#aagth ,,congress  #ast ,session  ,h4   
,r4 #ba  ,,an ,,act  ,to enhance the    
innovation1 security1 and availability  
of cloud computing products and services
 used in the ,federal ,government by    
establishing the ,federal ,risk and     
,authorization ,management ,program     
within the ,general ,services           
,administration and by establishing a   
risk management1 authorization1 and     
continuous monitoring process to enable 
the ,federal ,government to leverage    
cloud computing products and services   
using a risk-based approach consistent  
with the ,federal ,information ,security
 ,modernization ,act of #bjad and       
cloud-based operations1 and for other   
purposes4  #a4 ,short title ,this ,act  
may be cited as the ,federal ,risk and  
,authorization ,management ,program     
,authorization ,act of #bjba or the     
,fed,r,a,m,p ,authorization ,act4  #b4  
,codification of the ,fed,r,a,m,p       
program  7a7 ,amendment ,chapter #cf of 
title #dd1 ,united ,states ,code1 is    

amended by adding at the end the        
following new sections3  #cfjg4 ,federal
 ,risk and ,authorization ,management   
,program  7a7 ,establishment ,there is  
established within the ,general         
,services ,administration the ,federal  
,risk and ,authorization ,management    
,program4 ,the ,administrator of        
,general ,services1 in accordance with  
section #cfab1 shall establish a        
governmentwide program that provides the
 authoritative standardized approach to 
security assessment and authorization   
for cloud computing products and        
services that process unclassified      
information used by agencies4  7b7      
,components of ,fed,r,a,m,p ,the ,joint 
,authorization ,board and the           
,fed,r,a,m,p ,program ,management       
,office are established as components of
 ,fed,r,a,m,p4  #cfjh4 ,fed,r,a,m,p     
,program ,management ,office  7a7 ,,gsa 
duties  7#a7 ,roles and responsibilities
 ,the ,administrator of ,general        
,services shall-- 7,a7 determine the    

categories and characteristics of cloud 
computing products and services that are
 within the jurisdiction of ,fed,r,a,m,p
 and that require a ,fed,r,a,m,p        
authorization or a ,fed,r,a,m,p         
provisional authorization2  7,b7        
develop1 coordinate1 and implement a    
process for the ,fed,r,a,m,p ,program   
,management ,office1 the ,joint         
,authorization ,board1 and agencies to  
review security assessments of cloud    
computing products and services pursuant
 to subsections 7b7 and 7c7 of section  
#cfaa1 and appropriate oversight of     
continuous monitoring of cloud computing
 products and services2 and  7,c7 ensure
 the continuous improvement of          
,fed,r,a,m,p4  7#b7 ,implementation ,the
 ,administrator shall oversee the       
implementation of ,fed,r,a,m,p1         
including-- 7,a7 appointing a ,program  
,director to oversee the ,fed,r,a,m,p   
,program ,management ,office2  7,b7     
hiring professional staff as may be     
necessary for the effective operation of

 the ,fed,r,a,m,p ,program ,management  
,office1 and such other activities as   
are essential to properly perform       
critical functions2  7,c7 entering into 
interagency agreements to detail        
personnel on a reimbursable or          
non-reimbursable basis to assist the    
,fed,r,a,m,p ,program ,management       
,office and the ,joint ,authorization   
,board in discharging the               
responsibilities of the ,office under   
this section2 and  7,d7 such other      
actions as the ,administrator may       
determine necessary to carry out this   
section4  7b7 ,duties ,the ,fed,r,a,m,p 
,program ,management ,office shall have 
the following duties3  7#a7 ,provide    
guidance to independent assessment      
organizations1 validate the independent 
assessments1 and apply the requirements 
and guidelines adopted in section       
#cfji7;c77#e74  7#b7 ,oversee and issue 
guidelines regarding the necessary      
requirements for accreditation of       
third-party organizations seeking to be 

awarded accreditation as independent    
assessment organizations1 including     
qualifications1 roles1 and              
responsibilities of independent         
assessment organizations4  7#c7 ,develop
 templates and other materials to       
support the ,joint ,authorization ,board
 and agencies in the authorization of   
cloud computing products and services to
 increase the speed1 effectiveness1 and 
transparency of the authorization       
process1 consistent with standards      
defined by the ,national ,institute of  
,standards and ,technology4  7#d7       
,establish and maintain a public comment
 process for proposed guidance before   
the issuance of such guidance by        
,fed,r,a,m,p4  7#e7 ,review any         
authorization to operate issued by an   
agency to determine if the authorization
 meets the requirements and guidelines  
adopted in section #cfji7;c77#e74  7#f7 
,establish frameworks for agencies to   
use authorization packages processed by 
the ,fed,r,a,m,p ,program ,management   

,office and ,joint ,authorization       
,board4  7#g7 ,coordinate with the      
,secretary of ,defense and the          
,secretary of ,homeland ,security to    
establish a framework for continuous    
monitoring under section #ceec and      
agency reports required under section   
#ceed4  7#h7 ,establish a centralized   
and secure repository to collect and    
share necessary data1 including security
 authorization packages1 from the ,joint
 ,authorization ,board and agencies to  
enable better sharing and reuse of such 
packages across agencies4  7c7          
,evaluation of automation procedures    
7#a7 ,in general ,the ,fed,r,a,m,p      
,program ,management ,office shall      
assess and evaluate available automation
 capabilities and procedures to improve 
the efficiency and effectiveness of the 
issuance of ,fed,r,a,m,p authorizations 
and ,fed,r,a,m,p provisional            
authorizations1 including continuous    
monitoring of cloud computing products  
and services4  7#b7 ,means for          

automation ,not later than #a year after
 the date of the enactment of this      
section1 and updated annually           
thereafter1 the ,fed,r,a,m,p ,program   
,management ,office shall establish a   
means for the automation of security    
assessments and reviews4  7d7 ,metrics  
for authorization ,the ,fed,r,a,m,p     
,program ,management ,office shall      
establish annual metrics regarding the  
time and quality of the assessments     
necessary for completion of a           
,fed,r,a,m,p authorization process in a 
manner that can be consistently tracked 
over time in conjunction with the       
periodic testing and evaluation process 
pursuant to section #ceed in a manner   
that minimizes the agency reporting     
burden4  #cfji4 ,joint ,authorization   
,board  7a7 ,establishment ,the ,joint  
,authorization ,board shall consist of  
cloud computing experts1 appointed by   
the ,director in consultation with the  
,administrator1 from each of the        
following3  7#a7 ,the ,department of    

,defense4  7#b7 ,the ,department of     
,homeland ,security4  7#c7 ,the ,general
 ,services ,administration4  7#d7 ,such 
other agencies as determined by the     
,director1 in consultation with the     
,administrator4  7b7 ,issuance of       
,fed,r,a,m,p provisional authorizations 
,the ,joint ,authorization ,board shall 
conduct security assessments of cloud   
computing products and services and     
issue ,fed,r,a,m,p provisional          
authorizations to cloud service         
providers that meet the requirements and
 guidelines established in subsection   
7c77#e74  7c7 ,duties ,the ,joint       
,authorization ,board shall--  7#a7     
develop and make publicly available on a
 website1 determined by the             
,administrator1 criteria for            
prioritizing and selecting cloud        
computing products and services to be   
assessed by the ,joint ,authorization   
,board2  7#b7 provide regular updates to
 applicant cloud service providers on   
the status of any cloud computing       

product or service during the assessment
 and authorization process of the ,joint
 ,authorization ,board2  7#c7 review and
 validate cloud computing products and  
services and materials submitted by     
independent assessment organizations or 
any documentation determined to be      
necessary by the ,joint ,authorization  
,board to evaluate the system security  
of a cloud computing product or service2
  7#d7 in consultation with the         
,fed,r,a,m,p ,program ,management       
,office1 serve as a resource for best   
practices to accelerate the process for 
obtaining a ,fed,r,a,m,p authorization  
or ,fed,r,a,m,p provisional             
authorization2  7#e7 establish          
requirements and guidelines for security
 assessments of cloud computing products
 and services1 consistent with standards
 defined by the ,national ,institute of 
,standards and ,technology1 to be used  
by the ,joint ,authorization ,board and 
agencies2  7#f7 perform such other roles
 and responsibilities as the            

,administrator may assign1 in           
consultation with the ,fed,r,a,m,p      
,program ,management ,office and members
 of the ,joint ,authorization ,board2   
and  7#g7 establish metrics and goals   
for reviews and activities associated   
with issuing ,fed,r,a,m,p provisional   
authorizations and provide to the       
,fed,r,a,m,p ,program ,management       
,office4  7d7 ,determinations of demand 
for cloud computing products and        
services ,the ,joint ,authorization     
,board shall consult with the ,chief    
,information ,officers ,council         
established in section #cfjc to         
establish a process1 that shall be made 
available on a public website1 for      
prioritizing and accepting the cloud    
computing products and services to be   
granted a ,fed,r,a,m,p provisional      
authorization4  7e7 ,detail of personnel
 ,to assist the ,joint ,authorization   
,board in discharging the               
responsibilities under this section1    
personnel of agencies may be detailed to

 the ,joint ,authorization ,board for   
the performance of duties described     
under subsection 7c74  #cfaj4           
,independent assessment organizations   
7a7 ,requirements for accreditation ,the
 ,joint ,authorization ,board shall     
determine the requirements for the      
accreditation of a third-party          
organization seeking to be accredited as
 an independent assessment organization1
 ensuring adequate implementation of    
section #cfji4 ,such requirements may   
include developing or requiring         
certification programs for individuals  
employed by the third-party organization
 seeking accreditation4 ,the ,program   
,director of the ,fed,r,a,m,p ,program  
,management ,office shall accredit any  
third-party organization that meets the 
requirements for accreditation4  7b7    
,assessment ,an independent assessment  
organization may assess1 validate1 and  
attest to the quality and compliance of 
security assessment materials provided  
by cloud service providers as part of   

the ,fed,r,a,m,p authorization or the   
,fed,r,a,m,p provisional authorization  
process4  #cfaa4 ,roles and             
responsibilities of agencies  7a7 ,in   
general ,in implementing the            
requirements of ,fed,r,a,m,p1 the head  
of each agency shall1 consistent with   
guidance issued by the ,director        
pursuant to section #cfab--  7#a7 create
 policies to ensure cloud computing     
products and services used by the agency
 meet ,fed,r,a,m,p security requirements
 and other risk-based performance       
requirements as defined by the          
,director2  7#b7 issue agency-specific  
authorizations to operate for cloud     
computing services in compliance with   
section #ceed2  7#c7 confirm whether    
there is a ,fed,r,a,m,p authorization or
 ,fed,r,a,m,p provisional authorization 
in the cloud security repository        
established under section #cfjh7;b77#h7 
before beginning the process to award a 
,fed,r,a,m,p authorization or a         
,fed,r,a,m,p provisional authorization  

for a cloud computing product or        
service2  7#d7 to the extent            
practicable1 for any cloud computing    
product or service the agency seeks to  
authorize that has received a           
,fed,r,a,m,p authorization or           
,fed,r,a,m,p provisional authorization1 
use the existing assessments of security
 controls and materials within the      
authorization package2 and  7#e7 provide
 data and information required to the   
,director pursuant to section #cfab to  
determine how agencies are meeting      
metrics as defined by the ,fed,r,a,m,p  
,program ,management ,office4  7b7      
,submission of policies required ,not   
later than #f months after the date of  
the enactment of this section1 the head 
of each agency shall submit to the      
,director the policies created pursuant 
to subsection 7a77#a7 for review and    
approval4  7c7 ,submission of           
authorizations ,to operate required     
,upon issuance of an agency             
authorization to operate1 the head of   

the agency shall provide a copy of the  
authorization to operate letter and any 
supplementary information required      
pursuant to section #cfjh7;b7 to the    
,fed,r,a,m,p ,program ,management       
,office4  7d7 ,presumption of adequacy  
7#a7 ,in general ,the assessment of     
security controls and materials within  
the authorization package for a         
,fed,r,a,m,p authorization or           
,fed,r,a,m,p provisional authorization  
shall be presumed adequate for use in an
 agency authorization to operate cloud  
computing products and services4  7#b7  
,information security requirements ,the 
presumption under paragraph 7#a7 does   
not modify or alter the responsibility  
of any agency to ensure compliance with 
subchapter ,,ii of chapter #ce for any  
cloud computing products or services    
used by the agency4  #cfab4 ,roles and  
responsibilities of the ,office of      
,management and ,budget ,the ,director  
shall have the following duties3  7#a7  
,issue guidance to ensure that an agency

 does not operate a ,federal ,government
 cloud computing product or service     
using ,government data without an       
authorization to operate issued by the  
agency that meets the requirements of   
subchapter ,,ii of chapter #ce and the  
,fed,r,a,m,p authorization or           
,fed,r,a,m,p provisional authorization4 
7#b7 ,ensure agencies are in compliance 
with any guidance or other requirements 
issued related to ,fed,r,a,m,p4  7#c7   
,review1 analyze1 and update guidance on
 the adoption1 security1 and use of     
cloud computing services used by        
agencies4  7#d7 ,ensure the ,joint      
,authorization ,board is in compliance  
with section #cfji7;c74  7#e7           
,adjudicate disagreements between the   
,joint ,authorization ,board and cloud  
service providers seeking a ,fed,r,a,m,p
 provisional authorization4  7#f7       
,promulgate regulations on the role of  
,fed,r,a,m,p authorizations and         
,fed,r,a,m,p provisional authorizations 
in agency acquisition of cloud computing

 products and services that process     
unclassified information4  #cfac4       
,authorization of appropriations for    
,,fedramp ,there is authorized to be    
appropriated #bj1jjj1jjj each year for  
the ,fed,r,a,m,p ,program ,management   
,office and the ,joint ,authorization   
,board4  #cfad4 ,reports to ,congress2  
,,gao ,report  7a7 ,reports to ,congress
 ,not later than #ab months after the   
date of the enactment of this section1  
and annually thereafter1 the ,director  
shall submit to the ,committee on       
,oversight and ,reform of the ,house of 
,representatives and the ,committee on  
,homeland ,security and ,governmental   
,affairs of the ,senate a report that   
includes the following3  7#a7 ,the      
status1 efficiency1 and effectiveness of
 ,fed,r,a,m,p ,program ,management      
,office and agencies during the         
preceding year in supporting the speed1 
effectiveness1 sharing1 reuse1 and      
security of authorizations to operate   
for cloud computing products and        

services1 including progress towards    
meeting the metrics adopted by the      
,fed,r,a,m,p ,program ,management       
,office pursuant to section #cfjh7;d7   
and the ,joint ,authorization ,board    
pursuant to section #cfji7;c77#e74  7#b7
 ,data on ,fed,r,a,m,p authorizations   
and ,fed,r,a,m,p provisional            
authorizations4  7#c7 ,the average      
length of time for the ,joint           
,authorization ,board to review         
applications for and issue ,fed,r,a,m,p 
provisional authorizations4  7#d7 ,the  
average length of time for the          
,fed,r,a,m,p ,program ,management       
,office to review authorizations to     
operate4  7#e7 ,the number of           
,fed,r,a,m,p authorizations and         
,fed,r,a,m,p provisional authorizations 
issued for the previous year4  7#f7 ,a  
review of progress made during the      
preceding year in advancing automation  
techniques to securely automate         
,fed,r,a,m,p processes and to accelerate
 reporting as described in this section4

  7#g7 ,the number and characteristics  
of authorized cloud computing products  
and services in use at each agency      
consistent with guidance provided by the
 ,director in section #cfab4  7#h7 ,the 
cost incurred by agencies and cloud     
service providers related to the        
issuance of ,fed,r,a,m,p authorizations 
and ,fed,r,a,m,p provisional            
authorizations1 including information   
responsive to the report required in    
subsection 7b74  7b7 ,,gao report ,not  
later than #f months after the date of  
the enactment of this section1 the      
,comptroller ,general of the ,united    
,states shall publish a report that     
includes an assessment of the cost      
incurred by agencies and cloud service  
providers related to the issuance of    
,fed,r,a,m,p authorizations and         
,fed,r,a,m,p provisional authorizations4
  #cfae4 ,federal ,secure ,cloud        
,advisory ,committee  7a7               
,establishment1 purposes1 and duties    
7#a7 ,establishment ,there is           

established a ,federal ,secure ,cloud   
,advisory ,committee 7referred to in    
this section as the ,committee7 to      
ensure effective and ongoing            
coordination of agency adoption1 use1   
authorization1 monitoring1 acquisition1 
and security of cloud computing products
 and services to enable agency mission  
and administrative priorities4  7#b7    
,purposes ,the purposes of the          
,committee are the following3 7,a7 ,to  
examine the operations of ,fed,r,a,m,p  
and determine ways that authorization   
processes can continuously be improved1 
including the following3  7i7 ,measures 
to increase agency re-use of            
,fed,r,a,m,p provisional authorizations4
  7ii7 ,proposed actions that can be    
adopted to reduce the cost of           
,fed,r,a,m,p authorizations and         
,fed,r,a,m,p provisional authorizations 
for cloud service providers4  7iii7     
,measures to increase the number of     
,fed,r,a,m,p authorizations and         
,fed,r,a,m,p provisional authorizations 

for cloud computing services offered by 
small businesses 7as defined by section 
#c7;a7 of the ,small ,business ,act 7#ae
 ,u4,s4,c4 #fcb7;a774  7,b7 ,collect    
information and feedback on agency      
compliance with and implementation of   
,fed,r,a,m,p requirements4  7,c7 ,serve 
as a forum that facilitates             
communication and collaboration among   
the ,fed,r,a,m,p stakeholder community4 
7#c7 ,duties ,the duties of the         
,committee are1 at a minimum1 to provide
 advice and recommendations to the      
,administrator1 the ,joint              
,authorization ,board1 and to agencies  
on technical1 financial1 programmatic1  
and operational matters regarding secure
 adoption of cloud computing products   
and services4  7b7 ,members  7#a7       
,composition ,the ,committee shall be   
comprised of not more than #ae members  
who are qualified representatives from  
the public and private sectors1         
appointed by the ,administrator1 in     
consultation with the ,administrator of 

the ,office of ,electronic ,government1 
as follows3 7,a7 ,the ,administrator or 
the ,administrator's designee1 who shall
 be the ,chair of the ,committee4  7,b7 
,at least one representative each from  
the ,cybersecurity and ,infrastructure  
,security ,agency and the ,national     
,institute of ,standards and            
,technology4  7,c7 ,at least two        
officials who serve as the ,chief       
,information ,security ,officer within  
an agency1 who shall be required to     
maintain such a position throughout the 
duration of their service on the        
,committee4  7,d7 ,at least one official
 serving as ,chief ,procurement ,officer
 7or equivalent7 in an agency1 who shall
 be required to maintain such a position
 throughout the duration of their       
service on the ,committee4  7,e7 ,at    
least one individual representing an    
independent assessment organization4    
7,f7 ,no fewer than five representatives
 from unique businesses that primarily  
provide cloud computing services or     

products1 including at least two        
representatives from a small business   
7as defined by section #c7;a7 of the    
,small ,business ,act 7#ae ,u4,s4,c4    
#fcb7;a7774  7,g7 ,at least two other   
,government representatives as the      
,administrator determines to be         
necessary to provide sufficient balance1
 insights1 or expertise to the          
,committee4  7#b7 ,deadline for         
appointment ,each member of the         
,committee shall be appointed not later 
than #cj days after the date of the     
enactment of this section4  7#c7 ,period
 of appointment2 vacancies  7,a7 ,in    
general ,each non-,federal member of the
 ,committee shall be appointed for a    
term of #c years1 except that the       
initial terms for members may be        
staggered #a-1 #b-1 or #c-year terms to 
establish a rotation in which one-third 
of the members are selected each year4  
,any such member may be appointed for   
not more than #b consecutive terms4     
7,b7 ,vacancies ,any vacancy in the     

,committee shall not affect its powers1 
but shall be filled in the same manner  
in which the original appointment was   
made4 ,any member appointed to fill a   
vacancy occurring before the expiration 
of the term for which the member's      
predecessor was appointed shall be      
appointed only for the remainder of that
 term4 ,a member may serve after the    
expiration of that member's term until a
 successor has taken office4  7c7       
,meetings and rules of procedures  7#a7 
,meetings ,the ,committee shall hold not
 fewer than three meetings in a calendar
 year1 at such time and place as        
determined by the ,chair4  7#b7 ,initial
 meeting ,not later than #abj days after
 the date of the enactment of this      
section1 the ,committee shall meet and  
begin the operations of the ,committee4 
7#c7 ,rules of procedure ,the ,committee
 may establish rules for the conduct of 
the business of the ,committee1 if such 
rules are not inconsistent with this    
section or other applicable law4  7d7   

,employee status  7#a7 ,in general ,a   
member of the ,committee 7other than a  
member who is appointed to the          
,committee in connection with another   
,federal appointment7 shall not be      
considered an employee of the ,federal  
,government by reason of any service as 
such a member1 except for the purposes  
of section #egjc of title #e1 relating  
to travel expenses4  7#b7 ,pay not      
permitted ,a member of the ,committee   
covered by paragraph 7#a7 may not       
receive pay by reason of service on the 
,committee4  7e7 ,applicability to the  
,federal ,advisory ,committee ,act      
,section #ad of the ,federal ,advisory  
,committee ,act 7#e ,u4,s4,c4 ,app47    
shall not apply to the ,committee4  7f7 
,hearings and evidence ,the ,committee1 
or on the authority of the ,committee1  
any subcommittee1 may1 for the purposes 
of carrying out this section1 hold      
hearings1 sit and act at such times and 
places1 take testimony1 receive         
evidence1 and administer oaths4  7g7    

,contracting ,the ,committee1 may1 to   
such extent and in such amounts as are  
provided in appropriation ,acts1 enter  
into contracts to enable the ,committee 
to discharge its duties under this      
section4  7h7 ,information from ,federal
 agencies  7#a7 ,in general ,the        
,committee is authorized to secure      
directly from any executive department1 
bureau1 agency1 board1 commission1      
office1 independent establishment1 or   
instrumentality of the ,government1     
information1 suggestions1 estimates1 and
 statistics for the purposes of the     
,committee4 ,each department1 bureau1   
agency1 board1 commission1 office1      
independent establishment1 or           
instrumentality shall1 to the extent    
authorized by law1 furnish such         
information1 suggestions1 estimates1 and
 statistics directly to the ,committee1 
upon request made by the ,chair1 the    
,chair of any subcommittee created by a 
majority of the ,committee1 or any      
member designated by a majority of the  

,committee4  7#b7 ,receipt1 handling1   
storage1 and dissemination ,information 
may only be received1 handled1 stored1  
and disseminated by members of the      
,committee and its staff consistent with
 all applicable statutes1 regulations1  
and ,executive orders4  7i7 ,detail of  
employees ,any ,federal ,government     
employee may be detailed to the         
,committee without reimbursement from   
the ,committee1 and such detailee shall 
retain the rights1 status1 and          
privileges of his or her regular        
employment without interruption4  7j7   
,postal services ,the ,committee may use
 the ,united ,states mails in the same  
manner and under the same conditions as 
agencies4  7k7 ,expert and consultant   
services ,the ,committee is authorized  
to procure the services of experts and  
consultants in accordance with section  
#caji of title #e1 but at rates not to  
exceed the daily rate paid a person     
occupying a position at ,level ,,iv of  
the ,executive ,schedule under section  

