,i #aaeth ,,congress #b;d ,session ,h4 ,r4 #feej ,,in ,,the ,,house ,,of ,,representatives ,july #bf1 #bjah,mr4 ,connolly 7for himself and ,mr4 ,meadows7 introduced the following bill2 which was referred to the ,committee on ,oversight and ,government ,reform ,a ,,bill ,to enhance the innovation1 security1 and availability of ,federal ,government cloud services by establishing the ,federal ,risk and ,authorization ,management ,program within the ,office of ,management and ,budget ,office of ,electronic ,government and by establishing a risk management1 authorization1 and continuous monitoring process to enable the ,federal ,government to leverage cloud computing services using a risk-based approach consistent with the ,federal ,information ,security ,reform ,act of #bjad and cloud-based operations1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,risk and ,authorization ,management ,program ,reform ,act of #bjah or the ,fed,r,a,m,p ,authorization ,act4 #b4 ,codification of the ,fed,r,a,m,p program 7a7 ,amendment ,chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding at the end the following new sections3 #cfjg4 ,federal ,risk and ,authorization ,management ,program 7a7 ,establishment ,there is established within the ,general ,services ,administration1 an office to be known as the ,fed,r,a,m,p ,program ,management ,office that shall be responsible for the ,federal ,risk and ,authorization ,management ,program4 ,fed,r,a,m,p is a specific ,government certification program that examines and accredits cloud service providers that offer ,federal cloud computing services for sale1 lease1 or purchase to ,federal agency cloud customers4 ,the ,fed,r,a,m,p ,program ,management ,office embodies the goal of a qualify once1 use many times process through the issuance of certifications in the form of provisional authorizations to operate4 7b7 ,components of ,fed,r,a,m,p ,there are established as components of ,fed,r,a,m,p the ,joint ,authorization ,board and the ,program ,management ,office1 or such successor offices as the ,office of ,management and ,budget1 through the ,office of ,electronic ,government may determine4 7c7 ,fed,r,a,m,p duties ,the ,director of the ,office of ,management and ,budget and the ,administrator of ,general ,services1 or their designees1 shall work together to do the following3 7#a7 ,issue guidance on categories and characteristics of information technology goods or services that are within the jurisdiction of ,fed,r,a,m,p and that require ,fed,r,a,m,p certification4 7#b7 ,issue guidance for the establishment and implementation of ,fed,r,a,m,p to conduct security assessments1 reviews1 and appropriate oversight of continuous monitoring of cloud services used by agencies4 7#c7 ,not later than #ahj days after the date of the enactment of this section1 and annually thereafter1 submit to ,congress a report on the status and performance of the ,fed,r,a,m,p ,program ,management ,office1 including the status and disposition of waiver requests to ,fed,r,a,m,p submitted to the ,fed,r,a,m,p ,program ,management ,office by agencies and a description of and progress towards meeting the metrics adopted by the ,fed,r,a,m,p ,program ,management ,office pursuant to section #cfjh7;e71 as submitted to the ,administrator by that ,office4 #cfjh4 ,roles and responsibilities of the ,fed,r,a,m,p ,program ,management ,office 7a7 ,implementation ,upon delegation from the ,office of ,electronic ,government1 the ,administrator shall oversee the implementation of ,fed,r,a,m,p1 including-- 7#a7 appointing a ,program ,director to oversee the ,fed,r,a,m,p ,program ,management ,office2 7#b7 hiring professional staff as may be necessary for the effective operation of the ,fed,r,a,m,p ,program ,management ,office1 and such other activities as are essential to properly perform critical functions2 and 7#c7 such other actions as the ,administrator may determine necessary to carry out this section4 7b7 ,authority and ,duties ,the ,fed,r,a,m,p ,program ,management ,office shall have the following authority and duties3 7#a7 ,provide guidance to agencies1 regarding compliance with requirements1 guidelines1 and standards developed by the ,national ,institute of ,standards and ,technology4 7#b7 ,provide guidance to third party assessment organizations in using and applying the requirements1 guidelines1 and standards adopted by ,fed,r,a,m,p4 7#c7 ,provide guidance to agencies on appropriate use of and acquisition of ,fed,r,a,m,p approved services1 including the role of cloud brokers and cloud service integrators4 7#d7 ,in consultation with the ,director and the ,secretary of ,homeland ,security1 issue guidance for agencies on monitoring and reporting on the usage and demand of cloud computing1 use of automation1 and use of commercial cloud services