,i #aafth ,,congress #ast ,session ,h4 ,r4 #cida ,,in ,,the ,,house ,,of ,,representatives ,july #bd1 #bjai,mr4 ,connolly 7for himself and ,mr4 ,meadows7 introduced the following bill2 which was referred to the ,committee on ,oversight and ,reform ,a ,,bill ,to enhance the innovation1 security1 and availability of cloud computing services used in the ,federal ,government by establishing the ,federal ,risk and ,authorization ,management ,program within the ,general ,services ,administration and by establishing a risk management1 authorization1 and continuous monitoring process to enable the ,federal ,government to leverage cloud computing services using a risk-based approach consistent with the ,federal ,information ,security ,modernization ,act of #bjad and cloud-based operations1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,risk and ,authorization ,management ,program ,authorization ,act of #bjai or the ,fed,r,a,m,p ,authorization ,act4 #b4 ,codification of the ,fed,r,a,m,p program 7a7 ,amendment ,chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding at the end the following new sections3 #cfjg4 ,federal ,risk and ,authorization ,management ,program 7a7 ,establishment ,there is established within the ,general ,services ,administration the ,federal ,risk and ,authorization ,management ,program4 ,the ,administrator of ,general ,services1 in accordance with the guidelines established pursuant to section #cfab1 shall establish a governmentwide program that provides the authoritative standardized approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies4 7b7 ,components of ,fed,r,a,m,p ,there are established as components of ,fed,r,a,m,p the ,joint ,authorization ,board and the ,program ,management ,office1 or such successor offices as the ,administrator may determine4 #cfjh4 ,fed,r,a,m,p ,program ,management ,office 7a7 ,,gsa ,duties 7#a7 ,roles and responsibilities ,the ,administrator of ,general ,services shall-- 7,a7 determine the categories and characteristics of information technology goods or services that are within the jurisdiction of ,fed,r,a,m,p and that require ,fed,r,a,m,p authorization from the ,joint ,authorization ,board or the ,fed,r,a,m,p ,program ,management ,office1 including the role of cloud brokers and cloud service integrators2 7,b7 develop1 coordinate1 and implement a process for the ,fed,r,a,m,p ,program ,management ,office and the ,joint ,authorization ,board to conduct security assessments of cloud computing services1 review authorizations and assessments submitted by agencies pursuant to subsections 7b7 and 7c7 of section #cfaa1 and appropriate oversight of continuous monitoring of cloud computing services2 7,c7 oversee the administration of the ,federal ,secure ,cloud ,advisory ,committee1 established pursuant to section #cfae2 and 7,d7 ensure the continuous improvement of ,fed,r,a,m,p4 7#b7 ,implementation ,the ,administrator shall oversee the implementation of ,fed,r,a,m,p1 including-- 7,a7 appointing a ,program ,director to oversee the ,fed,r,a,m,p ,program ,management ,office2 7,b7 hiring professional staff as may be necessary for the effective operation of the ,fed,r,a,m,p ,program ,management ,office1 and such other activities as are essential to properly perform critical functions2 7,c7 entering into interagency agreements to detail personnel on a reimbursable or non-reimbursable basis to assist the ,fed,r,a,m,p ,program ,management ,office and the ,joint ,authorization ,board in discharging the responsibilities of the ,office under this section2 7,d7 adjudicating disagreements between the ,joint ,authorization ,board and cloud service providers seeking a provisional authorization to operate through the ,joint ,authorization ,board2 and 7,e7 such other actions as the ,administrator may determine necessary to carry out this section4 7b7 ,duties ,the ,fed,r,a,m,p ,program ,management ,office shall have the following duties3 7#a7 ,establish requirements and guidelines for security assessments of cloud computing services1 consistent with standards defined by the ,national ,institute of ,standards and ,technology1 to be used by the ,joint ,authorization ,board and agencies4 7#b7 ,provide guidance to independent assessment organizations and oversee the execution of independent assessments in using and applying the requirements and guidelines adopted in paragraph 7#a74 7#c7 ,oversee and issue guidelines regarding the qualifications1 roles1 and responsibilities of independent assessment organizations4 7#d7 ,develop templates and other materials to support the ,joint ,authorization ,board and agencies in the authorization of cloud computing services to increase the speed1 effectiveness1 and transparency of the authorization process1 consistent with standards defined by the ,national ,institute of ,standards and ,technology4 7#e7 ,establish and maintain a public comment process for proposed guidance before the issuance of such guidance by ,fed,r,a,m,p4 7#f7 ,issue ,fed,r,a,m,p authorization for any authorizations to operate issued by an agency that meets the requirements and guidelines described in paragraph 7#a74 7#g7 ,establish frameworks for agencies to use authorization packages processed by the ,fed,r,a,m,p ,program ,management ,office and ,joint ,authorization ,board4 7#h7 ,coordinate with the ,department of ,homeland ,security to establish a framework for continuous monitoring and reporting required of agencies pursuant to section #ceed4 7#i7 ,issue examples of security architectures to agencies and cloud computing services to better standardize and replicate secure configurations within a single cloud service and among cloud services4 7#aj7 ,establish a centralized and secure repository to collect and share necessary data1 including security authorization packages1 from the ,joint ,authorization ,board and agencies to enable better sharing and reuse to such packages across agencies4 7c7 ,evaluation of automation procedures 7#a7 ,in general ,the ,fed,r,a,m,p ,program ,management ,office shall assess and evaluate available automation capabilities and procedures to improve the efficiency and effectiveness of the issuance of provisional authorizations to operate issued by the ,joint ,authorization ,board and ,fed,r,a,m,p authorizations1 including better control inheritance and continuous monitoring of cloud environments and among cloud environments4 7#b7 ,means for automation ,not later than #a year after the date of the enactment of this section and updated annually thereafter1 the ,fed,r,a,m,p ,program ,management ,office shall establish a means for the automation of security assessments and reviews4 7d7 ,metrics for authorization ,the ,fed,r,a,m,p ,program ,management ,office shall establish annual metrics regarding the time and quality of the assessments necessary for completion of a ,fed,r,a,m,p authorization process in a manner that can be consistently tracked over time in conjunction with the periodic testing and evaluation process pursuant to section #ceec in a manner that minimizes the agency reporting burden4 #cfji4 ,joint ,authorization ,board 7a7 ,establishment ,there is established the ,joint ,authorization ,board which shall consist of #c security experts1 appointed by the ,director in consultation with the ,administrator1 from each of the following3 7#a7 ,the ,department of ,defense4 7#b7 ,the ,department of ,homeland ,security4 7#c7 ,the ,general ,services ,administration4 7b7 ,issuance of provisional authorizations ,to operate ,the ,joint ,authorization ,board shall conduct security assessments of cloud computing services and issue provisional authorizations to operate to cloud service providers that meet ,fed,r,a,m,p security guidelines set forth in section #cfjh7;b77#a74 7c7 ,duties ,the ,joint ,authorization ,board shall-- 7#a7 develop and make publicly available on a website1 determined by the ,administrator1 criteria for prioritizing and selecting cloud computing services to be assessed by the ,joint ,authorization ,board and to provide regular updates on the status of any cloud computing service during the assessment and authorization process of the ,joint ,authorization ,board2 7#b7 review and validate cloud computing services and independent assessment organization authorization packages2 7#c7 in consultation with the ,fed,r,a,m,p ,program ,management ,office1 serve as a resource for best practices to accelerate the ,fed,r,a,m,p process2 7#d7 perform such other roles and responsibilities as the ,administrator may assign1 in consultation with the ,fed,r,a,m,p ,program ,management ,office and members of the ,joint ,authorization ,board2 and 7#e7 establish metrics and goals for reviews and activities associated with issuing provisional authorizations to operate4 7d7 ,determinations of demand for cloud computing services ,the ,joint ,authorization ,board shall consult with the head of each agency to establish a process for prioritizing and accepting the cloud computing services to be granted a provisional authorization to operate through the ,joint ,authorization ,board1 which shall be made available on a public website4 7e7 ,detail of personnel ,to assist the ,joint ,authorization ,board in discharging the responsibilities under this section1 personnel of agencies may be detailed to the ,joint ,authorization ,board for the performance of duties described under subsection 7c74 #cfaj4 ,independent assessment organizations 7a7 ,requirements for accreditation ,the ,administrator1 in consultation with the ,joint ,authorization ,board1 shall determine the requirements for certification of independent assessment organizations4 ,such requirements may include developing or requiring certification programs for individuals employed by the independent assessment organizations who lead ,fed,r,a,m,p assessment teams4 7b7 ,assessment ,accredited independent assessment organizations may assess1 validate1 and attest to the quality and compliance of security assessment materials provided by cloud service providers4 #cfaa4 ,roles and responsibilities of agencies 7a7 ,in general ,in implementing the requirements of ,fed,r,a,m,p1 the head of each agency shall1 consistent with guidance issued by the ,director pursuant to section #cfab-- 7#a7 create policies to ensure cloud computing services used by the agency meet ,fed,r,a,m,p security requirements and other risk-based performance requirements as defined by the ,director2 7#b7 issue agency-specific authorizations to operate for cloud computing services in compliance with section #ceec2 7#c7 confirm whether there is a provisional authorization to operate in the cloud security repository established under section #cfjh7;b77#aj7 issued by the ,joint ,authorization ,board or a ,fed,r,a,m,p authorization issued by the ,fed,r,a,m,p ,program ,management ,office before beginning an agency authorization for a cloud computing product or service2 7#d7 to the extent practicable1 for any cloud computing product or service the agency seeks to authorize that has received either a provisional authorization to operate by the ,joint ,authorization ,board or a ,fed,r,a,m,p authorization by the ,fed,r,a,m,p ,program ,management ,office1 use the existing assessments of security controls and materials within the authorization package2 and 7#e7 provide data and information required to the ,director pursuant to section #cfab to determine how agencies are meeting metrics as defined by the ,fed,r,a,m,p ,program ,management ,office4 7b7 ,submission of policies required ,not later than #f months after the date of the enactment of this section1 the head of each agency shall submit to the ,director the policies created pursuant to subsection 7a77#a7 for review and approval4 7c7 ,submission of authorizations ,to operate required ,upon issuance of an authorization to operate1 the head of each agency shall provide a copy of the authorization to operate letter and any supplementary information required pursuant to section #cfjh7;b7 to the ,fed,r,a,m,p ,program ,management ,office4 7d7 ,presumption of adequacy 7#a7 ,in general ,the assessment of security controls and materials within the authorization package for provisional authorizations to operate issued by the ,joint ,authorization ,board and agency authorizations to operate that receive ,fed,r,a,m,p authorization from the ,program ,management ,office shall be presumed adequate for use in agency authorizations of cloud computing products and services4 7#b7 ,information security requirements ,the presumption under paragraph 7#a7 does not modify or alter the responsibility of any agency to ensure compliance with subchapter ,,ii of chapter #ce for any cloud computing products or services used by the agency4 #cfab4 ,roles and responsibilities of the ,office of ,management and ,budget ,the ,director shall have the following duties3 7#a7 ,issue guidance to ensure that an agency does not operate a ,federal ,government cloud computing service using ,government data without issuing an authorization to operate issued by the agency that meets the requirements of subchapter ,,ii of chapter #ce and ,fed,r,a,m,p4 7#b7 ,ensure agencies are in compliance with any guidance or other requirements issued related to ,fed,r,a,m,p4 7#c7 ,review1 analyze1 and update guidance on the adoption1 security1 and use of cloud computing services used by agencies4 7#d7 ,ensure the ,joint ,authorization ,board is in compliance with section #cfji7;c74 7#e7 ,promulgate regulations on the role of ,fed,r,a,m,p authorization in agency acquisition of cloud computing products and services that process unclassified information4 #cfac4 ,authorization of appropriations for ,fed,r,a,m,p ,there is