,,ii #aadth ,,congress #b;d ,session ,s4 #cbfc ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #ad1 #bjaf,mr4 ,moran 7for himself1 ,mr4 ,udall1 ,mr4 ,daines1 and ,mr4 ,warner7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to promote innovation and realize the efficiency gains and economic benefits of on-demand computing by accelerating the acquisition and deployment of innovative technology and computing resources throughout the ,federal ,government1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,modernizing ,outdated and ,vulnerable ,equipment and ,information ,technology ,act of #bjaf or the ,,move ,,it ,act4 #b4 ,findings and purposes 7a7 ,findings ,congress finds the following3 7#a7 ,national ,institute of ,standards and ,technology ,special ,publication #hjj-ade describes cloud computing as an evolving paradigm for information technology that is a model for enabling ubiquitous1 convenient1 on-demand network access to a shared pool of configurable computing resources 7i4e41 networks1 servers1 storage1 applications1 and services7 that can be rapidly provisioned and released with minimal management effort or service provider interaction4 7#b7 ,together1 the efficiencies1 cost savings1 and greater computing power enabled by cloud computing has the potential to-- 7,a7 eliminate inappropriate duplication1 reduce costs1 and address waste1 fraud1 and abuse in providing ,government services that are publicly available2 7,b7 address the critical need for cybersecurity by design2 and 7,c7 move the ,federal ,government into a broad digital-services delivery model that could transform the fashion in which the ,federal ,government provides services to the people of the ,united ,states4 7b7 ,purposes ,the purposes of this ,act are to-- 7#a7 accelerate the acquisition and deployment of cloud computing services by addressing key impediments and roadblocks in funding1 development1 and acquisition practices2 7#b7 support and expand an efficient ,federal certification standard for qualifying cloud services providers under the ,federal ,risk and ,authorization ,management ,program using a qualify once1 use many times efficiency model that strikes an appropriate balance between-- 7,a7 encouraging the adoption of strong security practices to protect against the harm of cyber intrusions and hacks2 and 7,b7 avoiding the imposition of unduly burdensome and restrictive requirements on cloud computing service providers that would deter investment in innovative cloud computing services2 7#c7 assist agencies in migrating to cloud computing services by providing guidance and oversight of agency enterprise-wide information technology portfolios suitable for and identifiable as suitable for a cloud-based delivery model2 and 7#d7 provide for ,federal agencies to procure cloud computing services that adhere to sound security practices4 #c4 ,federal risk and authorization management program 7a7 ,in general ,except as provided under subsection 7b71 a covered agency may not store or process ,government information on a ,federal information system with any cloud service provider1 unless the provider has an authorization to operate1 or a provisional authorization to operate1 covering the proposed scope of work1 from the covered agency or the ,joint ,authorization ,board4 ,a covered agency operating under a provisional authorization to operate shall issue an authorization to operate as soon as practicable and may not rely on the provisional authorization to operate for the duration of the scope of work4 7b7 ,waiver of requirements 7#a7 ,in general ,the ,director of ,national ,intelligence1 or a designee of the ,director1 may waive the applicability to any national security system of any provision of this section if the ,director of ,national ,intelligence1 or the designee1 determines that such waiver is in the interest of national security4 7#b7 ,notification ,not later than #cj days after exercising a waiver under this subsection1 the ,director of ,national ,intelligence1 or the designee of the ,director1 as the case may be1 shall submit to the ,committee on ,homeland ,security and ,governmental ,affairs and the ,select ,committee on ,intelligence of the ,senate and the ,committee on ,oversight and ,government ,reform and the ,permanent ,select ,committee on ,intelligence of the ,house of ,representatives a statement describing and justifying the waiver4 7c7 ,rule of construction ,nothing in this section shall be construed as limiting the ability of the ,office of ,management and ,budget to update or modify ,federal guidelines relating to the security of cloud computing4 #d4 ,expanded industry collaboration and metrics development for the ,federal ,risk and ,authorization ,management program office 7a7 ,in general ,the ,director shall coordinate with the ,federal ,risk and ,authorization ,management ,program ,office to establish mandatory guidelines for the submission of an application for an authorization to operate and related materials to the ,federal ,risk and ,authorization ,management ,program ,office4 7b7 ,contents ,the guidelines established under subsection 7a7 shall streamline and accelerate the ,federal ,risk and ,authorization ,management ,program accreditation process by meeting the following requirements3 7#a7 ,not less frequently than monthly1 report to the applicant the status1 expected time to completion1 and other key indicators related to compliance for an application for authorization to operate submitted to the ,federal ,risk and ,authorization ,management ,program ,office4 7#b7 ,enhanced training and industry liaison opportunities for covered agencies and cloud service providers4 7#c7 ,a clarification of-- 