HR 21 RFS
‘‘(5) The number of FedRAMP authorizations 
and FedRAMP provisional authorizations issued for 
the previous year. 
‘‘(6) A review of progress made during the pre-
ceding year in advancing automation techniques to 
securely automate FedRAMP processes and to accel-
erate reporting as described in this section. 
‘‘(7) The number and characteristics of author-
ized cloud computing products and services in use at 
each agency consistent with guidance provided by 
the Director in section 3612. 
‘‘(8) The cost incurred by agencies and cloud 
service 
providers 
related 
to 
the 
issuance 
of 
FedRAMP authorizations and FedRAMP provisional 
authorizations, including information responsive to 
the report required in subsection (b). 
‘‘(b) GAO REPORT.—Not later than 6 months after 
the date of the enactment of this section, the Comptroller 
General of the United States shall publish a report that 
includes an assessment of the cost incurred by agencies 
and cloud service providers related to the issuance of 
FedRAMP authorizations and FedRAMP provisional au-
thorizations. 
‘‘§ 3615. Federal Secure Cloud Advisory Committee 
‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
‘‘(1) ESTABLISHMENT.—There is established a 
Federal Secure Cloud Advisory Committee (referred 
to in this section as the ‘Committee’) to ensure ef-
fective and ongoing coordination of agency adoption, 
use, authorization, monitoring, acquisition, and secu-
rity of cloud computing products and services to en-
able agency mission and administrative priorities. 
‘‘(2) PURPOSES.—The purposes of the Com-
mittee are the following: 
‘‘(A) 
To 
examine 
the 
operations 
of 
FedRAMP and determine ways that authoriza-
tion processes can continuously be improved, in-
cluding the following: 
‘‘(i) Measures to increase agency re- 
use of FedRAMP provisional authoriza-
tions. 
‘‘(ii) Proposed actions that can be 
adopted to reduce the cost of FedRAMP 
authorizations and FedRAMP provisional 
authorizations for cloud service providers. 
‘‘(iii) Measures to increase the num-
ber of FedRAMP authorizations and 
FedRAMP provisional authorizations for 
cloud computing services offered by small 
businesses (as defined by section 3(a) of 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
the Small Business Act (15 U.S.C. 
632(a)). 
‘‘(B) Collect information and feedback on 
agency compliance with and implementation of 
FedRAMP requirements. 
‘‘(C) Serve as a forum that facilitates com-
munication 
and 
collaboration 
among 
the 
FedRAMP stakeholder community. 
‘‘(3) DUTIES.—The duties of the Committee 
are, at a minimum, to provide advice and rec-
ommendations to the Administrator, the Joint Au-
thorization Board, and to agencies on technical, fi-
nancial, programmatic, and operational matters re-
garding secure adoption of cloud computing products 
and services. 
‘‘(b) MEMBERS.— 
‘‘(1) COMPOSITION.—The Committee shall be 
comprised of not more than 15 members who are 
qualified representatives from the public and private 
sectors, appointed by the Administrator, in consulta-
tion with the Administrator of the Office of Elec-
tronic Government, as follows: 
‘‘(A) The Administrator or the Administra-
tor’s designee, who shall be the Chair of the 
Committee. 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
‘‘(B) At least one representative each from 
the Cybersecurity and Infrastructure Security 
Agency and the National Institute of Standards 
and Technology. 
‘‘(C) At least two officials who serve as the 
Chief Information Security Officer within an 
agency, who shall be required to maintain such 
a position throughout the duration of their serv-
ice on the Committee. 
‘‘(D) At least one official serving as Chief 
Procurement Officer (or equivalent) in an agen-
cy, who shall be required to maintain such a po-
sition throughout the duration of their service 
on the Committee. 
‘‘(E) At least one individual representing 
an independent assessment organization. 
‘‘(F) No fewer than five representatives 
from unique businesses that primarily provide 
cloud computing services or products, including 
at least two representatives from a small busi-
ness (as defined by section 3(a) of the Small 
Business Act (15 U.S.C. 632(a))). 
‘‘(G) At least two other Government rep-
resentatives as the Administrator determines to 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
be necessary to provide sufficient balance, in-
sights, or expertise to the Committee. 
‘‘(2) DEADLINE
FOR
APPOINTMENT.—Each 
member of the Committee shall be appointed not 
later than 30 days after the date of the enactment 
of this section. 
‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 
‘‘(A) IN
GENERAL.—Each non-Federal 
member of the Committee shall be appointed 
for a term of 3 years, except that the initial 
terms for members may be staggered 1-, 2-, or 
3-year terms to establish a rotation in which 
one-third of the members are selected each 
year. Any such member may be appointed for 
not more than 2 consecutive terms. 
‘‘(B) VACANCIES.—Any vacancy in the 
Committee shall not affect its powers, but shall 
be filled in the same manner in which the origi-
nal appointment was made. Any member ap-
pointed to fill a vacancy occurring before the 
expiration of the term for which the member’s 
predecessor was appointed shall be appointed 
only for the remainder of that term. A member 
may serve after the expiration of that member’s 
term until a successor has taken office. 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 
‘‘(1) MEETINGS.—The Committee shall hold 
not fewer than three meetings in a calendar year, at 
such time and place as determined by the Chair. 
‘‘(2) INITIAL
MEETING.—Not later than 120 
days after the date of the enactment of this section, 
the Committee shall meet and begin the operations 
of the Committee. 
‘‘(3) RULES OF PROCEDURE.—The Committee 
may establish rules for the conduct of the business 
of the Committee, if such rules are not inconsistent 
with this section or other applicable law. 
‘‘(d) EMPLOYEE STATUS.— 
‘‘(1) IN
GENERAL.—A member of the Com-
mittee (other than a member who is appointed to the 
Committee in connection with another Federal ap-
pointment) shall not be considered an employee of 
the Federal Government by reason of any service as 
such a member, except for the purposes of section 
5703 of title 5, relating to travel expenses. 
‘‘(2) PAY NOT PERMITTED.—A member of the 
Committee covered by paragraph (1) may not receive 
pay by reason of service on the Committee. 
‘‘(e) APPLICABILITY TO THE FEDERAL ADVISORY 
COMMITTEE ACT.—Section 14 of the Federal Advisory 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
Committee Act (5 U.S.C. App.) shall not apply to the 
Committee. 
‘‘(f) HEARINGS AND EVIDENCE.—The Committee, or 
on the authority of the Committee, any subcommittee, 
may, for the purposes of carrying out this section, hold 
hearings, sit and act at such times and places, take testi-
mony, receive evidence, and administer oaths. 
‘‘(g) CONTRACTING.—The Committee, may, to such 
extent and in such amounts as are provided in appropria-
tion Acts, enter into contracts to enable the Committee 
to discharge its duties under this section. 
‘‘(h) INFORMATION FROM FEDERAL AGENCIES.— 
‘‘(1) IN GENERAL.—The Committee is author-
ized to secure directly from any executive depart-
ment, bureau, agency, board, commission, office, 
independent establishment, or instrumentality of the 
Government, information, suggestions, estimates, 
and statistics for the purposes of the Committee. 
Each department, bureau, agency, board, commis-
sion, office, independent establishment, or instru-
mentality shall, to the extent authorized by law, fur-
nish such information, suggestions, estimates, and 
statistics directly to the Committee, upon request 
made by the Chair, the Chair of any subcommittee 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
created by a majority of the Committee, or any 
member designated by a majority of the Committee. 
‘‘(2) RECEIPT, HANDLING, STORAGE, AND DIS-
SEMINATION.—Information may only be received, 
handled, stored, and disseminated by members of 
the Committee and its staff consistent with all appli-
cable statutes, regulations, and Executive orders. 
‘‘(i) DETAIL OF EMPLOYEES.—Any Federal Govern-
ment employee may be detailed to the Committee without 
reimbursement from the Committee, and such detailee 
shall retain the rights, status, and privileges of his or her 
regular employment without interruption. 
‘‘(j) POSTAL SERVICES.—The Committee may use 
the United States mails in the same manner and under 
the same conditions as agencies. 
‘‘(k) EXPERT
AND CONSULTANT SERVICES.—The 
Committee is authorized to procure the services of experts 
and consultants in accordance with section 3109 of title 
5, but at rates not to exceed the daily rate paid a person 
occupying a position at Level IV of the Executive Schedule 
under section 5315 of title 5. 
‘‘(l) REPORTS.— 
‘‘(1) INTERIM REPORTS.—The Committee may 
submit to the Administrator and Congress interim 
reports containing such findings, conclusions, and 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
recommendations as have been agreed to by the 
Committee. 
‘‘(2) ANNUAL
REPORTS.—Not later than 18 
months after the date of the enactment of this sec-
tion, and annually thereafter, the Committee shall 
submit to the Administrator and Congress a final re-
port containing such findings, conclusions, and rec-
ommendations as have been agreed to by the Com-
mittee. 
‘‘§ 3616. Definitions 
‘‘(a) IN GENERAL.—Except as provided under sub-
section (b), the definitions under sections 3502 and 3552 
apply to sections 3607 through this section. 
‘‘(b) ADDITIONAL DEFINITIONS.—In sections 3607 
through this section: 
‘‘(1) ADMINISTRATOR.—The term ‘Adminis-
trator’ means the Administrator of General Services. 
‘‘(2) AUTHORIZATION
PACKAGE.—The term 
‘authorization package’— 
‘‘(A) means the essential information used 
to determine whether to authorize the operation 
of an information system or the use of a des-
ignated set of common controls; and 
‘‘(B) at a minimum, includes the informa-
tion system security plan, privacy plan, security 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
control assessment, privacy control assessment, 
and any relevant plans of action and milestones. 
‘‘(3) CLOUD
COMPUTING.—The term ‘cloud 
computing’ has the meaning given that term by the 
National Institutes of Standards and Technology in 
NIST Special Publication 800–145 and any amend-
atory or superseding document thereto. 
‘‘(4) CLOUD
SERVICE
PROVIDER.—The term 
‘cloud service provider’ means an entity offering 
cloud computing products or services to agencies. 
‘‘(5) DIRECTOR.—The term ‘Director’ means 
the Director of the Office of Management and Budg-
et. 
‘‘(6) 
FEDRAMP.—The 
term 
‘FedRAMP’ 
means the Federal Risk and Authorization Manage-
ment Program established under section 3607(a). 
‘‘(7) FEDRAMP AUTHORIZATION.—The term 
‘FedRAMP authorization’ means a certification that 
a cloud computing product or service received from 
an agency that provides an authorization to operate 
and the FedRAMP Program Management Office has 
determined the product or service has completed the 
FedRAMP authorization process. 
‘‘(8) FEDRAMP PROGRAM
MANAGEMENT
OF-
FICE.—The term ‘FedRAMP Program Management 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
Office’ means the office that administers FedRAMP 
established under section 3607(b). 
‘‘(9) FEDRAMP 
PROVISIONAL
AUTHORIZA-
TION.—The term ‘FedRAMP provisional authoriza-
tion’ means a certification that a cloud computing 
product or service has received from the Joint Au-
thorization Board that approves a provisional au-
thorization to operate. 
‘‘(10) INDEPENDENT
ASSESSMENT
ORGANIZA-
TION.—The term ‘independent assessment organiza-
tion’ means a third-party organization accredited by 
the Program Director of the FedRAMP Program 
Management Office to undertake conformity assess-
ments of cloud service providers and their products 
or services. 
‘‘(11) JOINT
AUTHORIZATION
BOARD.—The 
term ‘Joint Authorization Board’ means the Joint 
Authorization Board established under section 
3607(b).’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The table of sections for chapter 36 of title 44, United 
States Code, is amended by adding at the end the fol-
lowing new items: 
‘‘3607. Federal Risk and Authorization Management Program. 
‘‘3608. FedRAMP Program Management Office. 
‘‘3609. Joint Authorization Board. 
‘‘3610. Independent assessment organizations. 
‘‘3611. Roles and responsibilities of agencies. 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6211
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS
HR 21 RFS
‘‘3612. Roles and responsibilities of the Office of Management and Budget. 
‘‘3613. Authorization of appropriations for FEDRAMP. 
‘‘3614. Reports to Congress. 
‘‘3615. Federal Secure Cloud Advisory Committee. 
‘‘3616. Definitions.’’. 
(c) SUNSET.—This Act and any amendment made by 
this Act shall be repealed on the date that is 10 years 
after the date of the enactment of this Act. 
(d) RULE OF CONSTRUCTION.—Nothing in this Act 
or any amendment made by this Act shall be construed 
as altering or impairing the authorities of the Director of 
the Office of Management and Budget or the Secretary 
of Homeland Security under subchapter II of chapter 35 
of title 44, United States Code. 
Passed the House of Representatives January 5, 
2021. 
Attest: 
CHERYL L. JOHNSON, 
Clerk. 
VerDate Sep 11 2014 
23:15 Jan 07, 2021
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H21.RFS
H21
kjohnson on DSK79L0C42PROD with BILLS