authorized to be appropriated #be1jjj1jjj each year for the ,fed,r,a,m,p ,program ,management ,office and the ,joint ,authorization ,board4 #cfad4 ,reports to ,congress ,not later than #ab months after the date of the enactment of this section1 and annually thereafter1 the ,director shall submit to the ,committee on ,oversight and ,reform of the ,house of ,representatives and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a report that includes the following3 7#a7 ,the status1 efficiency1 and effectiveness of ,fed,r,a,m,p and agencies during the preceding year in supporting the speed1 effectiveness1 sharing1 reuse1 and security of authorizations to operate for cloud computing products and services1 including progress towards meeting the metrics adopted by the ,fed,r,a,m,p ,program ,management ,office pursuant to section #cfjh7;d7 and the ,joint ,authorization ,board pursuant to section #cfji7;c77#e74 7#b7 ,data on agency use of provisional authorizations to operate issued by the ,joint ,authorization ,board and agency sponsored authorizations that receive ,fed,r,a,m,p authorization by the ,fed,r,a,m,p ,program ,management ,office4 7#c7 ,the length of time for the ,joint ,authorization ,board to review applications for and issue provisional authorizations to operate4 7#d7 ,the length of time for the ,fed,r,a,m,p ,program ,management ,office to review agency applications for and issue ,fed,r,a,m,p authorization4 7#e7 ,the number of provisional authorizations to operate issued by each the ,joint ,authorization ,board and ,fed,r,a,m,p authorizations issued by the ,fed,r,a,m,p ,program ,management ,office for the previous year4 7#f7 ,a review of progress made during the preceding year in advancing automation techniques to securely automate ,fed,r,a,m,p processes and to accelerate reporting as described in this section4 7#g7 ,the number and characteristics of authorized cloud computing services in use at each agency consistent with guidance provided by the ,director in section #cfab4 #cfae4 ,federal ,secure ,cloud ,advisory ,committee 7a7 ,establishment1 purposes1 and duties 7#a7 ,establishment ,the ,administrator shall establish within the ,general ,services ,administration the ,federal ,secure ,cloud ,advisory 7referred to in this section as the ,committee7 to ensure effective and ongoing coordination of agency adoption1 use1 authorization1 monitoring1 acquisition1 and security of cloud computing products and services to enable agency mission and administrative priorities4 7#b7 ,purposes ,the purposes of the ,committee are to3 7,a7 ,examine the operations of ,fed,r,a,m,p and determine ways that authorization processes can continuously be improved4 7,b7 ,collect information and feedback on agency compliance with and implementation of ,fed,r,a,m,p requirements4 7,c7 ,serve as a forum that facilitates communication and collaboration among the ,fed,r,a,m,p stakeholder community4 7#c7 ,duties ,the duties of the ,committee are1 at a minimum1 the following3 7,a7 ,provide advice and recommendations to the ,administrator1 the ,joint ,authorization ,board1 and to agencies on technical1 financial1 programmatic1 and operational matters regarding secure adoption of cloud computing services4 7,b7 ,submit reports as required4 7b7 ,members 7#a7 ,composition ,the ,committee shall be comprised of not more than #ae members who are qualified representatives from the public and private sectors1 appointed by the ,administrator1 in consultation with the ,administrator of the ,office of ,electronic ,government1 as follows3 7,a7 ,the ,administrator or the ,administrator's designee1 who shall be the ,chair of the ,committee4 7,b7 ,at least #a representative each from the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,institute of ,standards and ,technology4 7,c7 ,at least #b officials who serve as the ,chief ,information ,security ,officer within an agency1 who shall be required to maintain such a position throughout the duration of their service on the ,committee4 7,d7 ,at least #a official serving as ,chief ,procurement ,officer 7or equivalent7 in an agency1 who shall be required to maintain such a position throughout the duration of their service on the ,committee4 7,e7 ,no fewer than #e representatives from businesses that primarily provide cloud computing services or products1 including at least #b representatives from a small business 7as defined by section #c7;a7 of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb7;a7774 7,f7 ,any other representatives as the ,administrator determines to be necessary to provide sufficient balance1 insights1 or expertise to the ,committee4 7#b7 ,deadline for appointment ,each member of the ,committee shall be appointed not later than #cj days after the date of the enactment of this ,act4 7#c7 ,period of appointment2 vacancies 7,a7 ,in general ,each member of the ,committee shall be appointed for a term of #c years1 except that the initial terms for members may be staggered #a1 #b1 or #c year terms to establish a rotation in which one-third of the members are selected each year4 ,any such member may be appointed for not more than #b consecutive terms4 7,b7 ,vacancies ,any vacancy in the ,committee shall not affect its powers1 but shall be filled in the same manner in which the original appointment was made4 ,any member appointed to fill a vacancy occurring before the expiration of the term for which the member's predecessor was appointed shall be appointed only for the remainder of that term4 ,a member may serve after the expiration of that member's term until a successor has taken office4 7c7 ,meetings and rules of procedures 7#a7 ,meetings ,the ,committee shall hold not less than #c meetings in a calendar year1 at such time and place as determined by the ,chair4 7#b7 ,initial meeting ,not later than #abj days after the date of the enactment of this section1 the ,committee shall meet and begin the operations of the ,committee4 7#c7 ,rules of procedure ,the ,committee may establish rules for the conduct of the business of the ,committee1 if such rules are not inconsistent with this section or other applicable law4 7d7 ,travel expenses ,while away from their homes or regular places of business in the performance of services for the ,committee1 members of the ,committee shall be allowed travel expenses1 including per diem in lieu of subsistence1 in the same manner as persons employed intermittently in the ,government service are allowed expenses under section #egjc7;b7 of title #e1 ,united ,states ,code4 7e7 ,applicability to the ,federal ,advisory ,committee ,act ,notwithstanding any other provision of law1 the ,federal ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 shall apply to the ,committee1 except that section #ad of such ,act shall not apply4 7f7 ,hearings and evidence ,the ,committee1 or on the authority of the ,committee1 any subcommittee1 may1 for the purposes of carrying out this section1 hold hearings1 sit and act at such times and places1 take testimony1 receive evidence1 and administer oaths4 7g7 ,contracting ,the ,committee1 may1 to such extent and in such amounts as are provided in appropriation ,acts1 enter into contracts to enable the ,committee to discharge its duties under this section4 7h7 ,information from ,federal agencies 7#a7 ,in general ,the ,committee is authorized to secure directly from any executive department1 bureau1 agency1 board1 commission1 office1 independent establishment1 or instrumentality of the ,government1 information1 suggestions1 estimates1 and statistics for the purposes of the ,committee4 ,each department1 bureau1 agency1 board1 commission1 office1 independent establishment1 or instrumentality shall1 to the extent authorized by law1 furnish such information1 suggestions1 estimates1 and statistics directly to the ,committee1 upon request made by the ,chair1 the ,chair of any subcommittee created by a majority of the ,committee1 or any member designated by a majority of the ,committee4 7#b7 ,receipt1 handling1 storage1 and dissemination ,information may only be received1 handled1 stored1 and disseminated by members of the ,committee and its staff consistent with all applicable statutes1 regulations1 and ,executive orders4 7i7 ,assistance from agencies 7#a7 ,other departments and agencies ,in addition to the administration of the ,committee by the ,general ,services ,administration1 other agencies may provide to the ,committee such services1 funds1 facilities1 staff1 and other support services as the head of the agency determines to be advisable and as is authorized by law4 7#b7 ,detail of employees ,any ,federal ,government employee may be detailed to the ,committee without reimbursement from the ,committee1 and such detailee shall retain the rights1 status1 and privileges of his or her regular employment without interruption4 7j7 ,gifts ,the ,committee may accept1 use1 and dispose of gifts or donations of services or property4 7k7 ,postal services ,the ,committee may use the ,united ,states mails in the same manner and under the same conditions as agencies4 7l7 ,expert and consultant services ,the ,committee