I 
114TH CONGRESS 
2D SESSION 
H. R. 5792 
To promote innovation and realize the efficiency gains and economic benefits 
of on-demand computing by accelerating the acquisition and deployment 
of innovative technology and computing resources throughout the Federal 
Government, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 14, 2016 
Mr. HURD of Texas (for himself, Ms. KELLY of Illinois, Mrs. COMSTOCK, Mr. 
CONNOLLY, Mr. KILMER, Mr. TED LIEU of California, Ms. HERRERA 
BEUTLER, Mr. CULBERSON, and Mr. YODER) introduced the following 
bill; which was referred to the Committee on Oversight and Government 
Reform, and in addition to the Committee on Appropriations, for a period 
to be subsequently determined by the Speaker, in each case for consider-
ation of such provisions as fall within the jurisdiction of the committee 
concerned 
A BILL 
To promote innovation and realize the efficiency gains and 
economic benefits of on-demand computing by accel-
erating the acquisition and deployment of innovative 
technology and computing resources throughout the Fed-
eral Government, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
04:22 Jul 27, 2016
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5792.IH
H5792
rfrederick on DSK6VPTVN1PROD with BILLS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Modernizing Outdated 
and Vulnerable Equipment and Information Technology 
Act of 2016’’ or the ‘‘MOVE IT Act’’. 
SEC. 2. FINDINGS AND PURPOSES. 
(a) FINDINGS.—Congress finds the following: 
(1) National Institute of Standards and Tech-
nology Special Publication 800–145 describes cloud 
computing as an evolving paradigm for information 
technology that is a model for enabling ubiquitous, 
convenient, on-demand network access to a shared 
pool of configurable computing resources (i.e., net-
works, servers, storage, applications, and services) 
that can be rapidly provisioned and released with 
minimal management effort or service provider inter-
action. 
(2) Together, the efficiencies, cost savings, and 
greater computing power enabled by cloud com-
puting has the potential to— 
(A) eliminate inappropriate duplication, re-
duce costs, and address waste, fraud, and abuse 
in providing Government services that are pub-
licly available; 
(B) address the critical need for cybersecu-
rity by design; and 
VerDate Sep 11 2014 
04:22 Jul 27, 2016
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5792.IH
H5792
rfrederick on DSK6VPTVN1PROD with BILLS
(C) move the Federal Government into a 
broad digital-services delivery model that could 
transform the fashion in which the Federal 
Government provides services to the people of 
the United States. 
(b) PURPOSES.—The purposes of this Act are to— 
(1) accelerate the acquisition and deployment of 
cloud computing services by addressing key impedi-
ments and roadblocks in funding, development, and 
acquisition practices; 
(2) support and expand an efficient Federal 
certification standard for qualifying cloud services 
providers under the Federal Risk and Authorization 
Management Program using a ‘‘qualify once, use 
many times’’ efficiency model that strikes an appro-
priate balance between— 
(A) encouraging the adoption of strong se-
curity practices to protect against the harm of 
cyber intrusions and hacks; and 
(B) avoiding the imposition of unduly bur-
densome and restrictive requirements on cloud 
computing service providers that would deter 
investment in innovative cloud computing serv-
ices; 
VerDate Sep 11 2014 
04:22 Jul 27, 2016
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5792.IH
H5792
rfrederick on DSK6VPTVN1PROD with BILLS
(3) assist agencies in migrating to cloud com-
puting services by providing guidance and oversight 
of agency enterprise-wide information technology 
portfolios suitable for and identifiable as suitable for 
a cloud-based delivery model; and 
(4) provide for Federal agencies to procure 
cloud computing services that adhere to sound secu-
rity practices. 
SEC. 3. FEDERAL RISK AND AUTHORIZATION MANAGEMENT 
PROGRAM. 
(a) IN GENERAL.—Except as provided under sub-
section (b), a covered agency may not store or process 
Government information on a Federal information system 
with any cloud service provider, unless the provider has 
an authorization to operate, or a provisional authorization 
to operate, covering the proposed scope of work, from the 
covered agency or the Joint Authorization Board. A cov-
ered agency operating under a provisional authorization 
to operate shall issue an authorization to operate as soon 
as practicable and may not rely on the provisional author-
ization to operate for the duration of the scope of work. 
(b) WAIVER OF REQUIREMENTS.— 
(1) IN GENERAL.—The Director of National In-
telligence, or a designee of the Director, may waive 
the applicability to any national security system of 
VerDate Sep 11 2014 
04:22 Jul 27, 2016
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5792.IH
H5792
rfrederick on DSK6VPTVN1PROD with BILLS
any provision of this section if the Director of Na-
tional Intelligence, or the designee, determines that 
such waiver is in the interest of national security. 
(2) NOTIFICATION.—Not later than 30 days 
after exercising a waiver under this subsection, the 
Director of National Intelligence, or the designee of 
the Director, as the case may be, shall submit to the 
Committee on Homeland Security and Governmental 
Affairs and the Select Committee on Intelligence of 
the Senate and the Committee on Oversight and 
Government Reform and the Permanent Select Com-
mittee on Intelligence of the House of Representa-
tives a statement describing and justifying the waiv-
er. 
