HR 3941 RFS
‘‘(j) POSTAL SERVICES.—The Committee may use 
the United States mails in the same manner and under 
the same conditions as agencies. 
‘‘(k) EXPERT
AND CONSULTANT SERVICES.—The 
Committee is authorized to procure the services of experts 
and consultants in accordance with section 3109 of title 
5, but at rates not to exceed the daily rate paid a person 
occupying a position at Level IV of the Executive Schedule 
under section 5315 of title 5. 
‘‘(l) REPORTS.— 
‘‘(1) INTERIM REPORTS.—The Committee may 
submit to the Administrator and Congress interim 
reports containing such findings, conclusions, and 
recommendations as have been agreed to by the 
Committee. 
‘‘(2) ANNUAL
REPORTS.—Not later than 18 
months after the date of the enactment of this sec-
tion, and annually thereafter, the Committee shall 
submit to the Administrator and Congress a final re-
port containing such findings, conclusions, and rec-
ommendations as have been agreed to by the Com-
mittee. 
VerDate Sep 11 2014 
22:43 Feb 10, 2020
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H3941.RFS
H3941
pamtmann on DSKBC07HB2PROD with BILLS
HR 3941 RFS
‘‘§ 3616. Definitions 
‘‘(a) IN GENERAL.—Except as provided under sub-
section (b), the definitions under sections 3502 and 3552 
apply to sections 3607 through this section. 
‘‘(b) ADDITIONAL DEFINITIONS.—In sections 3607 
through this section: 
‘‘(1) ADMINISTRATOR.—The term ‘Adminis-
trator’ means the Administrator of General Services. 
‘‘(2) AUTHORIZATION
PACKAGE.—The term 
‘authorization package’— 
‘‘(A) means the essential information used 
to determine whether to authorize the operation 
of an information system or the use of a des-
ignated set of common controls; and 
‘‘(B) at a minimum, includes the informa-
tion system security plan, privacy plan, security 
control assessment, privacy control assessment, 
and any relevant plans of action and milestones. 
‘‘(3) CLOUD
COMPUTING.—The term ‘cloud 
computing’ has the meaning given that term by the 
National Institutes of Standards and Technology in 
NIST Special Publication 800–145 and any amend-
atory or superseding document thereto. 
‘‘(4) CLOUD
SERVICE
PROVIDER.—The term 
‘cloud service provider’ means an entity offering 
cloud computing services to agencies. 
VerDate Sep 11 2014 
22:43 Feb 10, 2020
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H3941.RFS
H3941
pamtmann on DSKBC07HB2PROD with BILLS
HR 3941 RFS
‘‘(5) DIRECTOR.—The term ‘Director’ means 
the Director of the Office of Management and Budg-
et. 
‘‘(6) FEDRAMP.—The term ‘FedRAMP’ means 
the Federal Risk and Authorization Management 
Program established under section 3607(a). 
‘‘(7) FEDRAMP
AUTHORIZATION.—The term 
‘FedRAMP authorization’ means a cloud computing 
product or service that has received an agency au-
thorization to operate and has been approved by the 
FedRAMP Program Management Office to meet re-
quirements and guidelines established by the 
FedRAMP Program Management Office. 
‘‘(8) FEDRAMP
PROGRAM
MANAGEMENT
OF-
FICE.—The term ‘FedRAMP Program Management 
Office’ means the office that administers FedRAMP 
established under section 3608. 
‘‘(9) INDEPENDENT
ASSESSMENT
ORGANIZA-
TION.—The term ‘independent assessment organiza-
tion’ means a third-party organization accredited by 
the Program Director of the FedRAMP Program 
Management Office to undertake conformity assess-
ments of cloud service providers. 
‘‘(10) JOINT
AUTHORIZATION
BOARD.—The 
term ‘Joint Authorization Board’ means the Joint 
VerDate Sep 11 2014 
22:43 Feb 10, 2020
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H3941.RFS
H3941
pamtmann on DSKBC07HB2PROD with BILLS
HR 3941 RFS
Authorization Board established under section 
3609.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The table of sections for chapter 36 of title 44, United 
States Code, is amended by adding at the end the fol-
lowing new items: 
‘‘3607. Federal Risk and Authorization Management Program. 
‘‘3608. FedRAMP Program Management Office. 
‘‘3609. Joint Authorization Board. 
‘‘3610. Independent assessment organizations. 
‘‘3611. Roles and responsibilities of agencies. 
‘‘3612. Roles and responsibilities of the Office of Management and Budget. 
‘‘3613. Authorization of appropriations for FEDRAMP. 
‘‘3614. Reports to Congress. 
‘‘3615. Federal Secure Cloud Advisory Committee. 
‘‘3616. Definitions.’’. 
(c) SUNSET.—This Act and any amendment made by 
this Act shall be repealed on the date that is 10 years 
after the date of the enactment of this Act. 
(d) RULE OF CONSTRUCTION.—Nothing in this Act 
or any amendment made by this Act shall be construed 
as altering or impairing the authorities of the Director of 
the Office of Management and Budget or the Secretary 
of Homeland Security under subchapter II of chapter 35 
of title 44, United States Code. 
Passed the House of Representatives February 5, 
2020. 
Attest: 
CHERYL L. JOHNSON, 
Clerk. 
VerDate Sep 11 2014 
22:43 Feb 10, 2020
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H3941.RFS
H3941
pamtmann on DSKBC07HB2PROD with BILLS