7,a7 the role and authority of third party assessment organization in the ,federal ,risk and ,authorization ,management ,program process for authorizations to operate by covered agencies2 7,b7 the extent to which the ,federal ,risk and ,authorization ,management ,program ,office may identify and begin to accept or rely upon certifications from other standards development organizations or third party assessment organization2 and 7,c7 the responsibility of covered agencies to sponsor a ,federal ,risk and ,authorization ,management ,program authorization to operate as part of making ,federal ,risk and ,authorization ,management ,program compliance a condition for entering into a contract or providing cloud computing services to a covered agency4 7c7 ,fed,r,a,m,p liaison group 7#a7 ,in general ,the ,director1 in coordination with the ,program ,management ,office and the ,national ,institute of ,standards and ,technology1 shall host a public-private industry cloud commercial working group 7in this subsection referred to as the ,fed,r,a,m,p ,liaison ,group7 representing cloud service providers4 7#b7 ,composition and functions ,the ,fed,r,a,m,p ,liaison ,group-- 7,a7 shall include representatives of cloud service providers2 7,b7 may include such working groups as are determined appropriate by the ,fed,r,a,m,p ,liaison ,group2 7,c7 shall be hosted by the ,general ,services ,administration1 who shall convene plenary meetings on a quarterly basis with individual working groups meeting as frequently as determined by the group2 and 7,d7 shall consult with and provide recommendations directly to the ,program ,management ,office and the ,joint ,authorization ,board of the ,federal ,risk and ,authorization ,management ,program regarding the operations1 processes improvements1 and best practices of the ,office and ,board4 7#c7 ,,faca exemption ,the ,federal ,advisory ,committee ,act shall not apply to the ,fed,r,a,m,p ,liaison ,group4 7d7 ,providing ,dedicated ,agency ,support ,the ,program ,management ,office shall work with each covered agency to support and guide the efforts of the agency-- 7#a7 to establish and issue the authorization to operate for the agency2 7#b7 to facilitate authorization approval1 support1 and direct interfacing with cloud service providers2 and 7#c7 to facilitate partnership among agencies to efficiently support activities related to obtaining an authorization to operate4 7e7 ,metrics ,the ,director1 in coordination with the ,national ,institute of ,standards and ,technology and the ,fed,r,a,m,p ,liaison ,group1 shall establish key performance metrics for the ,federal ,risk and ,authorization ,management ,program ,office1 which shall include-- 7#a7 recommendations for maximum time limits for the completion of authorizations to operate by service categories of cloud service providers1 not to exceed six months2 7#b7 targets for the streamlining of the authorization to operate through the use of innovative templates and transparent submission requirements2 and 7#c7 recommendations for satisfying ,federal continuous monitoring requirements4 7f7 ,report required ,not later than one year after the date of the enactment of this ,act1 the ,director shall submit to the ,committees on ,appropriations and ,oversight and ,government ,reform of the ,house of ,representatives and the ,committees on ,appropriations and ,homeland ,security and ,governmental ,affairs of the ,senate a report on the effectiveness and efficiency of the ,federal ,risk and ,authorization ,management ,program ,office4 #e4 ,additional budget authorities for the ,modernization of ,,it ,systems 7a7 ,assessment of ,cloud ,first ,implementation ,not later than #ij days after the date of the enactment of this ,act1 the ,director1 in consultation with the ,chief ,information ,officers ,council1 shall assess cloud computing opportunities and issue policies and guidelines for the adoption of ,governmentwide programs providing for a standardized approach to security assessment and operational authorization for cloud computing products and services4 7b7 ,information technology system modernization and working capital fund 7#a7 ,establishment ,there is established in each covered agency an information technology system modernization and working capital fund 7hereafter ,,it working capital fund7 for necessary expenses for the agency described in paragraph 7#b74 7#b7 ,source of funds ,amounts may be deposited into an ,,it working capital fund as follows3 7,a7 ,reprogramming of funds1 including reprogramming of any funds available on the date of enactment of this ,act for the operation and maintenance of legacy systems1 in compliance with any applicable reprogramming law or guidelines of the ,committees on ,appropriations of the ,house of ,representatives and the ,senate4 7,b7 ,transfer of funds1 including transfer of any funds available on the date of enactment of this ,act for the operation and maintenance of legacy systems1 but only if transfer authority is specifically provided for by law4 7,c7 ,amounts made available through discretionary appropriations4 7#c7 ,use of funds ,an ,,it working capital fund established under paragraph 7#a7 may be used only for the following3 7,a7 ,the replacement of a legacy information technology system4 7,b7 ,the transition to cloud computing and innovative platforms and technologies subject to a transition plan for any project that costs more than #e1jjj1jjj and approved by the ,federal ,chief ,information ,officer according to such guidelines as the ,office of ,management and ,budget may designate4 7,c7 ,to assist and support agency efforts to provide adequate1 risk-based1 and cost-effective information technology