices) that can be rapidly provisioned and released 
with minimal management effort or service provider 
interaction (as defined by the National Institute of 
Standards and Technology pursuant to the National 
Institute of Standards and Technology Act (15 
U.S.C. 278g–3), including NIST Special Publication 
800–145) or any successor thereto. 
‘‘(4) CLOUD SERVICE INTEGRATOR.—The term 
‘cloud service integrator’ means a systems or service 
integrator that specializes in cloud computing serv-
ices. 
‘‘(5) CLOUD
SERVICE
PROVIDER.—The term 
‘cloud service provider’ means a third party entity 
offering cloud computing services to the Federal 
Government. 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The table of sections for chapter 36 of title 44, United 
States Code, is amended by adding at the end the fol-
lowing new items: 
‘‘3607. Federal Risk and Authorization Management Program. 
‘‘3608. Roles and responsibilities of the FedRAMP Program Management 
Office. 
‘‘3609. Roles and responsibilities of the Joint Authorization Board. 
‘‘3610. Roles and responsibilities of third party assessment organizations. 
‘‘3611. Roles and responsibilities of the agencies. 
‘‘3612. Funding of FedRAMP. 
‘‘3613. Reporting. 
‘‘3614. Definitions.’’. 
Æ 
VerDate Sep 11 2014 
02:44 Aug 09, 2018
Jkt 079200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6301
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS