#aaf? ,,congress  #b;d ,session  ,h4 ,r4
 #cida  ,,an ,,act  ,to enhance !       
innovation1 security1 & availability (  
cl\d comput+ s]vices us$ 9 ! ,f$]al     
,gov]nm5t by e/abli%+ ! ,f$]al ,risk &  
,au?orization ,managem5t ,program )9 !  
,g5]al ,s]vices ,adm9i/ration & by      
e/abli%+ a risk managem5t1 au?orization1
 & cont9u\s monitor+ process to enable !
 ,f$]al ,gov]nm5t to lev]age cl\d       
comput+ s]vices us+ a risk-bas$ approa* 
consi/5t ) ! ,f$]al ,in=mation ,security
 ,mod]nization ,act ( #bjad & cl\d-bas$ 
op]ations1 & = o!r purposes4  #a4 ,%ort 
title ,?is ,act may be cit$ z ! ,f$]al  
,risk & ,au?orization ,managem5t        
,program ,au?orization ,act ( #bjai or !
 ,fed,r,a,m,p ,au?orization ,act4  #b4  
,codification ( ! ,fed,r,a,m,p program  
7a7 ,am5dm5t ,*apt] #cf ( title #dd1    
,unit$ ,/ates ,code1 is am5d$ by add+ at
 ! end ! foll[+ new sections3  #cfjg4   
,f$]al ,risk & ,au?orization ,managem5t 
,program  7a7 ,e/abli%m5t ,!re is       
e/abli%$ )9 ! ,g5]al ,s]vices           

,adm9i/ration ! ,f$]al ,risk &          
,au?orization ,managem5t ,program4 ,!   
,adm9i/rator ( ,g5]al ,s]vices1 9       
accordance ) ! guidel9es e/abli%$       
pursuant to section #cfab1 %all e/abli% 
a gov]nm5twide program t provides !     
au?oritative /&>diz$ approa* to security
 assessm5t & au?orization = cl\d comput+
 products & s]vices t process           
unclassifi$ in=mation us$ by ag5cies4   
7b7 ,compon5ts ( f$ramp ,! ,jo9t        
,au?orization ,bo>d & ! ,fed,r,a,m,p    
,program ,managem5t ,(fice are e/abli%$ 
z compon5ts ( ,fed,r,a,m,p4  #cfjh4     
,fed,r,a,m,p ,program ,managem5t ,(fice 
7a7 ,,gsa duties  7#a7 ,roles &         
responsibilities ,! ,adm9i/rator (      
,g5]al ,s]vices %all-- 7,a7 det]m9e !   
categories & *>act]i/ics ( cl\d comput+ 
in=mation te*nology goods or s]vices t  
are )9 ! jurisdiction ( ,fed,r,a,m,p & t
 require ,fed,r,a,m,p au?orization f !  
,jo9t ,au?orization ,bo>d or !          
,fed,r,a,m,p ,program ,managem5t ,(fice2
  7,b7 develop1 coord9ate1 & implem5t a 

process = ! ,fed,r,a,m,p ,program       
,managem5t ,(fice1 ! ,jo9t ,au?orization
 ,bo>d1 & ag5cies to review security    
assessm5ts ( cl\d comput+ s]vices       
pursuant to subsections 7b7 & 7c7 (     
section #cfaa1 & appropriate ov]sight ( 
cont9u\s monitor+ ( cl\d comput+        
s]vices2 &  7,c7 ensure ! cont9u\s      
improvem5t ( ,fed,r,a,m,p4  7#b7        
,implem5tation ,! ,adm9i/rator %all     
ov]see ! implem5tation ( ,fed,r,a,m,p1  
includ+-- 7,a7 appo9t+ a ,program       
,director to ov]see ! ,fed,r,a,m,p      
,program ,managem5t ,(fice2  7,b7 hir+  
pr(essional /aff z may be necess>y = !  
effective op]ation ( ! ,fed,r,a,m,p     
,program ,managem5t ,(fice1 & su* o!r   
activities z are ess5tial to prop]ly    
p]=m critical functions2  7,c7 ent]+    
into int]ag5cy agreem5ts to detail      
p]sonnel on a reimbursable or           
non-reimbursable basis to assi/ !       
,fed,r,a,m,p ,program ,managem5t ,(fice 
& ! ,jo9t ,au?orization ,bo>d 9 dis*>g+ 
! responsibilities ( ! ,(fice "u ?is    