capabilities that address evolving threats to information security4 7,d7 ,developmental1 modernization1 and enhancement activities of information technology4 7#d7 ,existing funds ,an ,,it working capital fund may not be used to supplant funds provided for the operation and maintenance of any system already within an appropriation for the agency at the time of establishment of the ,,it working capital fund4 7#e7 ,reprogramming and transfer of funds ,the head of each covered agency shall prioritize funds within the ,,it working capital fund to be used initially for cost savings activities approved by the ,federal ,chief ,information ,officer1 in consultation with the ,chief ,information ,officer of the covered agency4 ,the head of each covered agency may-- 7,a7 reprogram any amounts saved as a direct result of such activities for deposit into the applicable ,,it working capital fund1 consistent with paragraph 7#b77;,a71 except that any such reprogramming of amounts in excess of #ejj1jjj shall be reported to the ,committees on ,appropriations of the ,house of ,representatives and the ,senate #cj days in advance of such reprogramming2 and 7,b7 may transfer any amounts saved as a direct result of such activities for deposit into the applicable ,,it working capital fund1 consistent with paragraph 7#b77;,b71 except that any such transfer of amounts in excess of #ejj1jjj shall be reported to the ,committees on ,appropriations of the ,house of ,representatives and the ,senate #cj days in advance of such transfer4 7#f7 ,return of funds ,any funds deposited into an ,,it working capital fund must be obligated no later than #c years after the date of such deposit4 ,any funds that are unobligated #c years after such date shall be rescinded and deposited into the general fund of the ,treasury and reported to the ,committees on ,appropriations of the ,house of ,representatives and the ,senate4 7#g7 ,semiannual report required ,not later than #f months after the date of the enactment of this ,act1 and semiannually thereafter1 the head of any covered agency that uses an ,,it working capital fund shall submit to the ,committees on ,appropriations and ,oversight and ,government ,reform of the ,house of ,representatives and the ,committees on ,appropriations and ,homeland ,security and ,governmental ,affairs of the ,senate a report on the obligation and expenditure of funds made available under this section4 7c7 ,,gao report ,not later than one year after the date of the enactment of this ,act1 and annually thereafter for five years1 the ,comptroller ,general of the ,united ,states shall submit to the ,committees on ,appropriations and ,oversight and ,government ,reform of the ,house of ,representatives and the ,committees on ,appropriations and ,homeland ,security and ,governmental ,affairs of the ,senate a report-- 7#a7 on the implementation and operation of each ,,it working capital fund established under this section2 7#b7 that identifies current practices and compares the practices with industry best practices in areas such as the effective oversight and governance of a cloud computing working capital fund2 and 7#c7 that describes the basis for the use and operation of an ,,it working capital fund1 the efficacy of the working capital fund to accelerate technology transitions1 and recommendations for further improvement for the working capital fund4 #f4 ,definitions ,in this ,act3 7#a7 ,authorization to operate ,the term authorization to operate means an approval and accreditation1 including a provisional authorization to operate1 regarding the security and operational qualifications of a cloud computing service provider to offer secure1 reliable cloud computing service to a covered agency1 that may be issued by the ,joint ,authorization ,board1 any successor entity1 or the head of a covered agency4 7#b7 ,cloud computing ,the term cloud computing has the meaning given that term by the ,national ,institute of ,standards and ,technology in ,,nist ,special ,publication #hjj-ade and any amendatory or superseding document thereto4 7#c7 ,cloud service provider ,the term cloud service provider means an entity offering cloud computing infrastructure1 platforms1 or software for commercial and ,government entities4 7#d7 ,covered agency ,the term covered agency means each agency listed in section #ija7;b7 of title #ca1 ,united ,states ,code4 7#e7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#f7 ,federal risk and authorization management program office ,the term ,federal ,risk and ,authorization ,management ,program ,office or ,program ,management ,office means the ,federal ,risk and ,authorization ,management ,program ,office1 or any successor thereto4 7#g7 ,information system ,the term information system has the meaning given that term under section #cejb of title #dd1 ,united ,states ,code4 7#h7 ,information technology ,the term information technology has the meaning given that term under section #aaaja of title #dj1 ,united ,states ,code4 7#i7 ,legacy information technology system ,the term legacy information technology system means an outdated or obsolete information technology that is no longer supported by the originating vendor or manufacturer4 7#aj7 ,national security system ,the term national security system has the meaning given that term under section #ceeb of title #dd1 ,united ,states ,code4 7#aa7 ,third party assessment organization ,the term third party assessment organization means a third party accreditation body that conducts a conformity assessment of a cloud service data provider to ensure the provider meets security and operational guidelines issued by the ,federal ,risk and ,authorization ,management ,program ,office4