(c) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed as limiting the ability of the Office 
of Management and Budget to update or modify Federal 
guidelines relating to the security of cloud computing. 
SEC. 
4. 
EXPANDED 
INDUSTRY 
COLLABORATION 
AND 
METRICS DEVELOPMENT FOR THE FEDERAL 
RISK AND AUTHORIZATION MANAGEMENT 
PROGRAM OFFICE. 
(a) IN GENERAL.—The Director shall coordinate 
with the Federal Risk and Authorization Management 
Program Office to establish mandatory guidelines for the 
VerDate Sep 11 2014 
04:22 Jul 27, 2016
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5792.IH
H5792
rfrederick on DSK6VPTVN1PROD with BILLS
submission of an application for an authorization to oper-
ate and related materials to the Federal Risk and Author-
ization Management Program Office. 
(b) CONTENTS.—The guidelines established under 
subsection (a) shall streamline and accelerate the Federal 
Risk and Authorization Management Program accredita-
tion process by meeting the following requirements: 
(1) Not less frequently than monthly, report to 
the applicant the status, expected time to comple-
tion, and other key indicators related to compliance 
for an application for authorization to operate sub-
mitted to the Federal Risk and Authorization Man-
agement Program Office. 
(2) Enhanced training and industry liaison op-
portunities for covered agencies and cloud service 
providers. 
(3) A clarification of— 
(A) the role and authority of third party 
assessment organization in the Federal Risk 
and Authorization Management Program proc-
ess for authorizations to operate by covered 
agencies; 
(B) the extent to which the Federal Risk 
and Authorization Management Program Office 
may identify and begin to accept or rely upon 
VerDate Sep 11 2014 
04:22 Jul 27, 2016
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5792.IH
H5792
rfrederick on DSK6VPTVN1PROD with BILLS
certifications from other standards development 
organizations or third party assessment organi-
zation; and 
(C) the responsibility of covered agencies 
to sponsor a Federal Risk and Authorization 
Management Program authorization to operate 
as part of making Federal Risk and Authoriza-
tion Management Program compliance a condi-
tion for entering into a contract or providing 
cloud computing services to a covered agency. 
(c) FEDRAMP LIAISON GROUP.— 
(1) IN GENERAL.—The Director, in coordina-
tion with the Program Management Office and the 
National Institute of Standards and Technology, 
shall host a public-private industry cloud commercial 
working group (in this subsection referred to as the 
‘‘FedRAMP Liaison Group’’) representing cloud 
service providers. 
(2) 
COMPOSITION
AND
FUNCTIONS.—The 
FedRAMP Liaison Group— 
(A) shall include representatives of cloud 
service providers; 
(B) may include such working groups as 
are determined appropriate by the FedRAMP 
Liaison Group; 
VerDate Sep 11 2014 
04:22 Jul 27, 2016
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5792.IH
H5792
rfrederick on DSK6VPTVN1PROD with BILLS
(C) shall be hosted by the General Services 
Administration, who shall convene plenary 
meetings on a quarterly basis with individual 
working groups meeting as frequently as deter-
mined by the group; and 
(D) shall consult with and provide rec-
ommendations directly to the Program Manage-
ment Office and the Joint Authorization Board 
of the Federal Risk and Authorization Manage-
ment Program regarding the operations, proc-
esses improvements, and best practices of the 
Office and Board. 
(3) FACA EXEMPTION.—The Federal Advisory 
Committee Act shall not apply to the FedRAMP Li-
aison Group. 
(d) PROVIDING DEDICATED AGENCY SUPPORT.—The 
Program Management Office shall work with each covered 
agency to support and guide the efforts of the agency— 
(1) to establish and issue the authorization to 
operate for the agency; 
(2) to facilitate authorization approval, support, 
and direct interfacing with cloud service providers; 
and 
VerDate Sep 11 2014 
04:22 Jul 27, 2016
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5792.IH
H5792
rfrederick on DSK6VPTVN1PROD with BILLS
(3) to facilitate partnership among agencies to 
efficiently support activities related to obtaining an 
authorization to operate. 
(e) METRICS.—The Director, in coordination with the 
National Institute of Standards and Technology and the 
FedRAMP Liaison Group, shall establish key performance 
metrics for the Federal Risk and Authorization Manage-
ment Program Office, which shall include— 
(1) recommendations for maximum time limits 
for the completion of authorizations to operate by 
service categories of cloud service providers, not to 
exceed six months; 
(2) targets for the streamlining of the author-
ization to operate through the use of innovative tem-
plates and transparent submission requirements; and 
(3) recommendations for satisfying Federal con-
tinuous monitoring requirements. 
(f) REPORT REQUIRED.—Not later than one year 
after the date of the enactment of this Act, the Director 
shall submit to the Committees on Appropriations and 
Oversight and Government Reform of the House of Rep-
resentatives and the Committees on Appropriations and 
Homeland Security and Governmental Affairs of the Sen-
ate a report on the effectiveness and efficiency of the Fed-
eral Risk and Authorization Management Program Office. 
VerDate Sep 11 2014 
04:22 Jul 27, 2016
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5792.IH
H5792
rfrederick on DSK6VPTVN1PROD with BILLS