section2 &  7,d7 su* o!r actions z !    
,adm9i/rator may det]m9e necess>y to    
c>ry out ?is section4  7b7 ,duties ,!   
,fed,r,a,m,p ,program ,managem5t ,(fice 
%all h ! foll[+ duties3  7#a7 ,provide  
guidance to indep5d5t assessm5t         
organizations1 validate ! indep5d5t     
assessm5ts1 & apply ! requirem5ts &     
guidel9es adopt$ 9 section              
#cfji7;c77#e74  7#b7 ,ov]see & issue    
guidel9es reg>d+ ! qualifications1      
roles1 & responsibilities ( indep5d5t   
assessm5t organizations4  7#c7 ,develop 
templates & o!r mat]ials to support !   
,jo9t ,au?orization ,bo>d & ag5cies 9 ! 
au?orization ( cl\d comput+ s]vices to  
increase ! spe$1 effectiv5ess1 &        
transp>5cy ( ! au?orization process1    
consi/5t ) /&>ds def9$ by ! ,national   
,in/itute ( ,/&>ds & ,te*nology4  7#d7  
,e/abli% & ma9ta9 a public comm5t       
process = propos$ guidance be=e !       
issuance ( su* guidance by ,fed,r,a,m,p4
  7#e7 ,issue ,fed,r,a,m,p au?orization 
= any au?orizations to op]ate issu$ by  

an ag5cy t meets ! requirem5ts &        
guidel9es describ$ 9 p>agraph 7#a74     
7#f7 ,e/abli% frameworks = ag5cies to   
use au?orization packages process$ by ! 
,fed,r,a,m,p ,program ,managem5t ,(fice 
& ,jo9t ,au?orization ,bo>d4  7#g7      
,coord9ate ) ! ,secret>y ( ,def5se & !  
,secret>y ( ,homel& ,security to e/abli%
 a framework = cont9u\s monitor+ &      
report+ requir$ ( ag5cies pursuant to   
section #ceec4  7#h7 ,e/abli% a         
c5traliz$ & secure repository to collect
 & %>e necess>y data1 includ+ security  
au?orization packages1 f ! ,jo9t        
,au?orization ,bo>d & ag5cies to enable 
bett] %>+ & reuse to su* packages across
 ag5cies4  7c7 ,evaluation ( automation 
proc$ures  7#a7 ,9 g5]al ,! ,fed,r,a,m,p
 ,program ,managem5t ,(fice %all assess 
& evaluate available automation         
capabilities & proc$ures to improve !   
effici5cy & effectiv5ess ( ! issuance ( 
provisional au?orizations to op]ate     
issu$ by ! ,jo9t ,au?orization ,bo>d &  
,fed,r,a,m,p au?orizations1 includ+     

cont9u\s monitor+ ( cl\d environm5ts &  
among cl\d environm5ts4  7#b7 ,means =  
automation ,n lat] ?an #a ye> aft] !    
date ( ! enactm5t ( ?is section & updat$
 annually !reaft]1 ! ,fed,r,a,m,p       
,program ,managem5t ,(fice %all e/abli% 
a means = ! automation ( security       
assessm5ts & reviews4  7d7 ,metrics =   
au?orization ,! ,fed,r,a,m,p ,program   
,managem5t ,(fice %all e/abli% annual   
metrics reg>d+ ! "t & quality ( !       
assessm5ts necess>y = completion ( a    
,fed,r,a,m,p au?orization process 9 a   
mann] t c be consi/5tly track$ ov] "t 9 
conjunction ) ! p]iodic te/+ &          
evaluation process pursuant to section  
#ceed 9 a mann] t m9imizes ! ag5cy      
report+ burd54  #cfji4 ,jo9t            
,au?orization ,bo>d  7a7 ,e/abli%m5t    
,!re is e/abli%$ ! ,jo9t ,au?orization  
,bo>d :i* %all consi/ ( cl\d comput+    
exp]ts1 appo9t$ by ! ,director 9        
consultation ) ! ,adm9i/rator1 f ea* ( !
 foll[+3  7#a7 ,! ,dep>tm5t ( ,def5se4  
7#b7 ,! ,dep>tm5t ( ,homel& ,security4  

