IB 
Union Calendar No. 315 
116TH CONGRESS 
2D SESSION 
H. R. 3941 
[Report No. 116–391] 
To enhance the innovation, security, and availability of cloud computing 
services used in the Federal Government by establishing the Federal 
Risk and Authorization Management Program within the General Serv-
ices Administration and by establishing a risk management, authoriza-
tion, and continuous monitoring process to enable the Federal Govern-
ment to leverage cloud computing services using a risk-based approach 
consistent with the Federal Information Security Modernization Act of 
2014 and cloud-based operations, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 24, 2019 
Mr. CONNOLLY (for himself and Mr. MEADOWS) introduced the following bill; 
which was referred to the Committee on Oversight and Reform 
FEBRUARY 5, 2020 
Additional sponsor: Mr. FITZPATRICK 
FEBRUARY 5, 2020 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on July 24, 2019] 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
A BILL 
To enhance the innovation, security, and availability of cloud 
computing services used in the Federal Government by 
establishing the Federal Risk and Authorization Manage-
ment Program within the General Services Administra-
tion and by establishing a risk management, authoriza-
tion, and continuous monitoring process to enable the 
Federal Government to leverage cloud computing services 
using a risk-based approach consistent with the Federal 
Information Security Modernization Act of 2014 and 
cloud-based operations, and for other purposes. 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Federal Risk and Au-
thorization Management Program Authorization Act of 
2019’’ or the ‘‘FedRAMP Authorization Act’’. 
SEC. 2. CODIFICATION OF THE FEDRAMP PROGRAM. 
(a) AMENDMENT.—Chapter 36 of title 44, United 
States Code, is amended by adding at the end the following 
new sections: 
‘‘§ 3607. Federal Risk and Authorization Management 
Program 
‘‘(a) ESTABLISHMENT.—There is established within 
the General Services Administration the Federal Risk and 
Authorization Management Program. The Administrator of 
General Services, in accordance with the guidelines estab-
lished pursuant to section 3612, shall establish a govern-
mentwide program that provides the authoritative stand-
ardized approach to security assessment and authorization 
for cloud computing products and services that process un-
classified information used by agencies. 
‘‘(b) COMPONENTS OF FEDRAMP.—The Joint Author-
ization Board and the FedRAMP Program Management 
Office are established as components of FedRAMP. 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘§ 3608. FedRAMP Program Management Office 
‘‘(a) GSA DUTIES.— 
‘‘(1) ROLES AND RESPONSIBILITIES.—The Ad-
ministrator of General Services shall— 
‘‘(A) determine the categories and character-
istics of cloud computing information technology 
goods or services that are within the jurisdiction 
of FedRAMP and that require FedRAMP au-
thorization from the Joint Authorization Board 
or the FedRAMP Program Management Office; 
‘‘(B) develop, coordinate, and implement a 
process for the FedRAMP Program Management 
Office, the Joint Authorization Board, and agen-
cies to review security assessments of cloud com-
puting services pursuant to subsections (b) and 
(c) of section 3611, and appropriate oversight of 
continuous monitoring of cloud computing serv-
ices; and 
‘‘(C) ensure the continuous improvement of 
FedRAMP. 
‘‘(2) 
IMPLEMENTATION.—The 
Administrator 
shall oversee the implementation of FedRAMP, in-
cluding— 
‘‘(A) appointing a Program Director to 
oversee the FedRAMP Program Management Of-
fice; 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘(B) hiring professional staff as may be 
necessary for the effective operation of the 
FedRAMP Program Management Office, and 
such other activities as are essential to properly 
perform critical functions; 
‘‘(C) entering into interagency agreements 
to detail personnel on a reimbursable or non-re-
imbursable basis to assist the FedRAMP Pro-
gram Management Office and the Joint Author-
ization Board in discharging the responsibilities 
of the Office under this section; and 
‘‘(D) such other actions as the Adminis-
trator may determine necessary to carry out this 
section. 
‘‘(b) DUTIES.—The FedRAMP Program Management 
Office shall have the following duties: 
‘‘(1) Provide guidance to independent assessment 
organizations, validate the independent assessments, 
and apply the requirements and guidelines adopted in 
section 3609(c)(5). 
‘‘(2) Oversee and issue guidelines regarding the 
qualifications, roles, and responsibilities of inde-
pendent assessment organizations. 
‘‘(3) Develop templates and other materials to 
support the Joint Authorization Board and agencies 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
in the authorization of cloud computing services to 
increase the speed, effectiveness, and transparency of 
the authorization process, consistent with standards 
defined by the National Institute of Standards and 
Technology. 
‘‘(4) Establish and maintain a public comment 
process for proposed guidance before the issuance of 
such guidance by FedRAMP. 
‘‘(5) Issue FedRAMP authorization for any au-
thorizations to operate issued by an agency that meets 
the requirements and guidelines described in para-
graph (1). 
‘‘(6) Establish frameworks for agencies to use au-
thorization packages processed by the FedRAMP Pro-
gram Management Office and Joint Authorization 
Board. 
‘‘(7) Coordinate with the Secretary of Defense 
and the Secretary of Homeland Security to establish 
a framework for continuous monitoring and reporting 
required of agencies pursuant to section 3553. 
‘‘(8) Establish a centralized and secure reposi-
tory to collect and share necessary data, including se-
curity authorization packages, from the Joint Author-
ization Board and agencies to enable better sharing 
and reuse to such packages across agencies. 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS
‘‘(c) EVALUATION OF AUTOMATION PROCEDURES.— 
‘‘(1) IN
GENERAL.—The FedRAMP Program 
Management Office shall assess and evaluate available 
automation capabilities and procedures to improve 
the efficiency and effectiveness of the issuance of pro-
visional authorizations to operate issued by the Joint 
Authorization Board and FedRAMP authorizations, 
including continuous monitoring of cloud environ-
ments and among cloud environments. 
‘‘(2) MEANS FOR AUTOMATION.—Not later than 
1 year after the date of the enactment of this section 
and updated annually thereafter, the FedRAMP Pro-
gram Management Office shall establish a means for 
the automation of security assessments and reviews. 
‘‘(d) METRICS FOR AUTHORIZATION.—The FedRAMP 
Program Management Office shall establish annual metrics 
regarding the time and quality of the assessments necessary 
for completion of a FedRAMP authorization process in a 
manner that can be consistently tracked over time in con-
junction with the periodic testing and evaluation process 
pursuant to section 3554 in a manner that minimizes the 
agency reporting burden. 
‘‘§ 3609. Joint Authorization Board 
‘‘(a) ESTABLISHMENT.—There is established the Joint 
Authorization Board which shall consist of cloud computing 
VerDate Sep 11 2014 
21:44 Feb 05, 2020
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H3941.RH
H3941
kjohnson on DSK79L0C42PROD with BILLS