,,ii  #aad? ,,congress  #b;d ,session   
,s4 #cbfc  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,july #ad1 #bjaf,mr4   
,moran 7= himself1 ,mr4 ,udall1 ,mr4    
,da9es1 & ,mr4 ,w>n]7 introduc$ ! foll[+
 bill2 :i* 0 read twice & ref]r$ to !   
,committee on ,homel& ,security &       
,gov]nm5tal ,affairs  ,a ,,bill  ,to    
promote innovation & realize ! effici5cy
 ga9s & economic b5efits ( on-dem&      
comput+ by accel]at+ ! acquisition &    
deploym5t ( innovative te*nology &      
comput+ res\rces ?r\gh\t ! ,f$]al       
,gov]nm5t1 & = o!r purposes4  #a4 ,%ort 
title ,?is ,act may be cit$ z !         
,mod]niz+ ,outdat$ & ,vuln]able         
,equipm5t & ,in=mation ,te*nology ,act (
 #bjaf or ! ,,move ,,x ,act4  #b4 ,f9d+s
 & purposes  7a7 ,f9d+s ,congress f9ds !
 foll[+3  7#a7 ,national ,in/itute (    
,/&>ds & ,te*nology ,special            
,publication #hjj-ade describes cl\d    
comput+ z an evolv+ p>adigm = in=mation 
te*nology t is a model = enabl+         
ubiquit\s1 conv5i5t1 on-dem& network    

access to a %>$ pool ( configurable     
comput+ res\rces 7i4e41 networks1 s]v]s1
 /orage1 applications1 & s]vices7 t c be
 rapidly provision$ & releas$ ) m9imal  
managem5t ef=t or s]vice provid]        
int]action4  7#b7 ,toge!r1 !            
effici5cies1 co/ sav+s1 & great] comput+
 p[] enabl$ by cl\d comput+ has !       
pot5tial to--  7,a7 elim9ate            
inappropriate duplication1 r$uce co/s1 &
 address wa/e1 fraud1 & abuse 9 provid+ 
,gov]nm5t s]vices t are publicly        
available2  7,b7 address ! critical ne$ 
= cyb]security by design2 &  7,c7 move !
 ,f$]al ,gov]nm5t into a broad          
digital-s]vices deliv]y model t c\ld    
trans=m ! fa%ion 9 :i* ! ,f$]al         
,gov]nm5t provides s]vices to ! p ( !   
,unit$ ,/ates4  7b7 ,purposes ,!        
purposes ( ?is ,act are to-- 7#a7       
accel]ate ! acquisition & deploym5t (   
cl\d comput+ s]vices by address+ key    
imp$im5ts & roadblocks 9 fund+1         
developm5t1 & acquisition practices2    
7#b7 support & exp& an effici5t ,f$]al  

c]tification /&>d = qualify+ cl\d       
s]vices provid]s "u ! ,f$]al ,risk &    
,au?orization ,managem5t ,program us+ a 
qualify once1 use _m times effici5cy    
model t /rikes an appropriate balance   
betwe5--  7,a7 enc\rag+ ! adoption (    
/rong security practices to protect     
aga9/ ! h>m ( cyb] intrusions & hacks2 &
  7,b7 avoid+ ! imposition ( unduly     
burd5some & re/rictive requirem5ts on   
cl\d comput+ s]vice provid]s t w\ld det]
 inve/m5t 9 innovative cl\d comput+     
s]vices2  7#c7 assi/ ag5cies 9 migrat+  
to cl\d comput+ s]vices by provid+      
guidance & ov]sight ( ag5cy             
ent]prise-wide in=mation te*nology      
portfolios suitable = & id5tifiable z   
suitable = a cl\d-bas$ deliv]y model2 & 
7#d7 provide = ,f$]al ag5cies to procure
 cl\d comput+ s]vices t adh]e to s\nd   
security practices4  #c4 ,f$]al risk &  
au?orization managem5t program  7a7 ,9  
g5]al ,except z provid$ "u subsection   
7b71 a cov]$ ag5cy may n /ore or process
 ,gov]nm5t in=mation on a ,f$]al        