7#c7 ,! ,g5]al ,s]vices ,adm9i/ration4  
7#d7 ,su* o!r ag5cies z det]m9$ by !    
,director1 9 consultation ) !           
,adm9i/rator4  7b7 ,issuance (          
provisional au?orizations to op]ate ,!  
,jo9t ,au?orization ,bo>d %all conduct  
security assessm5ts ( cl\d comput+      
s]vices & issue provisional             
au?orizations to op]ate to cl\d s]vice  
provid]s t meet ,fed,r,a,m,p security   
guidel9es set =? 9 section              
#cfjh7;b77#a74  7c7 ,duties ,! ,jo9t    
,au?orization ,bo>d %all--  7#a7 develop
 & make publicly available on a website1
 det]m9$ by ! ,adm9i/rator1 crit]ia =   
prioritiz+ & select+ cl\d comput+       
s]vices to be assess$ by ! ,jo9t        
,au?orization ,bo>d2  7#b7 provide      
regul> updates on ! /atus ( any cl\d    
comput+ s]vice dur+ ! assessm5t &       
au?orization process ( ! ,jo9t          
,au?orization ,bo>d2  7#c7 review &     
validate cl\d comput+ s]vices &         
indep5d5t assessm5t organization        
security packages or any docum5tation   

det]m9$ to be necess>y by ! ,jo9t       
,au?orization ,bo>d to evaluate ! sy/em 
security ( a cl\d comput+ s]vice2  7#d7 
9 consultation ) ! ,fed,r,a,m,p ,program
 ,managem5t ,(fice1 s]ve z a res\rce =  
be/ practices to accel]ate !            
,fed,r,a,m,p process2  7#e7 e/abli%     
requirem5ts & guidel9es = security      
assessm5ts ( cl\d comput+ s]vices1      
consi/5t ) /&>ds def9$ by ! ,national   
,in/itute ( ,/&>ds & ,te*nology1 to be  
us$ by ! ,jo9t ,au?orization ,bo>d &    
ag5cies2  7#f7 p]=m su* o!r roles &     
responsibilities z ! ,adm9i/rator may   
assign1 9 consultation ) ! ,fed,r,a,m,p 
,program ,managem5t ,(fice & memb]s ( ! 
,jo9t ,au?orization ,bo>d2 &  7#g7      
e/abli% metrics & goals = reviews &     
activities associat$ ) issu+ provisional
 au?orizations to op]ate & provide to ! 
,fed,r,a,m,p ,program ,managem5t ,(fice4
  7d7 ,det]m9ations ( dem& = cl\d       
comput+ s]vices ,! ,jo9t ,au?orization  
,bo>d %all consult ) ! ,*ief ,in=mation 
,(fic]s ,c\ncil e/abli%$ 9 section #cfjc

 to e/abli% a process = prioritiz+ &    
accept+ ! cl\d comput+ s]vices to be    
grant$ a provisional au?orization to    
op]ate ?r\gh ! ,jo9t ,au?orization      
,bo>d1 :i* %all be made available on a  
public website4  7e7 ,detail ( p]sonnel 
,to assi/ ! ,jo9t ,au?orization ,bo>d 9 
dis*>g+ ! responsibilities "u ?is       
section1 p]sonnel ( ag5cies may be      
detail$ to ! ,jo9t ,au?orization ,bo>d =
 ! p]=mance ( duties describ$ "u        
subsection 7c74  #cfaj4 ,indep5d5t      
assessm5t organizations  7a7            
,requirem5ts = accr$itation ,! ,jo9t    
,au?orization ,bo>d %all det]m9e !      
requirem5ts = c]tification ( indep5d5t  
assessm5t organizations pursuant to     
section #cfji4 ,su* requirem5ts may     
include develop+ or requir+ c]tification
 programs = individuals employ$ by !    
indep5d5t assessm5t organizations :o    
lead ,fed,r,a,m,p assessm5t teams4  7b7 
,assessm5t ,accr$it$ indep5d5t assessm5t
 organizations may assess1 validate1 &  
atte/ to ! quality & compliance (       

security assessm5t mat]ials provid$ by  
cl\d s]vice provid]s4  #cfaa4 ,roles &  
responsibilities ( ag5cies  7a7 ,9 g5]al
 ,9 implem5t+ ! requirem5ts (           
,fed,r,a,m,p1 ! head ( ea* ag5cy %all1  
consi/5t ) guidance issu$ by ! ,director
 pursuant to section #cfab--  7#a7      
create policies to ensure cl\d comput+  
s]vices us$ by ! ag5cy meet ,fed,r,a,m,p
 security requirem5ts & o!r risk-bas$   
p]=mance requirem5ts z def9$ by !       
,director2  7#b7 issue ag5cy-specific   
au?orizations to op]ate = cl\d comput+  
s]vices 9 compliance ) section #ceed2   
7#c7 confirm :e!r !re is a provisional  
au?orization to op]ate 9 ! cl\d security
 repository e/abli%$ "u section         
#cfjh7;b77#aj7 issu$ by ! ,jo9t         
,au?orization ,bo>d or a ,fed,r,a,m,p   
au?orization issu$ by ! ,fed,r,a,m,p    
,program ,managem5t ,(fice be=e beg9n+  
an ag5cy au?orization = a cl\d comput+  
product or s]vice2  7#d7 to ! ext5t     
practicable1 = any cl\d comput+ product 
or s]vice ! ag5cy seeks to au?orize t   