is authorized to procure the services of experts and consultants in accordance with section #caji of title #e1 but at rates not to exceed the daily rate paid a person occupying a position at ,level ,,iv of the ,executive ,schedule under section #ecae of title #e4 7m7 ,volunteer services ,notwithstanding section #acdb of title #ca1 the ,committee may accept and use voluntary and uncompensated services as the ,committee determines necessary4 7n7 ,reports 7#a7 ,interim reports ,the ,committee may submit to the ,administrator and ,congress interim reports containing such findings1 conclusions1 and recommendations as have been agreed to by the ,committee4 7#b7 ,annual reports ,not later than #ah months after the date of the enactment of this section1 and annually thereafter1 the ,committee shall submit to the ,administrator and ,congress a final report containing such findings1 conclusions1 and recommendations as have been agreed to by the ,committee4 7o7 ,sunset provision ,the authority and obligations established by this section shall terminate on the date that is five years after the date of the enactment of this section4 #cfaf4 ,definitions 7a7 ,in general ,except as provided under subsection 7b71 the definitions under sections #cejb and #ceeb apply to sections #cfjg through this section4 7b7 ,additional definitions ,in sections #cfjg through this section3 7#a7 ,administrator ,the term ,administrator means the ,administrator of ,general ,services4 7#b7 ,authorization package ,the term authorization package-- 7,a7 means the essential information used to determine whether to authorize the operation of an information system or the use of a designated set of common controls2 and 7,b7 at a minimum1 includes the information system security plan1 privacy plan1 security control assessment1 privacy control assessment1 and any relevant plans of action and milestones4 7#c7 ,cloud broker ,the term cloud broker means an entity that manages the use1 performance1 and delivery of cloud computing services and negotiates relationships between cloud service providers and cloud consumers4 7#d7 ,cloud computing ,the term cloud computing has the meaning given that term by the ,national ,institutes of ,standards and ,technology in ,,nist ,special ,publication #hjj-ade and any amendatory or superseding document thereto4 7#e7 ,cloud service provider ,the term cloud service provider means a non-,federal entity offering cloud computing services to agencies4 7#f7 ,fed,r,a,m,p ,the term ,fed,r,a,m,p means the ,federal ,risk and ,authorization ,management ,program established under section #cfjg7;a74 7#g7 ,fed,r,a,m,p ,authorization ,the term ,fed,r,a,m,p authorization means a cloud computing product or service that has received an agency authorization to operate and has been certified by the ,fed,r,a,m,p ,program ,management ,office to meet requirements and guidelines established by the ,fed,r,a,m,p ,program ,management ,office4 7#h7 ,fed,r,a,m,p ,program ,management ,office ,the term ,fed,r,a,m,p ,program ,management ,office means the office that administers ,fed,r,a,m,p4 7#i7 ,independent assessment organization ,the term independent assessment organization means a third-party organization accredited by the ,program ,director of the ,fed,r,a,m,p ,program ,management ,office to undertake conformity assessments of cloud service providers4 7#aj7 ,joint ,authorization ,board ,the term ,joint ,authorization ,board means the ,joint ,authorization ,board established under section #cfji4 7#aa7 ,security architecture ,the term security architecture means a set of physical and logical security-relevant representations of system architecture that conveys information about how the system is partitioned into security domains and makes use of security-relevant elements to enforce security policies within and between security domains based on how data and information must be protected4 4 7b7 ,technical and conforming amendment ,the table of sections for chapter #cf of title #dd1 ,united ,states ,code1 is amended by adding at the end the following new items3 #cfjg4 ,federal ,risk and ,authorization ,management ,program4 #cfjh4 ,fed,r,a,m,p ,program ,management ,office4 #cfji4 ,joint ,authorization ,board4 #cfaj4 ,independent assessment organizations4 #cfaa4 ,roles and responsibilities of agencies4 #cfab4 ,roles and responsibilities of the ,office of ,management and ,budget4 #cfac4 ,authorization of appropriations for ,fed,r,a,m,p4 #cfad4 ,reports to ,congress4 #cfae4 ,federal ,secure ,cloud ,advisory ,committee4 #cfaf4 ,definitions4 4