H. R. 7776—1061 
‘‘(4) oversee the effectiveness of FedRAMP and the 
FedRAMP Board, including the compliance by the FedRAMP 
Board with the duties described in section 3610(d); and 
‘‘(5) to the greatest extent practicable, encourage and pro-
mote consistency of the assessment, authorization, adoption, 
and use of secure cloud computing products and services within 
and across agencies. 
‘‘§ 3615. Reports to Congress; GAO report 
‘‘(a) REPORTS TO CONGRESS.—Not later than 1 year after the 
date of enactment of this section, and annually thereafter, the 
Director shall submit to the appropriate congressional committees 
a report that includes the following: 
‘‘(1) During the preceding year, the status, efficiency, and 
effectiveness of the General Services Administration under sec-
tion 3609 and agencies under section 3613 and in supporting 
the speed, effectiveness, sharing, reuse, and security of 
authorizations to operate for secure cloud computing products 
and services. 
‘‘(2) Progress towards meeting the metrics required under 
section 3609(d). 
‘‘(3) Data on FedRAMP authorizations. 
‘‘(4) The average length of time to issue FedRAMP 
authorizations. 
‘‘(5) The number of FedRAMP authorizations submitted, 
issued, and denied for the preceding year. 
‘‘(6) A review of progress made during the preceding year 
in advancing automation techniques to securely automate 
FedRAMP processes and to accelerate reporting under this 
section. 
‘‘(7) The number and characteristics of authorized cloud 
computing products and services in use at each agency con-
sistent with guidance provided by the Director under section 
3614. 
‘‘(8) A review of FedRAMP measures to ensure the security 
of data stored or processed by cloud service providers, which 
may include— 
‘‘(A) geolocation restrictions for provided products or 
services; 
‘‘(B) disclosures of foreign elements of supply chains 
of acquired products or services; 
‘‘(C) continued disclosures of ownership of cloud service 
providers by foreign entities; and 
‘‘(D) encryption for data processed, stored, or trans-
mitted by cloud service providers. 
‘‘(b) GAO REPORT.—Not later than 180 days after the date 
of enactment of this section, the Comptroller General of the United 
States shall report to the appropriate congressional committees 
an assessment of the following: 
‘‘(1) The costs incurred by agencies and cloud service pro-
viders relating to the issuance of FedRAMP authorizations. 
‘‘(2) The extent to which agencies have processes in place 
to continuously monitor the implementation of cloud computing 
products and services operating as Federal information systems. 
‘‘(3) How often and for which categories of products and 
services agencies use FedRAMP authorizations.
H. R. 7776—1062 
‘‘(4) The unique costs and potential burdens incurred by 
cloud computing companies that are small business concerns 
(as defined in section 3(a) of the Small Business Act (15 U.S.C. 
632(a)) as a part of the FedRAMP authorization process. 
‘‘§ 3616. Federal Secure Cloud Advisory Committee 
‘‘(a) ESTABLISHMENT, PURPOSES, AND DUTIES.— 
‘‘(1) ESTABLISHMENT.—There is established a Federal 
Secure Cloud Advisory Committee (referred to in this section 
as the ‘Committee’) to ensure effective and ongoing coordination 
of agency adoption, use, authorization, monitoring, acquisition, 
and security of cloud computing products and services to enable 
agency mission and administrative priorities. 
‘‘(2) PURPOSES.—The purposes of the Committee are the 
following: 
‘‘(A) To examine the operations of FedRAMP and deter-
mine ways that authorization processes can continuously 
be improved, including the following: 
‘‘(i) 
Measures 
to 
increase 
agency 
reuse 
of 
FedRAMP authorizations. 
‘‘(ii) Proposed actions that can be adopted to reduce 
the burden, confusion, and cost associated with 
FedRAMP authorizations for cloud service providers. 
‘‘(iii) 
Measures 
to 
increase 
the 
number 
of 
FedRAMP authorizations for cloud computing products 
and services offered by small businesses concerns (as 
defined by section 3(a) of the Small Business Act (15 
U.S.C. 632(a)). 
‘‘(iv) Proposed actions that can be adopted to 
reduce the burden and cost of FedRAMP authorizations 
for agencies. 
‘‘(B) Collect information and feedback on agency 
compliance with and implementation of FedRAMP require-
ments. 
‘‘(C) Serve as a forum that facilitates communication 
and collaboration among the FedRAMP stakeholder 
community. 
‘‘(3) DUTIES.—The duties of the Committee include pro-
viding advice and recommendations to the Administrator, the 
FedRAMP Board, and agencies on technical, financial, pro-
grammatic, and operational matters regarding secure adoption 
of cloud computing products and services. 
‘‘(b) MEMBERS.— 
‘‘(1) COMPOSITION.—The Committee shall be comprised of 
not more than 15 members who are qualified representatives 
from the public and private sectors, appointed by the Adminis-
trator, in consultation with the Director, as follows: 
‘‘(A) The Administrator or the Administrator’s des-
ignee, who shall be the Chair of the Committee. 
‘‘(B) At least 1 representative each from the Cybersecu-
rity and Infrastructure Security Agency and the National 
Institute of Standards and Technology. 
‘‘(C) At least 2 officials who serve as the Chief Informa-
tion Security Officer within an agency, who shall be 
required to maintain such a position throughout the dura-
tion of their service on the Committee.