to the fullest extent practical4 7#e7 ,in consultation with the ,federal ,chief ,information ,officer1 oversee and issue guidelines regarding the qualifications1 roles1 and responsibilities of third party assessment organizations1 in consultation with the ,national ,institute of ,standards and ,technology4 7#f7 ,develop standards and templates1 including a summary risk report template for third party assessment organizations that informs the security assessment report to complement the existing authorization package artifacts and serve as an authorization decision-making tool4 7#g7 ,coordinate with stakeholders to provide guidance and recommendations to ,fed,r,a,m,p4 ,stakeholders to include-- 7,a7 agency cloud customers2 7,b7 cloud service providers2 7,c7 third party assessment organizations2 7,d7 agency ,offices of ,inspector ,general2 and 7,e7 the ,government ,accountability ,office4 7#h7 ,establish and maintain a public comment process for newly issued or revised guidance adopted by ,fed,r,a,m,p4 7c7 ,evaluation of automation procedures ,the ,fed,r,a,m,p ,program ,management ,office shall assess and evaluate available automation procedures to accelerate the processing of ,fed,r,a,m,p applications4 7d7 ,metrics for certification ,the ,fed,r,a,m,p ,program ,management ,office shall adopt specific metrics regarding the time1 cost1 and quality of the assessments necessary for completion of a ,fed,r,a,m,p authorization process in a manner that can be consistently tracked over time1 which shall be done in conjunction with the periodic testing and evaluation process pursuant to subchapter ,,ii of chapter #ce in a manner that minimizes the agency reporting burden4 #cfji4 ,roles and responsibilities of the ,joint ,authorization ,board 7a7 ,establishment ,there is established the ,joint ,authorization ,board which shall consist of the ,chief ,information ,officers or their designees of the ,department of ,defense1 the ,department of ,homeland ,security1 and the ,general ,services ,administration4 7b7 ,issuance of provisional authorizations ,to operate ,the ,joint ,authorization ,board shall have the authority to issue provisional authorizations to operate to cloud service providers that meet ,fed,r,a,m,p security guidelines set forth in the ,common ,security ,control ,baseline4 7c7 ,duties ,the ,joint ,authorization ,board shall-- 7#a7 review and validate cloud service provider and third party assessment organization security assessment packages2 7#b7 in consultation with the ,fed,r,a,m,p ,program ,management ,office1 serve as a resource for best practices to accelerate the ,fed,r,a,m,p process2 7#c7 obtain such professional staff as may be necessary for the effective operation of ,fed,r,a,m,p and such other activities as are essential to properly perform critical functions2 7#d7 such other roles and responsibilities as the ,fed,r,a,m,p ,program ,management ,office may assign1 as agreed to by the ,fed,r,a,m,p ,program ,management ,office and members of the ,joint ,authorization ,board2 and 7#e7 appoint technical representatives responsible for ,fed,r,a,m,p activities within each ,joint ,authorization ,board agency4 #cfaj4 ,roles and responsibilities of third party assessment organizations 7a7 ,requirements for certification ,the ,fed,r,a,m,p ,program ,management ,office1 in consultation with the ,joint ,authorization ,board1 shall determine the requirements for certification of third party assessment organizations4 ,such requirements may include developing or requiring certification programs for individuals employed by the third party assessment organizations who lead ,fed,r,a,m,p assessment teams4 7b7 ,assessment ,accredited third party assessment organizations shall assess1 validate1 and attest to the quality and compliance of security assessment materials provided by cloud service providers4 7c7 ,summary risk report ,accredited third party assessment organizations shall develop a risk report that summarizes the security assessment report to complement the existing authorization package artifacts and serve as an authorization decision making tool4 #cfaa4 ,roles and responsibilities of agencies 7a7 ,in general ,in implementing and enforcing the requirements of ,fed,r,a,m,p1 ,federal agency cloud customers shall-- 7#a7 create policies to implement ,fed,r,a,m,p requirements2 7#b7 issue agency-specific authorizations to operate for ,federal cloud computing services in compliance with subchapter ,,ii of chapter #ce2 7#c7 be in compliance with any ,fed,r,a,m,p requirements1 unless a waiver is issued by the ,director2 7#d7 provide data to the ,director on how agencies are meeting metrics as defined by the ,fed,r,a,m,p ,program ,management ,office pursuant to section #cfad7;b72 and 7#e7 if applicable1 ensure that any contract is in compliance with ,fed,r,a,m,p requirements4 7b7 ,submission of policies required ,not later than #f months after the date of the enactment of this section1 ,federal agency cloud customers shall submit to the ,director the policies created pursuant to subsection 7a77#a7 for review and approval4 7c7 ,submission of authorizations ,to operate required ,upon issuance of an authorization to operate1 the head of the relevant agency shall provide a copy of the authorization to operate letter to the ,fed,r,a,m,p ,program ,management ,office and the cloud service provider to enable the ,fed,r,a,m,p ,program ,management ,office to track and assess all forms of authorizations to operate on a ,governmentwide basis4 7d7 ,presumption of adequacy ,any provisional authorization to operate issued by the ,joint ,authorization ,board shall be considered to be presumptively adequate by agencies1 subject to technical or programmatic rebuttal by an agency that disagrees with adequacy or sufficiency of the certification4 ,this rebuttable presumption of adequacy shall not derogate1 modify1 or alter the responsibility of any agency to ensure compliance with the subchapter ,,ii of chapter #ce for any ,federal cloud computing services that the agency deploys4 7e7 ,waiver or exception ,the ,chief ,information ,officer of each agency may request a waiver or exception to specific ,fed,r,a,m,p requirements4 ,such request for waiver shall be in accordance with the determinations and finding issued under section #cfab7b74 ,the determination and findings shall be submitted to the ,fed,r,a,m,p ,program ,management ,office and the ,director1 along with such supporting articles as may be required under guidelines issued by ,fed,r,a,m,p4 7f7 ,agency reports required ,not later than #ij days after the date of which any guidance is issued pursuant to section #cfjh7;b77#d7 from the ,fed,r,a,m,p ,program ,management ,office1 the head of each agency shall submit to the ,director a report on cloud computing usage and the potential demand for cloud computing4 #cfab4 ,roles and ,responsibilities of the ,office of ,management and ,budget ,the ,director shall have the following duties3 7#a7 ,highlight current guidance or issue new guidance to ensure that an agency does not operate a ,federal ,government cloud computing service using ,government data without issuing an authorization to operate issued by the agency that meets the requirements of subchapter ,,ii of chapter #ce and ,fed,r,a,m,p4 7#b7 ,issue guidance and templates for agency determinations and findings for waivers to the requirements of ,fed,r,a,m,p 7any request by an agency for such a waiver must set forth unique agency-specific technical1 operational1 or managerial requirements necessary for agency operations74 7#c7 ,define alternatives and agency best practices for compliance with the ,trusted ,internet ,connection for agencies connecting to a cloud service provider4 7#d7 ,grant waivers or exceptions to specific ,fed,r,a,m,p requirements as may be necessary by the submission of agency determinations and findings that meet the ,,omb guidelines for ,fed,r,a,m,p waivers pursuant to paragraph 7#b74 7#e7 ,ensure agencies are in compliance with any guidance or other requirements issued related to ,fed,r,a,m,p4 #cfac4 ,funding of ,fed,r,a,m,p ,the ,fed,r,a,m,p ,program ,management ,office may1 to the extent deemed appropriate by the ,administrator and in consultation with the ,director1 use funds contained within the ,acquisition ,services ,fund described under section #cba of title #dj or such other funds as may be available for the operations of ,fed,r,a,m,p4 #cfad4 ,reporting 7a7 ,in general ,not later than #ah months after the date of the enactment of this section1 and annually thereafter1 the ,director shall submit to the ,committee on ,oversight and ,government ,reform of the ,house of ,representatives and the ,committee on ,homeland ,security and ,government ,affairs of the ,senate a report that includes the following3 7#a7 ,the status1 efficiency1 and effectiveness of ,fed,r,a,m,p during the preceding year in authorizing and recertifying secure cloud solutions for ,federal agency cloud customers4 7#b7 ,the length of time for ,federal agency cloud customers to issue authorizations to operate during the preceding year4 7#c7 ,agency requests for ,fed,r,a,m,p waivers4 7#d7 ,progress during the preceding year in advancing automation techniques to securely automate ,fed,r,a,m,p processes and to accelerate reporting as described in this section4 7#e7 ,number of cloud computing systems in use at each agency and the number of cloud computing authorizations to operate4 7b7 ,,gao report ,not later than #b years after the date of enactment of this section1 and every three years thereafter1 the ,comptroller ,general shall submit to the ,oversight and ,government ,reform ,committee of the ,house of ,representatives and the ,homeland ,security and ,governmental ,affairs ,committee of the ,senate an assessment of ,fed,r,a,m,p1 third party assessment organizations1 and ,federal agency cloud customers1 including the following3 7#a7 ,an evaluation of the impact and continuing need for specific cloud security controls4 7#b7 ,a review of the adequacy of resources to run ,fed,r,a,m,p4 7#c7 ,the development of reusability and the potential for the use and adoption of reciprocal standards1 whether from ,government or the private sector1 as substitutes for specific security controls in use by the ,fed,r,a,m,p ,project ,management ,office4 #cfae4 ,definitions 7a7 ,in general ,except as provided under paragraph 7#b71 the definitions under sections #cejb and #ceeb apply to sections #cfjg through #cfad4 7b7 ,additional definitions ,in sections #cfjg through #cfad3 7#a7 ,administrator ,the term ,administrator means the ,administrator of ,general ,services4 7#b7 ,cloud broker ,the term cloud broker means an entity that manages the use1 performance1 and delivery of cloud computing services and negotiates relationships between cloud service providers and cloud consumers4 7#c7 ,cloud computing ,the term cloud computing means a model for enabling ubiquitous1 convenient1 on-demand network access to a shared pool of configurable computing resources 7such as networks1 servers1 storage1 applications1 and services7 that can be rapidly provisioned and released with minimal management effort or service provider interaction 7as defined by the ,national ,institute of ,standards and ,technology pursuant to the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c71 including ,,nist ,special ,publication #hjj-ade7 or any successor thereto4 7#d7 ,cloud service integrator ,the term cloud service integrator means a systems or service integrator that specializes in cloud computing services4 7#e7 ,cloud service provider ,the term cloud service provider means a third party entity offering cloud computing services to the ,federal ,government4 7#f7 ,common security control baseline ,the term common security control baseline means the guidance issued pursuant to section #cfjg7;c77#b74 7#g7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#h7 ,federal agency cloud customer ,the term ,federal agency cloud customer means an agency using cloud computing services4 7#i7 ,federally controlled information system ,the term federally controlled information system or ,federal information system means an information system used or operated by a ,federal agency cloud customer as set forth and in compliance with the guidelines and requirements of section #ceed of title #dj4 7#aj7 ,federal ,government cloud computing services ,the term ,federal ,government cloud computing services means a cloud computing service that is used or operated by a ,federal agency cloud customer upon a federally controlled information system4 7#aa7 ,fed,r,a,m,p ,the term ,fed,r,a,m,p means the ,federal ,risk and ,authorization ,management ,program established under section #cfjg7;a74 7#ab7 ,fed,r,a,m,p ,program ,management ,office ,the term ,fed,r,a,m,p ,program ,management ,office means the office that administers ,fed,r,a,m,p4 7#ac7 ,fed,r,a,m,p security controls baseline ,the term ,fed,r,a,m,p security controls baseline means those security controls that cloud service providers and agencies must1 at a minimum1 address to receive a provisional authorization to operate1 as defined by the ,fed,r,a,m,p ,program ,management ,office4 7#ad7 ,joint ,authorization ,board ,the term ,joint ,authorization ,board means the ,joint ,authorization ,board established under section #cfji4 7#ae7 ,technical representative ,the term technical representative means an agency's technical representative to the ,joint ,authorization ,board designated by the member agency of the ,joint ,authorization ,board4 7#af7 ,third party assessment organization ,the term third party assessment organization means a third-party organization accredited by the ,program ,director of the ,fed,r,a,m,p ,program ,management ,office to undertake conformity assessments of cloud service providers4 4 7b7 ,technical and conforming amendment ,the table of sections for chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding at the end the following new items3 #cfjg4 ,federal ,risk and ,authorization ,management ,program4 #cfjh4 ,roles and responsibilities of the ,fed,r,a,m,p ,program ,management ,office4 #cfji4 ,roles and responsibilities of the ,joint ,authorization ,board4 #cfaj4 ,roles and responsibilities of third party assessment organizations4 #cfaa4 ,roles and responsibilities of the agencies4 #cfab4 ,funding of ,fed,r,a,m,p4 #cfac4 ,reporting4 #cfad4 ,definitions4 4