has receiv$ ei!r a provisional          
au?orization to op]ate by ! ,jo9t       
,au?orization ,bo>d or a ,fed,r,a,m,p   
au?orization by ! ,fed,r,a,m,p ,program 
,managem5t ,(fice1 use ! exi/+          
assessm5ts ( security controls &        
mat]ials )9 ! au?orization package2 &   
7#e7 provide data & in=mation requir$ to
 ! ,director pursuant to section #cfab  
to det]m9e h[ ag5cies are meet+ metrics 
z def9$ by ! ,fed,r,a,m,p ,program      
,managem5t ,(fice4  7b7 ,submission (   
policies requir$ ,n lat] ?an #f mon?s   
aft] ! date ( ! enactm5t ( ?is section1 
! head ( ea* ag5cy %all submit to !     
,director ! policies creat$ pursuant to 
subsection 7a77#a7 = review & approval4 
7c7 ,submission ( au?orizations ,to     
op]ate requir$ ,^u issuance ( an        
au?orization to op]ate or a provisional 
au?orization to op]ate issu$ by an      
ag5cy1 ! head ( ea* ag5cy %all provide a
 copy ( ! au?orization to op]ate lett] &
 any supplem5t>y in=mation requir$      
pursuant to section #cfjh7;b7 to !      

,fed,r,a,m,p ,program ,managem5t ,(fice4
  7d7 ,presumption ( adequacy  7#a7 ,9  
g5]al ,! assessm5t ( security controls &
 mat]ials )9 ! au?orization package =   
provisional au?orizations to op]ate     
issu$ by ! ,jo9t ,au?orization ,bo>d &  
ag5cy au?orizations to op]ate t receive 
,fed,r,a,m,p au?orization f !           
,fed,r,a,m,p ,program ,managem5t ,(fice 
%all be presum$ adequate = use 9 ag5cy  
au?orizations ( cl\d comput+ products & 
s]vices4  7#b7 ,in=mation security      
requirem5ts ,! presumption "u p>agraph  
7#a7 does n modify or alt] !            
responsibility ( any ag5cy to ensure    
compliance ) sub*apt] ,,ii ( *apt] #ce =
 any cl\d comput+ products or s]vices   
us$ by ! ag5cy4  #cfab4 ,roles &        
responsibilities ( ! ,(fice ( ,managem5t
 & ,budget ,! ,director %all h ! foll[+ 
duties3  7#a7 ,issue guidance to ensure 
t an ag5cy does n op]ate a ,f$]al       
,gov]nm5t cl\d comput+ s]vice us+       
,gov]nm5t data )\t an au?orization to   
op]ate issu$ by ! ag5cy t meets !       

requirem5ts ( sub*apt] ,,ii ( *apt] #ce 
& ,fed,r,a,m,p4  7#b7 ,ensure ag5cies   
are 9 compliance ) any guidance or o!r  
requirem5ts issu$ relat$ to             
,fed,r,a,m,p4  7#c7 ,review1 analyze1 & 
update guidance on ! adoption1 security1
 & use ( cl\d comput+ s]vices us$ by    
ag5cies4  7#d7 ,ensure ! ,jo9t          
,au?orization ,bo>d is 9 compliance )   
section #cfji7;c74  7#e7 ,adjudicate    
disagreem5ts betwe5 ! ,jo9t             
,au?orization ,bo>d & cl\d s]vice       
provid]s seek+ a provisional            
au?orization to op]ate ?r\gh ! ,jo9t    
,au?orization ,bo>d4  7#f7 ,promulgate  
regulations on ! role ( ,fed,r,a,m,p    
au?orization 9 ag5cy acquisition ( cl\d 
comput+ products & s]vices t process    
unclassifi$ in=mation4  #cfac4          
,au?orization ( appropriations =        
,,f$ramp ,!re is au?oriz$ to be         
appropriat$ #bj1jjj1jjj ea* ye> = !     
,fed,r,a,m,p ,program ,managem5t ,(fice 
& ! ,jo9t ,au?orization ,bo>d4  #cfad4  
,reports to ,congress ,n lat] ?an #ab   

mon?s aft] ! date ( ! enactm5t ( ?is    
section1 & annually !reaft]1 ! ,director
 %all submit to ! ,committee on         
,ov]sight & ,re=m ( ! ,h\se (           
,repres5tatives & ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate a report t includes !       
foll[+3  7#a7 ,! /atus1 effici5cy1 &    
effectiv5ess ( ,fed,r,a,m,p ,program    
,managem5t ,(fice & ag5cies dur+ !      
prec$+ ye> 9 support+ ! spe$1           
effectiv5ess1 %>+1 reuse1 & security (  
au?orizations to op]ate = cl\d comput+  
products & s]vices1 includ+ progress    
t[>ds meet+ ! metrics adopt$ by !       
,fed,r,a,m,p ,program ,managem5t ,(fice 
pursuant to section #cfjh7;d7 & ! ,jo9t 
,au?orization ,bo>d pursuant to section 
#cfji7;c77#e74  7#b7 ,data on ag5cy use 
( provisional au?orizations to op]ate   
issu$ by ! ,jo9t ,au?orization ,bo>d &  
ag5cy sponsor$ au?orizations t receive  
,fed,r,a,m,p au?orization by !          
,fed,r,a,m,p ,program ,managem5t ,(fice4
  7#c7 ,! l5g? ( "t = ! ,jo9t           

,au?orization ,bo>d to review           
applications = & issue provisional      
au?orizations to op]ate4  7#d7 ,! l5g? (
 "t = ! ,fed,r,a,m,p ,program ,managem5t
 ,(fice to review ag5cy applications = &
 issue ,fed,r,a,m,p au?orization4  7#e7 
,! numb] ( provisional au?orizations to 
op]ate issu$ by ! ,jo9t ,au?orization   
,bo>d & ,fed,r,a,m,p au?orizations issu$
 by ! ,fed,r,a,m,p ,program ,managem5t  
,(fice = ! previ\s ye>4  7#f7 ,a review 
( progress made dur+ ! prec$+ ye> 9     
advanc+ automation te*niques to securely
 automate ,fed,r,a,m,p processes & to   
accel]ate report+ z describ$ 9 ?is      
section4  7#g7 ,! numb] & *>act]i/ics ( 
au?oriz$ cl\d comput+ s]vices 9 use at  
ea* ag5cy consi/5t ) guidance provid$ by
 ! ,director 9 section #cfab4  #cfae4   
,f$]al ,secure ,cl\d ,advisory          
,committee  7a7 ,e/abli%m5t1 purposes1 &
 duties  7#a7 ,e/abli%m5t ,!re is       
e/abli%$ a ,f$]al ,secure ,cl\d         
,advisory ,committee 7ref]r$ to 9 ?is   
section z ! ,committee7 to ensure       

effective & ongo+ coord9ation ( ag5cy   
adoption1 use1 au?orization1 monitor+1  
acquisition1 & security ( cl\d comput+  
products & s]vices to enable ag5cy      
mission & adm9i/rative priorities4  7#b7
 ,purposes ,! purposes ( ! ,committee   
are ! foll[+3 7,a7 ,to exam9e !         
op]ations ( ,fed,r,a,m,p & det]m9e ways 
t au?orization processes c cont9u\sly be
 improv$1 includ+ ! foll[+3  7i7        
,measures to increase ag5cy re-use (    
provisional au?orizations to op]ate     
issu$ by ! ,jo9t ,au?orization ,bo>d4   
7ii7 ,propos$ actions t c be adopt$ to  
r$uce ! co/ ( provisional au?orizations 
to op]ate & ,fed,r,a,m,p au?orizations =
 cl\d s]vice provid]s4  7iii7 ,measures 
to increase ! numb] ( provisional       
au?orizations to op]ate or ,fed,r,a,m,p 
au?orizations = cl\d comput+ s]vices    
(f]$ by small bus9esses 7z def9$ by     
section #c7;a7 ( ! ,small ,bus9ess ,act 
7#ae ,u4,s4,c4 #fcb7;a774  7,b7 ,collect
 in=mation & fe$back on ag5cy compliance
 ) & implem5tation ( ,fed,r,a,m,p       

requirem5ts4  7,c7 ,s]ve z a =um t      
facilitates communication &             
collaboration among ! ,fed,r,a,m,p      
/akehold] community4  7#c7 ,duties ,!   
duties ( ! ,committee are1 at a m9imum1 
! foll[+3  7,a7 ,provide advice &       
recomm5dations to ! ,adm9i/rator1 !     
,jo9t ,au?orization ,bo>d1 & to ag5cies 
on te*nical1 f9ancial1 programmatic1 &  
op]ational matt]s reg>d+ secure adoption
 ( cl\d comput+ s]vices4  7,b7 ,submit  
reports z requir$4  7b7 ,memb]s  7#a7   
,composition ,! ,committee %all be      
compris$ ( n m ?an #ae memb]s :o are    
qualifi$ repres5tatives f ! public &    
private sectors1 appo9t$ by !           
,adm9i/rator1 9 consultation ) !        
,adm9i/rator ( ! ,(fice ( ,electronic   
,gov]nm5t1 z foll[s3 7,a7 ,!            
,adm9i/rator or ! ,adm9i/rator's        
designee1 :o %all be ! ,*air ( !        
,committee4  7,b7 ,at lea/ "o           
repres5tative ea* f ! ,cyb]security &   
,infra/ructure ,security ,ag5cy & !     
,national ,in/itute ( ,/&>ds &          

,te*nology4  7,c7 ,at lea/ two (ficials 
:o s]ve z ! ,*ief ,in=mation ,security  
,(fic] )9 an ag5cy1 :o %all be requir$  
to ma9ta9 su* a position ?r\gh\t !      
duration ( _! s]vice on ! ,committee4   
7,d7 ,at lea/ "o (ficial s]v+ z ,*ief   
,procurem5t ,(fic] 7or equival5t7 9 an  
ag5cy1 :o %all be requir$ to ma9ta9 su* 
a position ?r\gh\t ! duration ( _!      
s]vice on ! ,committee4  7,e7 ,at lea/  
"o individual repres5t+ an indep5d5t    
assessm5t organization4  7,f7 ,no few]  
?an five repres5tatives f unique        
bus9esses t prim>ily provide cl\d       
comput+ s]vices or products1 includ+ at 
lea/ two repres5tatives f a small       
bus9ess 7z def9$ by section #c7;a7 ( !  
,small ,bus9ess ,act 7#ae ,u4,s4,c4     
#fcb7;a7774  7,g7 ,at lea/ two o!r      
gov]nm5t repres5tatives z ! ,adm9i/rator
 det]m9es to be necess>y to provide     
suffici5t balance1 insights1 or exp]tise
 to ! ,committee4  7#b7 ,deadl9e =      
appo9tm5t ,ea* memb] ( ! ,committee %all
 be appo9t$ n lat] ?an #cj days aft] !  

date ( ! enactm5t ( ?is ,act4  7#c7     
,p]iod ( appo9tm5t2 vacancies  7,a7 ,9  
g5]al ,ea* non-,f$]al memb] ( !         
,committee %all be appo9t$ = a t]m ( #c 
ye>s1 except t ! initial t]ms = memb]s  
may be /agg]$ #a1 #b1 or #c ye> t]ms to 
e/abli% a rotation 9 :i* "o-?ird ( !    
memb]s are select$ ea* ye>4 ,any su*    
memb] may be appo9t$ = n m ?an #b       
consecutive t]ms4  7,b7 ,vacancies ,any 
vacancy 9 ! ,committee %all n affect its
 p[]s1 b %all be fill$ 9 ! same mann] 9 
:i* ! orig9al appo9tm5t 0 made4 ,any    
memb] appo9t$ to fill a vacancy occurr+ 
be=e ! expiration ( ! t]m = :i* !       
memb]'s pr$ecessor 0 appo9t$ %all be    
appo9t$ only = ! rema9d] ( t t]m4 ,a    
memb] may s]ve aft] ! expiration ( t    
memb]'s t]m until a successor has tak5  
(fice4  7c7 ,meet+s & rules ( proc$ures 
7#a7 ,meet+s ,! ,committee %all hold n  
few] ?an ?ree meet+s 9 a cal5d> ye>1 at 
su* "t & place z det]m9$ by ! ,*air4    
7#b7 ,initial meet+ ,n lat] ?an #abj    
days aft] ! date ( ! enactm5t ( ?is     