#ecae of title #e4  7l7 ,reports  7#a7  
,interim reports ,the ,committee may    
submit to the ,administrator and        
,congress interim reports containing    
such findings1 conclusions1 and         
recommendations as have been agreed to  
by the ,committee4  7#b7 ,annual reports
 ,not later than #ah months after the   
date of the enactment of this section1  
and annually thereafter1 the ,committee 
shall submit to the ,administrator and  
,congress a final report containing such
 findings1 conclusions1 and             
recommendations as have been agreed to  
by the ,committee4  #cfaf4 ,definitions 
7a7 ,in general ,except as provided     
under subsection 7b71 the definitions   
under sections #cejb and #ceeb apply to 
sections #cfjg through this section4    
7b7 ,additional definitions ,in sections
 #cfjg through this section3  7#a7      
,administrator ,the term ,administrator 
means the ,administrator of ,general    
,services4  7#b7 ,authorization package 
,the term authorization package--  7,a7 

means the essential information used to 
determine whether to authorize the      
operation of an information system or   
the use of a designated set of common   
controls2 and  7,b7 at a minimum1       
includes the information system security
 plan1 privacy plan1 security control   
assessment1 privacy control assessment1 
and any relevant plans of action and    
milestones4  7#c7 ,cloud computing ,the 
term cloud computing has the meaning    
given that term by the ,national        
,institutes of ,standards and           
,technology in ,,nist ,special          
,publication #hjj-ade and any amendatory
 or superseding document thereto4  7#d7 
,cloud service provider ,the term cloud 
service provider means an entity        
offering cloud computing products or    
services to agencies4  7#e7 ,director   
,the term ,director means the ,director 
of the ,office of ,management and       
,budget4  7#f7 ,fed,r,a,m,p ,the term   
,fed,r,a,m,p means the ,federal ,risk   
and ,authorization ,management ,program 

established under section #cfjg7;a74    
7#g7 ,fed,r,a,m,p authorization ,the    
term ,fed,r,a,m,p authorization means a 
certification that a cloud computing    
product or service received from an     
agency that provides an authorization to
 operate and the ,fed,r,a,m,p ,program  
,management ,office has determined the  
product or service has completed the    
,fed,r,a,m,p authorization process4     
7#h7 ,fed,r,a,m,p program management    
office ,the term ,fed,r,a,m,p ,program  
,management ,office means the office    
that administers ,fed,r,a,m,p           
established under section #cfjg7;b74    
7#i7 ,fed,r,a,m,p provisional           
authorization ,the term ,fed,r,a,m,p    
provisional authorization means a       
certification that a cloud computing    
product or service has received from the
 ,joint ,authorization ,board that      
approves a provisional authorization to 
operate4  7#aj7 ,independent assessment 
organization ,the term independent      
assessment organization means a         

third-party organization accredited by  
the ,program ,director of the           
,fed,r,a,m,p ,program ,management       
,office to undertake conformity         
assessments of cloud service providers  
and their products or services4  7#aa7  
,joint ,authorization ,board ,the term  
,joint ,authorization ,board means the  
,joint ,authorization ,board established
 under section #cfjg7;b74  4  7b7       
,technical and conforming amendment ,the
 table of sections for chapter #cf of   
title #dd1 ,united ,states ,code1 is    
amended by adding at the end the        
following new items3  #cfjg4 ,federal   
,risk and ,authorization ,management    
,program4 #cfjh4 ,fed,r,a,m,p ,program  
,management ,office4 #cfji4 ,joint      
,authorization ,board4 #cfaj4           
,independent assessment organizations4  
#cfaa4 ,roles and responsibilities of   
agencies4 #cfab4 ,roles and             
responsibilities of the ,office of      
,management and ,budget4 #cfac4         
,authorization of appropriations for    

,,fedramp4 #cfad4 ,reports to ,congress4
 #cfae4 ,federal ,secure ,cloud         
,advisory ,committee4 #cfaf4            
,definitions4  4  7c7 ,sunset ,this ,act
 and any amendment made by this ,act    
shall be repealed on the date that is   
#aj years after the date of the         
enactment of this ,act4  7d7 ,rule of   
construction ,nothing in this ,act or   
any amendment made by this ,act shall be
 construed as altering or impairing the 
authorities of the ,director of the     
,office of ,management and ,budget or   
the ,secretary of ,homeland ,security   
under subchapter ,,ii of chapter #ce of 
title #dd1 ,united ,states ,code4       
,passed the ,house of ,representatives  
,january #e1 #bjba4;,clerk4