in=mation sy/em ) any cl\d s]vice       
provid]1 unless ! provid] has an        
au?orization to op]ate1 or a provisional
 au?orization to op]ate1 cov]+ ! propos$
 scope ( "w1 f ! cov]$ ag5cy or ! ,jo9t 
,au?orization ,bo>d4 ,a cov]$ ag5cy     
op]at+ "u a provisional au?orization to 
op]ate %all issue an au?orization to    
op]ate z soon z practicable & may n rely
 on ! provisional au?orization to op]ate
 = ! duration ( ! scope ( "w4  7b7      
,waiv] ( requirem5ts  7#a7 ,9 g5]al ,!  
,director ( ,national ,intellig5ce1 or a
 designee ( ! ,director1 may waive !    
applicability to any national security  
sy/em ( any provision ( ?is section if !
 ,director ( ,national ,intellig5ce1 or 
! designee1 det]m9es t su* waiv] is 9 ! 
int]e/ ( national security4  7#b7       
,notification ,n lat] ?an #cj days aft] 
ex]cis+ a waiv] "u ?is subsection1 !    
,director ( ,national ,intellig5ce1 or !
 designee ( ! ,director1 z ! case may   
be1 %all submit to ! ,committee on      
,homel& ,security & ,gov]nm5tal ,affairs

 & ! ,select ,committee on ,intellig5ce 
( ! ,s5ate & ! ,committee on ,ov]sight &
 ,gov]nm5t ,re=m & ! ,p]man5t ,select   
,committee on ,intellig5ce ( ! ,h\se (  
,repres5tatives a /atem5t describ+ &    
ju/ify+ ! waiv]4  7c7 ,rule (           
con/ruction ,no?+ 9 ?is section %all be 
con/ru$ z limit+ ! ability ( ! ,(fice ( 
,managem5t & ,budget to update or modify
 ,f$]al guidel9es relat+ to ! security (
 cl\d comput+4  #d4 ,exp&$ indu/ry      
collaboration & metrics developm5t = !  
,f$]al ,risk & ,au?orization ,managem5t 
program (fice  7a7 ,9 g5]al ,! ,director
 %all coord9ate ) ! ,f$]al ,risk &      
,au?orization ,managem5t ,program ,(fice
 to e/abli% m&atory guidel9es = !       
submission ( an application = an        
au?orization to op]ate & relat$ mat]ials
 to ! ,f$]al ,risk & ,au?orization      
,managem5t ,program ,(fice4  7b7        
,cont5ts ,! guidel9es e/abli%$ "u       
subsection 7a7 %all /reaml9e & accel]ate
 ! ,f$]al ,risk & ,au?orization         
,managem5t ,program accr$itation process

 by meet+ ! foll[+ requirem5ts3  7#a7 ,n
 less frequ5tly ?an mon?ly1 report to ! 
applicant ! /atus1 expect$ "t to        
completion1 & o!r key indicators relat$ 
to compliance = an application =        
au?orization to op]ate submitt$ to !    
,f$]al ,risk & ,au?orization ,managem5t 
,program ,(fice4  7#b7 ,enhanc$ tra9+ & 
indu/ry liaison opportunities = cov]$   
ag5cies & cl\d s]vice provid]s4  7#c7 ,a
 cl>ification (-- 7,a7 ! role & au?ority
 ( ?ird p>ty assessm5t organization 9 ! 
,f$]al ,risk & ,au?orization ,managem5t 
,program process = au?orizations to     
op]ate by cov]$ ag5cies2  7,b7 ! ext5t  
to :i* ! ,f$]al ,risk & ,au?orization   
,managem5t ,program ,(fice may id5tify &
 beg9 to accept or rely ^u c]tifications
 f o!r /&>ds developm5t organizations or
 ?ird p>ty assessm5t organization2 &    
7,c7 ! responsibility ( cov]$ ag5cies to
 sponsor a ,f$]al ,risk & ,au?orization 
,managem5t ,program au?orization to     
op]ate z "p ( mak+ ,f$]al ,risk &       
,au?orization ,managem5t ,program       

compliance a condition = ent]+ into a   
contract or provid+ cl\d comput+ s]vices
 to a cov]$ ag5cy4  7c7 ,fed,r,a,m,p    
liaison gr\p  7#a7 ,9 g5]al ,!          
,director1 9 coord9ation ) ! ,program   
,managem5t ,(fice & ! ,national         
,in/itute ( ,/&>ds & ,te*nology1 %all   
ho/ a public-private indu/ry cl\d       
comm]cial work+ gr\p 79 ?is subsection  
ref]r$ to z ! ,fed,r,a,m,p ,liaison     
,gr\p7 repres5t+ cl\d s]vice provid]s4  
7#b7 ,composition & functions ,!        
,fed,r,a,m,p ,liaison ,gr\p-- 7,a7 %all 
include repres5tatives ( cl\d s]vice    
provid]s2  7,b7 may include su* work+   
gr\ps z are det]m9$ appropriate by !    
,fed,r,a,m,p ,liaison ,gr\p2  7,c7 %all 
be ho/$ by ! ,g5]al ,s]vices            
,adm9i/ration1 :o %all conv5e pl5>y     
meet+s on a qu>t]ly basis ) individual  
work+ gr\ps meet+ z frequ5tly z det]m9$ 
by ! gr\p2 &  7,d7 %all consult ) &     
provide recomm5dations directly to !    
,program ,managem5t ,(fice & ! ,jo9t    
,au?orization ,bo>d ( ! ,f$]al ,risk &  

,au?orization ,managem5t ,program reg>d+
 ! op]ations1 processes improvem5ts1 &  
be/ practices ( ! ,(fice & ,bo>d4  7#c7 
,,faca exemption ,! ,f$]al ,advisory    
,committee ,act %all n apply to !       
,fed,r,a,m,p ,liaison ,gr\p4  7d7       
,provid+ ,d$icat$ ,ag5cy ,support ,!    
,program ,managem5t ,(fice %all "w ) ea*
 cov]$ ag5cy to support & guide ! ef=ts 
( ! ag5cy--  7#a7 to e/abli% & issue !  
au?orization to op]ate = ! ag5cy2  7#b7 
to facilitate au?orization approval1    
support1 & direct int]fac+ ) cl\d s]vice
 provid]s2 &  7#c7 to facilitate        
p>tn]%ip among ag5cies to effici5tly    
support activities relat$ to obta9+ an  
au?orization to op]ate4  7e7 ,metrics ,!
 ,director1 9 coord9ation ) ! ,national 
,in/itute ( ,/&>ds & ,te*nology & !     
,fed,r,a,m,p ,liaison ,gr\p1 %all       
e/abli% key p]=mance metrics = ! ,f$]al 
,risk & ,au?orization ,managem5t        
,program ,(fice1 :i* %all include--     
7#a7 recomm5dations = maximum "t limits 
= ! completion ( au?orizations to op]ate

 by s]vice categories ( cl\d s]vice     
provid]s1 n to exce$ six mon?s2  7#b7   
t>gets = ! /reaml9+ ( ! au?orization to 
op]ate ?r\gh ! use ( innovative         
templates & transp>5t submission        
requirem5ts2 &  7#c7 recomm5dations =   
satisfy+ ,f$]al cont9u\s monitor+       
requirem5ts4  7f7 ,report requir$ ,n    
lat] ?an "o ye> aft] ! date ( ! enactm5t
 ( ?is ,act1 ! ,director %all submit to 
! ,committees on ,appropriations &      
,ov]sight & ,gov]nm5t ,re=m ( ! ,h\se ( 
,repres5tatives & ! ,committees on      
,appropriations & ,homel& ,security &   
,gov]nm5tal ,affairs ( ! ,s5ate a report
 on ! effectiv5ess & effici5cy ( !      
,f$]al ,risk & ,au?orization ,managem5t 
,program ,(fice4  #e4 ,additional budget
 au?orities = ! ,mod]nization ( ,,x     
,sy/ems  7a7 ,assessm5t ( ,cl\d ,fir/   
,implem5tation ,n lat] ?an #ij days aft]
 ! date ( ! enactm5t ( ?is ,act1 !      
,director1 9 consultation ) ! ,*ief     
,in=mation ,(fic]s ,c\ncil1 %all assess 
cl\d comput+ opportunities & issue      

policies & guidel9es = ! adoption (     
,gov]nm5twide programs provid+ = a      
/&>diz$ approa* to security assessm5t & 
op]ational au?orization = cl\d comput+  
products & s]vices4  7b7 ,in=mation     
te*nology sy/em mod]nization & work+    
capital fund  7#a7 ,e/abli%m5t ,!re is  
e/abli%$ 9 ea* cov]$ ag5cy an in=mation 
te*nology sy/em mod]nization & work+    
capital fund 7h]eaft] ,,x work+ capital 
fund7 = necess>y exp5ses = ! ag5cy      
describ$ 9 p>agraph 7#b74  7#b7 ,s\rce (
 funds ,am\nts may be deposit$ into an  
,,x work+ capital fund z foll[s3 7,a7   
,reprogramm+ ( funds1 includ+           
reprogramm+ ( any funds available on !  
date ( enactm5t ( ?is ,act = ! op]ation 
& ma9t5ance ( legacy sy/ems1 9          
compliance ) any applicable reprogramm+ 
law or guidel9es ( ! ,committees on     
,appropriations ( ! ,h\se (             
,repres5tatives & ! ,s5ate4  7,b7       
,transf] ( funds1 includ+ transf] ( any 
funds available on ! date ( enactm5t (  
?is ,act = ! op]ation & ma9t5ance (     

