experts, appointed by the Director in consultation with the 
Administrator, from each of the following: 
‘‘(1) The Department of Defense. 
‘‘(2) The Department of Homeland Security. 
‘‘(3) The General Services Administration. 
‘‘(4) Such other agencies as determined by the 
Director, in consultation with the Administrator. 
‘‘(b) ISSUANCE OF PROVISIONAL AUTHORIZATIONS TO 
OPERATE.—The Joint Authorization Board shall conduct 
security assessments of cloud computing services and issue 
provisional authorizations to operate to cloud service pro-
viders that meet FedRAMP security guidelines set forth in 
section 3608(b)(1). 
‘‘(c) DUTIES.—The Joint Authorization Board shall— 
‘‘(1) develop and make publicly available on a 
website, determined by the Administrator, criteria for 
prioritizing and selecting cloud computing services to 
be assessed by the Joint Authorization Board; 
‘‘(2) provide regular updates on the status of any 
cloud computing service during the assessment and 
authorization process of the Joint Authorization 
Board; 
‘‘(3) review and validate cloud computing serv-
ices and independent assessment organization security 
packages or any documentation determined to be nec-
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
essary by the Joint Authorization Board to evaluate 
the system security of a cloud computing service; 
‘‘(4) in consultation with the FedRAMP Pro-
gram Management Office, serve as a resource for best 
practices to accelerate the FedRAMP process; 
‘‘(5) establish requirements and guidelines for se-
curity assessments of cloud computing services, con-
sistent with standards defined by the National Insti-
tute of Standards and Technology, to be used by the 
Joint Authorization Board and agencies; 
‘‘(6) perform such other roles and responsibilities 
as the Administrator may assign, in consultation 
with the FedRAMP Program Management Office and 
members of the Joint Authorization Board; and 
‘‘(7) establish metrics and goals for reviews and 
activities associated with issuing provisional author-
izations to operate and provide to the FedRAMP Pro-
gram Management Office. 
‘‘(d) DETERMINATIONS OF DEMAND FOR CLOUD COM-
PUTING SERVICES.—The Joint Authorization Board shall 
consult with the Chief Information Officers Council estab-
lished in section 3603 to establish a process for prioritizing 
and accepting the cloud computing services to be granted 
a provisional authorization to operate through the Joint 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
Authorization Board, which shall be made available on a 
public website. 
‘‘(e) DETAIL OF PERSONNEL.—To assist the Joint Au-
thorization Board in discharging the responsibilities under 
this section, personnel of agencies may be detailed to the 
Joint Authorization Board for the performance of duties de-
scribed under subsection (c). 
‘‘§ 3610. Independent assessment organizations 
‘‘(a) 
REQUIREMENTS
FOR
ACCREDITATION.—The 
Joint Authorization Board shall determine the requirements 
for certification of independent assessment organizations 
pursuant to section 3609. Such requirements may include 
developing or requiring certification programs for individ-
uals employed by the independent assessment organizations 
who lead FedRAMP assessment teams. 
‘‘(b) ASSESSMENT.—Accredited independent assess-
ment organizations may assess, validate, and attest to the 
quality and compliance of security assessment materials 
provided by cloud service providers. 
‘‘§ 3611. Roles and responsibilities of agencies 
‘‘(a) IN GENERAL.—In implementing the requirements 
of FedRAMP, the head of each agency shall, consistent with 
guidance issued by the Director pursuant to section 3612— 
‘‘(1) create policies to ensure cloud computing 
services used by the agency meet FedRAMP security 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
requirements and other risk-based performance re-
quirements as defined by the Director; 
‘‘(2) issue agency-specific authorizations to oper-
ate for cloud computing services in compliance with 
section 3554; 
‘‘(3) confirm whether there is a provisional au-
thorization to operate in the cloud security repository 
established under section 3608(b)(10) issued by the 
Joint Authorization Board or a FedRAMP authoriza-
tion issued by the FedRAMP Program Management 
Office before beginning an agency authorization for a 
cloud computing product or service; 
‘‘(4) to the extent practicable, for any cloud com-
puting product or service the agency seeks to author-
ize that has received either a provisional authoriza-
tion to operate by the Joint Authorization Board or 
a FedRAMP authorization by the FedRAMP Program 
Management Office, use the existing assessments of se-
curity controls and materials within the authoriza-
tion package; and 
‘‘(5) provide data and information required to 
the Director pursuant to section 3612 to determine 
how agencies are meeting metrics as defined by the 
FedRAMP Program Management Office. 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘(b) SUBMISSION OF POLICIES REQUIRED.—Not later 
than 6 months after the date of the enactment of this section, 
the head of each agency shall submit to the Director the 
policies created pursuant to subsection (a)(1) for review and 
approval. 
‘‘(c) SUBMISSION OF AUTHORIZATIONS TO OPERATE 
REQUIRED.—Upon issuance of an authorization to operate 
or a provisional authorization to operate issued by an agen-
cy, the head of each agency shall provide a copy of the au-
thorization to operate letter and any supplementary infor-
mation required pursuant to section 3608(b) to the 
FedRAMP Program Management Office. 
‘‘(d) PRESUMPTION OF ADEQUACY.— 
‘‘(1) IN GENERAL.—The assessment of security 
controls and materials within the authorization pack-
age for provisional authorizations to operate issued 
by the Joint Authorization Board and agency author-
izations to operate that receive FedRAMP authoriza-
tion from the FedRAMP Program Management Office 
shall be presumed adequate for use in agency author-
izations of cloud computing products and services. 
‘‘(2) INFORMATION SECURITY REQUIREMENTS.— 
The presumption under paragraph (1) does not mod-
ify or alter the responsibility of any agency to ensure 
compliance with subchapter II of chapter 35 for any 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
cloud computing products or services used by the 
agency. 
‘‘§ 3612. Roles and responsibilities of the Office of 
Management and Budget 
‘‘The Director shall have the following duties: 
‘‘(1) Issue guidance to ensure that an agency 
does not operate a Federal Government cloud com-
puting service using Government data without an au-
thorization to operate issued by the agency that meets 
the requirements of subchapter II of chapter 35 and 
FedRAMP. 
‘‘(2) Ensure agencies are in compliance with 
any guidance or other requirements issued related to 
FedRAMP. 
‘‘(3) Review, analyze, and update guidance on 
the adoption, security, and use of cloud computing 
services used by agencies. 
‘‘(4) Ensure the Joint Authorization Board is in 
compliance with section 3609(c). 
‘‘(5) Adjudicate disagreements between the Joint 
Authorization Board and cloud service providers seek-
ing a provisional authorization to operate through the 
Joint Authorization Board. 
‘‘(6) Promulgate regulations on the role of 
FedRAMP authorization in agency acquisition of 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
cloud computing products and services that process 
unclassified information. 
‘‘§ 3613. 
Authorization 
of 
appropriations 
for 
FEDRAMP 
‘‘There is authorized to be appropriated $20,000,000 
each year for the FedRAMP Program Management Office 
and the Joint Authorization Board. 
‘‘§ 3614. Reports to Congress 
‘‘Not later than 12 months after the date of the enact-
ment of this section, and annually thereafter, the Director 
shall submit to the Committee on Oversight and Reform of 
the House of Representatives and the Committee on Home-
land Security and Governmental Affairs of the Senate a 
report that includes the following: 
‘‘(1) The status, efficiency, and effectiveness of 
FedRAMP Program Management Office and agencies 
during the preceding year in supporting the speed, ef-
fectiveness, sharing, reuse, and security of authoriza-
tions to operate for cloud computing products and 
services, including progress towards meeting the 
metrics adopted by the FedRAMP Program Manage-
ment Office pursuant to section 3608(d) and the Joint 
Authorization Board pursuant to section 3609(c)(5). 
‘‘(2) Data on agency use of provisional author-
izations to operate issued by the Joint Authorization 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
in this section as the ‘Committee’) to ensure effective 
and ongoing coordination of agency adoption, use, 
authorization, monitoring, acquisition, and security 
of cloud computing products and services to enable 
agency mission and administrative priorities. 
‘‘(2) PURPOSES.—The purposes of the Committee 
are the following: 
‘‘(A) 
To 
examine 
the 
operations 
of 
FedRAMP and determine ways that authoriza-
tion processes can continuously be improved, in-
cluding the following: 
‘‘(i) Measures to increase agency re-use 
of provisional authorizations to operate 
issued by the Joint Authorization Board. 
‘‘(ii) Proposed actions that can be 
adopted to reduce the cost of provisional au-
thorizations to operate and FedRAMP au-
thorizations for cloud service providers. 
‘‘(iii) Measures to increase the number 
of provisional authorizations to operate or 
FedRAMP authorizations for cloud com-
puting services offered by small businesses 
(as defined by section 3(a) of the Small 
Business Act (15 U.S.C. 632(a)). 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) Collect information and feedback on 
agency compliance with and implementation of 
FedRAMP requirements. 
‘‘(C) Serve as a forum that facilitates com-
munication 
and 
collaboration 
among 
the 
FedRAMP stakeholder community. 
‘‘(3) DUTIES.—The duties of the Committee are, 
at a minimum, the following: 
‘‘(A) Provide advice and recommendations 
to the Administrator, the Joint Authorization 
Board, and to agencies on technical, financial, 
programmatic, and operational matters regard-
ing secure adoption of cloud computing services. 
‘‘(B) Submit reports as required. 
‘‘(b) MEMBERS.— 
‘‘(1) COMPOSITION.—The Committee shall be 
comprised of not more than 15 members who are 
qualified representatives from the public and private 
sectors, appointed by the Administrator, in consulta-
tion with the Administrator of the Office of Electronic 
Government, as follows: 
‘‘(A) The Administrator or the Administra-
tor’s designee, who shall be the Chair of the Com-
mittee. 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) At least 1 representative each from the 
Cybersecurity and Infrastructure Security Agen-
cy and the National Institute of Standards and 
Technology. 
‘‘(C) At least 2 officials who serve as the 
Chief Information Security Officer within an 
agency, who shall be required to maintain such 
a position throughout the duration of their serv-
ice on the Committee. 
‘‘(D) At least 1 official serving as Chief 
Procurement Officer (or equivalent) in an agen-
cy, who shall be required to maintain such a po-
sition throughout the duration of their service on 
the Committee. 
‘‘(E) At least 1 individual representing an 
independent assessment organization. 
‘‘(F) No fewer than 5 representatives from 
unique businesses that primarily provide cloud 
computing services or products, including at 
least 2 representatives from a small business (as 
defined by section 3(a) of the Small Business Act 
(15 U.S.C. 632(a))). 
‘‘(G) At least 2 other government represent-
atives as the Administrator determines to be nec-
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
essary to provide sufficient balance, insights, or 
expertise to the Committee. 
‘‘(2) DEADLINE FOR APPOINTMENT.—Each mem-
ber of the Committee shall be appointed not later than 
30 days after the date of the enactment of this Act. 
‘‘(3) PERIOD OF APPOINTMENT; VACANCIES.— 
‘‘(A) 
IN
GENERAL.—Each 
non-Federal 
member of the Committee shall be appointed for 
a term of 3 years, except that the initial terms 
for members may be staggered 1, 2, or 3 year 
terms to establish a rotation in which one-third 
of the members are selected each year. Any such 
member may be appointed for not more than 2 
consecutive terms. 
‘‘(B) VACANCIES.—Any vacancy in the 
Committee shall not affect its powers, but shall 
be filled in the same manner in which the origi-
nal appointment was made. Any member ap-
pointed to fill a vacancy occurring before the ex-
piration of the term for which the member’s 
predecessor was appointed shall be appointed 
only for the remainder of that term. A member 
may serve after the expiration of that member’s 
term until a successor has taken office. 
‘‘(c) MEETINGS AND RULES OF PROCEDURES.— 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) MEETINGS.—The Committee shall hold not 
fewer than 3 meetings in a calendar year, at such 
time and place as determined by the Chair. 
‘‘(2) INITIAL MEETING.—Not later than 120 days 
after the date of the enactment of this section, the 
Committee shall meet and begin the operations of the 
Committee. 
‘‘(3) RULES
OF
PROCEDURE.—The Committee 
may establish rules for the conduct of the business of 
the Committee, if such rules are not inconsistent with 
this section or other applicable law. 
‘‘(d) EMPLOYEE STATUS.— 
‘‘(1) IN GENERAL.—A member of the Committee 
(other than a member who is appointed to the Com-
mittee in connection with another Federal appoint-
ment) shall not be considered an employee of the Fed-
eral Government by reason of any service as such a 
member, except for the purposes of section 5703 of 
title 5, relating to travel expenses. 
‘‘(2) PAY NOT PERMITTED.—A member of the 
Committee covered by paragraph (1) may not receive 
pay by reason of service on the panel. 
‘‘(e) APPLICABILITY TO THE FEDERAL ADVISORY COM-
MITTEE ACT.—Notwithstanding any other provision of law, 
the Federal Advisory Committee Act (5 U.S.C. App.) shall 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
apply to the Committee, except that section 14 of such Act 
shall not apply. 
‘‘(f) HEARINGS AND EVIDENCE.—The Committee, or 
on the authority of the Committee, any subcommittee, may, 
for the purposes of carrying out this section, hold hearings, 
sit and act at such times and places, take testimony, receive 
evidence, and administer oaths. 
‘‘(g) CONTRACTING.—The Committee, may, to such ex-
tent and in such amounts as are provided in appropriation 
Acts, enter into contracts to enable the Committee to dis-
charge its duties under this section. 
‘‘(h) INFORMATION FROM FEDERAL AGENCIES.— 
‘‘(1) IN GENERAL.—The Committee is authorized 
to secure directly from any executive department, bu-
reau, agency, board, commission, office, independent 
establishment, or instrumentality of the Government, 
information, suggestions, estimates, and statistics for 
the purposes of the Committee. Each department, bu-
reau, agency, board, commission, office, independent 
establishment, or instrumentality shall, to the extent 
authorized by law, furnish such information, sugges-
tions, estimates, and statistics directly to the Com-
mittee, upon request made by the Chair, the Chair of 
any subcommittee created by a majority of the Com-
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
mittee, or any member designated by a majority of 
the Committee. 
‘‘(2) RECEIPT, HANDLING, STORAGE, AND DIS-
SEMINATION.—Information may only be received, 
handled, stored, and disseminated by members of the 
Committee and its staff consistent with all applicable 
statutes, regulations, and Executive orders. 
‘‘(i) ASSISTANCE FROM AGENCIES.— 
‘‘(1) OTHER DEPARTMENTS AND AGENCIES.—In 
addition to the administration of the Committee by 
the General Services Administration, other agencies 
may provide to the Committee such services, funds, 
facilities, staff, and other support services as the head 
of the agency determines to be advisable and as is au-
thorized by law. 
‘‘(2) DETAIL OF EMPLOYEES.—Any Federal Gov-
ernment employee may be detailed to the Committee 
without reimbursement from the Committee, and such 
detailee shall retain the rights, status, and privileges 
of his or her regular employment without interrup-
tion. 
‘‘(j) POSTAL SERVICES.—The Committee may use the 
United States mails in the same manner and under the 
same conditions as agencies. 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘(k) EXPERT AND CONSULTANT SERVICES.—The Com-
mittee is authorized to procure the services of experts and 
consultants in accordance with section 3109 of title 5, but 
at rates not to exceed the daily rate paid a person occu-
pying a position at Level IV of the Executive Schedule 
under section 5315 of title 5. 
‘‘(l) REPORTS.— 
‘‘(1) INTERIM REPORTS.—The Committee may 
submit to the Administrator and Congress interim re-
ports containing such findings, conclusions, and rec-
ommendations as have been agreed to by the Com-
mittee. 
‘‘(2) ANNUAL
REPORTS.—Not later than 18 
months after the date of the enactment of this section, 
and annually thereafter, the Committee shall submit 
to the Administrator and Congress a final report con-
taining such findings, conclusions, and recommenda-
tions as have been agreed to by the Committee. 
‘‘§ 3616. Definitions 
‘‘(a) IN GENERAL.—Except as provided under sub-
section (b), the definitions under sections 3502 and 3552 
apply to sections 3607 through this section. 
‘‘(b) ADDITIONAL DEFINITIONS.—In sections 3607 
through this section: 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘(1) 
ADMINISTRATOR.—The 
term 
‘Adminis-
trator’ means the Administrator of General Services. 
‘‘(2) AUTHORIZATION PACKAGE.—The term ‘au-
thorization package’— 
‘‘(A) means the essential information used 
to determine whether to authorize the operation 
of an information system or the use of a des-
ignated set of common controls; and 
‘‘(B) at a minimum, includes the informa-
tion system security plan, privacy plan, security 
control assessment, privacy control assessment, 
and any relevant plans of action and milestones. 
‘‘(3) CLOUD COMPUTING.—The term ‘cloud com-
puting’ has the meaning given that term by the Na-
tional Institutes of Standards and Technology in 
NIST Special Publication 800–145 and any amend-
atory or superseding document thereto. 
‘‘(4) CLOUD
SERVICE
PROVIDER.—The term 
‘cloud service provider’ means an entity offering cloud 
computing services to agencies. 
‘‘(5) DIRECTOR.—The term ‘Director’ means the 
Director of the Office of Management and Budget. 
‘‘(6) FEDRAMP.—The term ‘FedRAMP’ means 
the Federal Risk and Authorization Management Pro-
gram established under section 3607(a). 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘(7) 
FEDRAMP
AUTHORIZATION.—The 
term 
‘FedRAMP authorization’ means a cloud computing 
product or service that has received an agency author-
ization to operate and has been approved by the 
FedRAMP Program Management Office to meet re-
quirements 
and 
guidelines 
established 
by 
the 
FedRAMP Program Management Office. 
‘‘(8) FEDRAMP
PROGRAM
MANAGEMENT
OF-
FICE.—The term ‘FedRAMP Program Management 
Office’ means the office that administers FedRAMP 
established under section 3608. 
‘‘(9) 
INDEPENDENT
ASSESSMENT
ORGANIZA-
TION.—The term ‘independent assessment organiza-
tion’ means a third-party organization accredited by 
the Program Director of the FedRAMP Program 
Management Office to undertake conformity assess-
ments of cloud service providers. 
‘‘(10) JOINT AUTHORIZATION BOARD.—The term 
‘Joint Authorization Board’ means the Joint Author-
ization Board established under section 3609.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.—The 
table of sections for chapter 36 of title 44, United States 
Code, is amended by adding at the end the following new 
items: 
‘‘3607. Federal Risk and Authorization Management Program. 
‘‘3608. FedRAMP Program Management Office. 
‘‘3609. Joint Authorization Board. 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6213
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘3610. Independent assessment organizations. 
‘‘3611. Roles and responsibilities of agencies. 
‘‘3612. Roles and responsibilities of the Office of Management and Budget. 
‘‘3613. Authorization of appropriations for FEDRAMP. 
‘‘3614. Reports to Congress. 
‘‘3615. Federal Secure Cloud Advisory Committee. 
‘‘3616. Definitions.’’. 
(c) SUNSET.—This Act and any amendment made by 
this Act shall be repealed on the date that is 10 years after 
the date of the enactment of this Act. 
(d) RULE OF CONSTRUCTION.—Nothing in this Act or 
any amendment made by this Act shall be construed as al-
tering or impairing the authorities of the Director of the 
Office of Management and Budget or the Secretary of 
Homeland Security under subchapter II of chapter 35 of 
title 44, United States Code. 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS