I 
115TH CONGRESS 
2D SESSION 
H. R. 6550 
To enhance the innovation, security, and availability of Federal Government 
cloud services by establishing the Federal Risk and Authorization Man-
agement Program within the Office of Management and Budget Office 
of Electronic Government and by establishing a risk management, author-
ization, and continuous monitoring process to enable the Federal Govern-
ment to leverage cloud computing services using a risk-based approach 
consistent with the Federal Information Security Reform Act of 2014 
and cloud-based operations, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 26, 2018 
Mr. CONNOLLY (for himself and Mr. MEADOWS) introduced the following bill; 
which was referred to the Committee on Oversight and Government Reform 
A BILL 
To enhance the innovation, security, and availability of Fed-
eral Government cloud services by establishing the Fed-
eral Risk and Authorization Management Program with-
in the Office of Management and Budget Office of Elec-
tronic Government and by establishing a risk manage-
ment, authorization, and continuous monitoring process 
to enable the Federal Government to leverage cloud com-
puting services using a risk-based approach consistent 
with the Federal Information Security Reform Act of 
2014 and cloud-based operations, and for other purposes. 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Risk and Au-
thorization Management Program Reform Act of 2018’’ 
or the ‘‘FedRAMP Authorization Act’’. 
SEC. 2. CODIFICATION OF THE FEDRAMP PROGRAM. 
(a) AMENDMENT.—Chapter 36 of title 44, United 
States Code, is amended by adding at the end the fol-
lowing new sections: 
‘‘§ 3607. Federal Risk and Authorization Management 
Program 
‘‘(a) ESTABLISHMENT.—There is established within 
the General Services Administration, an office to be known 
as the FedRAMP Program Management Office that shall 
be responsible for the Federal Risk and Authorization 
Management Program. FedRAMP is a specific Govern-
ment certification program that examines and accredits 
cloud service providers that offer Federal cloud computing 
services for sale, lease, or purchase to Federal agency 
cloud customers. The FedRAMP Program Management 
Office embodies the goal of a ‘qualify once, use many 
times’ process through the issuance of certifications in the 
form of provisional authorizations to operate. 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS
‘‘(b) COMPONENTS OF FEDRAMP.—There are estab-
lished as components of FedRAMP the Joint Authoriza-
tion Board and the Program Management Office, or such 
successor offices as the Office of Management and Budg-
et, through the Office of Electronic Government may de-
termine. 
‘‘(c) FEDRAMP DUTIES.—The Director of the Office 
of Management and Budget and the Administrator of 
General Services, or their designees, shall work together 
to do the following: 
‘‘(1) Issue guidance on categories and charac-
teristics of information technology goods or services 
that are within the jurisdiction of FedRAMP and 
that require FedRAMP certification. 
‘‘(2) Issue guidance for the establishment and 
implementation of FedRAMP to conduct security as-
sessments, reviews, and appropriate oversight of con-
tinuous monitoring of cloud services used by agen-
cies. 
‘‘(3) Not later than 180 days after the date of 
the enactment of this section, and annually there-
after, submit to Congress a report on the status and 
performance of the FedRAMP Program Manage-
ment Office, including the status and disposition of 
waiver requests to FedRAMP submitted to the 
VerDate Sep 11 2014 
21:51 Aug 08, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6550.IH
H6550
amozie on DSK3GDR082PROD with BILLS