legacy sy/ems1 b only if transf]        
au?ority is specifically provid$ = by   
law4  7,c7 ,am\nts made available ?r\gh 
discretion>y appropriations4  7#c7 ,use 
( funds ,an ,,x work+ capital fund      
e/abli%$ "u p>agraph 7#a7 may be us$    
only = ! foll[+3  7,a7 ,! replacem5t ( a
 legacy in=mation te*nology sy/em4  7,b7
 ,! transition to cl\d comput+ &        
innovative plat=ms & te*nologies subject
 to a transition plan = any project t   
co/s m ?an #e1jjj1jjj & approv$ by !    
,f$]al ,*ief ,in=mation ,(fic] accord+  
to su* guidel9es z ! ,(fice ( ,managem5t
 & ,budget may designate4  7,c7 ,to     
assi/ & support ag5cy ef=ts to provide  
adequate1 risk-bas$1 & co/-effective    
in=mation te*nology capabilities t      
address evolv+ ?reats to in=mation      
security4  7,d7 ,developm5tal1          
mod]nization1 & enhancem5t activities ( 
in=mation te*nology4  7#d7 ,exi/+ funds 
,an ,,x work+ capital fund may n be us$ 
to supplant funds provid$ = ! op]ation &
 ma9t5ance ( any sy/em already )9 an    

appropriation = ! ag5cy at ! "t (       
e/abli%m5t ( ! ,,x work+ capital fund4  
7#e7 ,reprogramm+ & transf] ( funds ,!  
head ( ea* cov]$ ag5cy %all prioritize  
funds )9 ! ,,x work+ capital fund to be 
us$ initially = co/ sav+s activities    
approv$ by ! ,f$]al ,*ief ,in=mation    
,(fic]1 9 consultation ) ! ,*ief        
,in=mation ,(fic] ( ! cov]$ ag5cy4 ,!   
head ( ea* cov]$ ag5cy may--  7,a7      
reprogram any am\nts sav$ z a direct    
result ( su* activities = deposit into !
 applicable ,,x work+ capital fund1     
consi/5t ) p>agraph 7#b77;,a71 except t 
any su* reprogramm+ ( am\nts 9 excess ( 
#ejj1jjj %all be report$ to !           
,committees on ,appropriations ( ! ,h\se
 ( ,repres5tatives & ! ,s5ate #cj days 9
 advance ( su* reprogramm+2 &  7,b7 may 
transf] any am\nts sav$ z a direct      
result ( su* activities = deposit into !
 applicable ,,x work+ capital fund1     
consi/5t ) p>agraph 7#b77;,b71 except t 
any su* transf] ( am\nts 9 excess (     
#ejj1jjj %all be report$ to !           

,committees on ,appropriations ( ! ,h\se
 ( ,repres5tatives & ! ,s5ate #cj days 9
 advance ( su* transf]4  7#f7 ,return ( 
funds ,any funds deposit$ into an ,,x   
work+ capital fund mu/ be obligat$ no   
lat] ?an #c ye>s aft] ! date ( su*      
deposit4 ,any funds t are unobligat$ #c 
ye>s aft] su* date %all be resc9d$ &    
deposit$ into ! g5]al fund ( ! ,treasury
 & report$ to ! ,committees on          
,appropriations ( ! ,h\se (             
,repres5tatives & ! ,s5ate4  7#g7       
,semiannual report requir$ ,n lat] ?an  
#f mon?s aft] ! date ( ! enactm5t ( ?is 
,act1 & semiannually !reaft]1 ! head (  
any cov]$ ag5cy t uses an ,,x work+     
capital fund %all submit to !           
,committees on ,appropriations &        
,ov]sight & ,gov]nm5t ,re=m ( ! ,h\se ( 
,repres5tatives & ! ,committees on      
,appropriations & ,homel& ,security &   
,gov]nm5tal ,affairs ( ! ,s5ate a report
 on ! obligation & exp5diture ( funds   
made available "u ?is section4  7c7     
,,gao report ,n lat] ?an "o ye> aft] !  

date ( ! enactm5t ( ?is ,act1 & annually
 !reaft] = five ye>s1 ! ,comptroll]     
,g5]al ( ! ,unit$ ,/ates %all submit to 
! ,committees on ,appropriations &      
,ov]sight & ,gov]nm5t ,re=m ( ! ,h\se ( 
,repres5tatives & ! ,committees on      
,appropriations & ,homel& ,security &   
,gov]nm5tal ,affairs ( ! ,s5ate a       
report--  7#a7 on ! implem5tation &     
op]ation ( ea* ,,x work+ capital fund   
e/abli%$ "u ?is section2  7#b7 t        
id5tifies curr5t practices & comp>es !  
practices ) indu/ry be/ practices 9     
areas su* z ! effective ov]sight &      
gov]nance ( a cl\d comput+ work+ capital
 fund2 &  7#c7 t describes ! basis = !  
use & op]ation ( an ,,x work+ capital   
fund1 ! efficacy ( ! work+ capital fund 
to accel]ate te*nology transitions1 &   
recomm5dations = fur!r improvem5t = !   
work+ capital fund4  #f4 ,def9itions ,9 
?is ,act3 7#a7 ,au?orization to op]ate  
,! t]m au?orization to op]ate means an  
approval & accr$itation1 includ+ a      
provisional au?orization to op]ate1     

reg>d+ ! security & op]ational          
qualifications ( a cl\d comput+ s]vice  
provid] to (f] secure1 reliable cl\d    
comput+ s]vice to a cov]$ ag5cy1 t may  
be issu$ by ! ,jo9t ,au?orization ,bo>d1
 any successor entity1 or ! head ( a    
cov]$ ag5cy4  7#b7 ,cl\d comput+ ,! t]m 
cl\d comput+ has ! mean+ giv5 t t]m by !
 ,national ,in/itute ( ,/&>ds &         
,te*nology 9 ,,ni/ ,special ,publication
 #hjj-ade & any am5datory or sup]s$+    
docum5t !reto4  7#c7 ,cl\d s]vice       
provid] ,! t]m cl\d s]vice provid] means
 an entity (f]+ cl\d comput+            
infra/ructure1 plat=ms1 or s(tw>e =     
comm]cial & ,gov]nm5t entities4  7#d7   
,cov]$ ag5cy ,! t]m cov]$ ag5cy means   
ea* ag5cy li/$ 9 section #ija7;b7 (     
title #ca1 ,unit$ ,/ates ,code4  7#e7   
,director ,! t]m ,director means !      
,director ( ! ,(fice ( ,managem5t &     
,budget4  7#f7 ,f$]al risk &            
au?orization managem5t program (fice ,! 
t]m ,f$]al ,risk & ,au?orization        
,managem5t ,program ,(fice or ,program  

,managem5t ,(fice means ! ,f$]al ,risk &
 ,au?orization ,managem5t ,program      
,(fice1 or any successor !reto4  7#g7   
,in=mation sy/em ,! t]m in=mation sy/em 
has ! mean+ giv5 t t]m "u section #cejb 
( title #dd1 ,unit$ ,/ates ,code4  7#h7 
,in=mation te*nology ,! t]m in=mation   
te*nology has ! mean+ giv5 t t]m "u     
section #aaaja ( title #dj1 ,unit$      
,/ates ,code4  7#i7 ,legacy in=mation   
te*nology sy/em ,! t]m legacy in=mation 
te*nology sy/em means an outdat$ or     
obsolete in=mation te*nology t is no    
long] support$ by ! orig9at+ v5dor or   
manufactur]4  7#aj7 ,national security  
sy/em ,! t]m national security sy/em has
 ! mean+ giv5 t t]m "u section #ceeb (  
title #dd1 ,unit$ ,/ates ,code4  7#aa7  
,?ird p>ty assessm5t organization ,! t]m
 ?ird p>ty assessm5t organization means 
a ?ird p>ty accr$itation body t conducts
 a con=mity assessm5t ( a cl\d s]vice   
data provid] to ensure ! provid] meets  
security & op]ational guidel9es issu$ by
 ! ,f$]al ,risk & ,au?orization         

,managem5t ,program ,(fice4