section1 ! ,committee %all meet & beg9 !
 op]ations ( ! ,committee4  7#c7 ,rules 
( proc$ure ,! ,committee may e/abli%    
rules = ! conduct ( ! bus9ess ( !       
,committee1 if su* rules are n          
inconsi/5t ) ?is section or o!r         
applicable law4  7d7 ,employee /atus    
7#a7 ,9 g5]al ,a memb] ( ! ,committee   
7o!r ?an a memb] :o is appo9t$ to !     
,committee 9 connection ) ano!r ,f$]al  
appo9tm5t7 %all n be consid]$ an        
employee ( ! ,f$]al ,gov]nm5t by reason 
( any s]vice z su* a memb]1 except = !  
purposes ( section #egjc ( title #e1    
relat+ to travel exp5ses4  7#b7 ,pay n  
p]mitt$ ,a memb] ( ! ,committee cov]$ by
 p>agraph 7#a7 may n receive pay by     
reason ( s]vice on ! panel4  7e7        
,applicability to ! ,f$]al ,advisory    
,committee ,act ,not)/&+ any o!r        
provision ( law1 ! ,f$]al ,advisory     
,committee ,act 7#e ,u4,s4,c4 ,app47    
%all apply to ! ,committee1 except t    
section #ad ( su* ,act %all n apply4    
7f7 ,he>+s & evid5ce ,! ,committee1 or  

on ! au?ority ( ! ,committee1 any       
subcommittee1 may1 = ! purposes ( c>ry+ 
out ?is section1 hold he>+s1 sit & act  
at su* times & places1 take te/imony1   
receive evid5ce1 & adm9i/] oa?s4  7g7   
,contract+ ,! ,committee1 may1 to su*   
ext5t & 9 su* am\nts z are provid$ 9    
appropriation ,acts1 ent] into contracts
 to enable ! ,committee to dis*>ge its  
duties "u ?is section4  7h7 ,in=mation f
 f$]al ag5cies  7#a7 ,9 g5]al ,!        
,committee is au?oriz$ to secure        
directly f any executive dep>tm5t1      
bureau1 ag5cy1 bo>d1 commission1 (fice1 
indep5d5t e/abli%m5t1 or in/rum5tality (
 ! ,gov]nm5t1 in=mation1 sugge/ions1    
e/imates1 & /ati/ics = ! purposes ( !   
,committee4 ,ea* dep>tm5t1 bureau1      
ag5cy1 bo>d1 commission1 (fice1         
indep5d5t e/abli%m5t1 or in/rum5tality  
%all1 to ! ext5t au?oriz$ by law1 furni%
 su* in=mation1 sugge/ions1 e/imates1 & 
/ati/ics directly to ! ,committee1 ^u   
reque/ made by ! ,*air1 ! ,*air ( any   
subcommittee creat$ by a majority ( !   

,committee1 or any memb] designat$ by a 
majority ( ! ,committee4  7#b7 ,receipt1
 h&l+1 /orage1 & dissem9ation ,in=mation
 may only be receiv$1 h&l$1 /or$1 &     
dissem9at$ by memb]s ( ! ,committee &   
its /aff consi/5t ) all applicable      
/atutes1 regulations1 & ,executive      
ord]s4  7i7 ,detail ( employees ,any    
,f$]al ,gov]nm5t employee may be detail$
 to ! ,committee )\t reimbursem5t f !   
,committee1 & su* detailee %all reta9 ! 
rights1 /atus1 & privileges ( 8 or h]   
regul> employm5t )\t int]ruption4  7j7  
,po/al s]vices ,! ,committee may use !  
,unit$ ,/ates mails 9 ! same mann] & "u 
! same conditions z ag5cies4  7k7 ,exp]t
 & consultant s]vices ,! ,committee is  
au?oriz$ to procure ! s]vices ( exp]ts &
 consultants 9 accordance ) section     
#caji ( title #e1 b at rates n to exce$ 
! daily rate paid a p]son occupy+ a     
position at ,level ,,iv ( ! ,executive  
,s*$ule "u section #ecae ( title #e4    
7l7 ,reports  7#a7 ,int]im reports ,!   
,committee may submit to ! ,adm9i/rator 

& ,congress int]im reports conta9+ su*  
f9d+s1 conclusions1 & recomm5dations z h
 be5 agre$ to by ! ,committee4  7#b7    
,annual reports ,n lat] ?an #ah mon?s   
aft] ! date ( ! enactm5t ( ?is section1 
& annually !reaft]1 ! ,committee %all   
submit to ! ,adm9i/rator & ,congress a  
f9al report conta9+ su* f9d+s1          
conclusions1 & recomm5dations z h be5   
agre$ to by ! ,committee4  #cfaf4       
,def9itions  7a7 ,9 g5]al ,except z     
provid$ "u subsection 7b71 ! def9itions 
"u sections #cejb & #ceeb apply to      
sections #cfjg ?r\gh ?is section4  7b7  
,additional def9itions ,9 sections #cfjg
 ?r\gh ?is section3  7#a7 ,adm9i/rator  
,! t]m ,adm9i/rator means ! ,adm9i/rator
 ( ,g5]al ,s]vices4  7#b7 ,au?orization 
package ,! t]m au?orization package--   
7,a7 means ! ess5tial in=mation us$ to  
det]m9e :e!r to au?orize ! op]ation ( an
 in=mation sy/em or ! use ( a designat$ 
set ( common controls2 &  7,b7 at a     
m9imum1 includes ! in=mation sy/em      
security plan1 privacy plan1 security   

control assessm5t1 privacy control      
assessm5t1 & any relevant plans ( action
 & mile/ones4  7#c7 ,cl\d comput+ ,! t]m
 cl\d comput+ has ! mean+ giv5 t t]m by 
! ,national ,in/itutes ( ,/&>ds &       
,te*nology 9 ,,ni/ ,special ,publication
 #hjj-ade & any am5datory or sup]s$+    
docum5t !reto4  7#d7 ,cl\d s]vice       
provid] ,! t]m cl\d s]vice provid] means
 an entity (f]+ cl\d comput+ s]vices to 
ag5cies4  7#e7 ,director ,! t]m         
,director means ! ,director ( ! ,(fice (
 ,managem5t & ,budget4  7#f7 ,f$ramp ,! 
t]m ,fed,r,a,m,p means ! ,f$]al ,risk & 
,au?orization ,managem5t ,program       
e/abli%$ "u section #cfjg7;a74  7#g7    
,f$ramp au?orization ,! t]m ,fed,r,a,m,p
 au?orization means a cl\d comput+      
product or s]vice t has receiv$ an ag5cy
 au?orization to op]ate & has be5       
approv$ by ! ,fed,r,a,m,p ,program      
,managem5t ,(fice to meet requirem5ts & 
guidel9es e/abli%$ by ! ,fed,r,a,m,p    
,program ,managem5t ,(fice4  7#h7       
,f$ramp program managem5t (fice ,! t]m  

,fed,r,a,m,p ,program ,managem5t ,(fice 
means ! (fice t adm9i/]s ,fed,r,a,m,p   
e/abli%$ "u section #cfjh4  7#i7        
,indep5d5t assessm5t organization ,! t]m
 indep5d5t assessm5t organization means 
a ?ird-p>ty organization accr$it$ by !  
,program ,director ( ! ,fed,r,a,m,p     
,program ,managem5t ,(fice to und]take  
con=mity assessm5ts ( cl\d s]vice       
provid]s4  7#aj7 ,jo9t au?orization bo>d
 ,! t]m ,jo9t ,au?orization ,bo>d means 
! ,jo9t ,au?orization ,bo>d e/abli%$ "u 
section #cfji4  4  7b7 ,te*nical &      
con=m+ am5dm5t ,! table ( sections =    
*apt] #cf ( title #dd1 ,unit$ ,/ates    
,code1 is am5d$ by add+ at ! end !      
foll[+ new items3  #cfjg4 ,f$]al ,risk &
 ,au?orization ,managem5t ,program4     
#cfjh4 ,fed,r,a,m,p ,program ,managem5t 
,(fice4 #cfji4 ,jo9t ,au?orization      
,bo>d4 #cfaj4 ,indep5d5t assessm5t      
organizations4 #cfaa4 ,roles &          
responsibilities ( ag5cies4 #cfab4      
,roles & responsibilities ( ! ,(fice (  
,managem5t & ,budget4 #cfac4            

,au?orization ( appropriations =        
,,f$ramp4 #cfad4 ,reports to ,congress4 
#cfae4 ,f$]al ,secure ,cl\d ,advisory   
,committee4 #cfaf4 ,def9itions4  4  7c7 
,sunset ,?is ,act & any am5dm5t made by 
?is ,act %all be repeal$ on ! date t is 
#aj ye>s aft] ! date ( ! enactm5t ( ?is 
,act4  7d7 ,rule ( con/ruction ,no?+ 9  
?is ,act or any am5dm5t made by ?is ,act
 %all be con/ru$ z alt]+ or impair+ !   
au?orities ( ! ,director ( ! ,(fice (   
,managem5t & ,budget or ! ,secret>y (   
,homel& ,security "u sub*apt] ,,ii (    
*apt] #ce ( title #dd1 ,unit$ ,/ates    
,code4  ,pass$ ! ,h\se ( ,repres5tatives
 ,febru>y #e1 #bjbj4;,cl]k4