H. R. 7776—1063 
‘‘(D) At least 1 official serving as Chief Procurement 
Officer (or equivalent) in an agency, who shall be required 
to maintain such a position throughout the duration of 
their service on the Committee. 
‘‘(E) At least 1 individual representing an independent 
assessment service. 
‘‘(F) At least 5 representatives from unique businesses 
that primarily provide cloud computing services or prod-
ucts, including at least 2 representatives from a small 
business concern (as defined by section 3(a) of the Small 
Business Act (15 U.S.C. 632(a))). 
‘‘(G) At least 2 other representatives of the Federal 
Government as the Administrator determines necessary 
to provide sufficient balance, insights, or expertise to the 
Committee. 
‘‘(2) DEADLINE
FOR
APPOINTMENT.—Each member of the 
Committee shall be appointed not later than 90 days after 
the date of enactment of this section. 
‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 
‘‘(A) IN GENERAL.—Each non-Federal member of the 
Committee shall be appointed for a term of 3 years, except 
that the initial terms for members may be staggered 1- 
, 2-, or 3-year terms to establish a rotation in which one- 
third of the members are selected each year. Any such 
member may be appointed for not more than 2 consecutive 
terms. 
‘‘(B) VACANCIES.—Any vacancy in the Committee shall 
not affect its powers, but shall be filled in the same manner 
in which the original appointment was made. Any member 
appointed to fill a vacancy occurring before the expiration 
of the term for which the member’s predecessor was 
appointed shall be appointed only for the remainder of 
that term. A member may serve after the expiration of 
that member’s term until a successor has taken office. 
‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 
‘‘(1) MEETINGS.—The Committee shall hold not fewer than 
3 meetings in a calendar year, at such time and place as 
determined by the Chair. 
‘‘(2) INITIAL MEETING.—Not later than 120 days after the 
date of enactment of this section, the Committee shall meet 
and begin the operations of the Committee. 
‘‘(3) RULES OF PROCEDURE.—The Committee may establish 
rules for the conduct of the business of the Committee if such 
rules are not inconsistent with this section or other applicable 
law. 
‘‘(d) EMPLOYEE STATUS.— 
‘‘(1) IN GENERAL.—A member of the Committee (other than 
a member who is appointed to the Committee in connection 
with another Federal appointment) shall not be considered 
an employee of the Federal Government by reason of any service 
as such a member, except for the purposes of section 5703 
of title 5, relating to travel expenses. 
‘‘(2) PAY NOT PERMITTED.—A member of the Committee 
covered by paragraph (1) may not receive pay by reason of 
service on the Committee.
H. R. 7776—1064 
‘‘(e) APPLICABILITY
TO
THE FEDERAL ADVISORY COMMITTEE 
ACT.—Section 14 of the Federal Advisory Committee Act (5 U.S.C. 
App.) shall not apply to the Committee. 
‘‘(f) DETAIL OF EMPLOYEES.—Any Federal Government employee 
may be detailed to the Committee without reimbursement from 
the Committee, and such detailee shall retain the rights, status, 
and privileges of his or her regular employment without interrup-
tion. 
‘‘(g) POSTAL SERVICES.—The Committee may use the United 
States mails in the same manner and under the same conditions 
as agencies. 
‘‘(h) REPORTS.— 
‘‘(1) INTERIM REPORTS.—The Committee may submit to the 
Administrator and Congress interim reports containing such 
findings, conclusions, and recommendations as have been 
agreed to by the Committee. 
‘‘(2) ANNUAL REPORTS.—Not later than 540 days after the 
date of enactment of this section, and annually thereafter, 
the Committee shall submit to the Administrator and Congress 
a report containing such findings, conclusions, and rec-
ommendations as have been agreed to by the Committee.’’. 
(c) TECHNICAL AND CONFORMING AMENDMENT.—The table of 
sections for chapter 36 of title 44, United States Code, is amended 
by adding at the end the following new items: 
‘‘3607. Definitions. 
‘‘3608. Federal Risk and Authorization Management Program. 
‘‘3609. Roles and responsibilities of the General Services Administration. 
‘‘3610. FedRAMP Board. 
‘‘3611. Independent assessment. 
‘‘3612. Declaration of foreign interests. 
‘‘3613. Roles and responsibilities of agencies. 
‘‘3614. Roles and responsibilities of the Office of Management and Budget. 
‘‘3615. Reports to Congress; GAO report. 
‘‘3616. Federal Secure Cloud Advisory Committee.’’. 
(d) SUNSET.— 
(1) IN
GENERAL.—Effective on the date that is 5 years 
after the date of enactment of this Act, chapter 36 of title 
44, United States Code, is amended by striking sections 3607 
through 3616. 
(2) CONFORMING AMENDMENT.—Effective on the date that 
is 5 years after the date of enactment of this Act, the table 
of sections for chapter 36 of title 44, United States Code, 
is amended by striking the items relating to sections 3607 
through 3616. 
(e) RULE OF CONSTRUCTION.—Nothing in this section or any 
amendment made by this section shall be construed as altering 
or impairing the authorities of the Director of the Office of Manage-
ment and Budget or the Secretary of Homeland Security under 
subchapter II of chapter 35 of title 44, United States Code. 
Subtitle D—Judicial Security and Privacy 
SEC. 5931. SHORT TITLE. 
This subtitle may be cited as the ‘‘Daniel Anderl Judicial Secu-
rity and Privacy Act of 2022’’. 
SEC. 5932. FINDINGS AND PURPOSE. 
(a) FINDINGS.—Congress finds the following: