#aag? ,,congress #a/ ,session ,h4 ,r4 #ba ,,an ,,act ,to enhance ! innovation1 security1 & availability ( cl\d comput+ products & s]vices us$ 9 ! ,f$]al ,gov]nm5t by e/abli%+ ! ,f$]al ,risk & ,au?orization ,managem5t ,program )9 ! ,g5]al ,s]vices ,adm9i/ration & by e/abli%+ a risk managem5t1 au?orization1 & cont9u\s monitor+ process to enable ! ,f$]al ,gov]nm5t to lev]age cl\d comput+ products & s]vices us+ a risk-bas$ approa* consi/5t ) ! ,f$]al ,in=mation ,security ,mod]nization ,act ( #bjad & cl\d-bas$ op]ations1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,f$]al ,risk & ,au?orization ,managem5t ,program ,au?orization ,act ( #bjba or ! ,fed,r,a,m,p ,au?orization ,act4 #b4 ,codification ( ! ,fed,r,a,m,p program 7a7 ,am5dm5t ,*apt] #cf ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+ new sections3 #cfjg4 ,f$]al ,risk & ,au?orization ,managem5t ,program 7a7 ,e/abli%m5t ,!re is e/abli%$ )9 ! ,g5]al ,s]vices ,adm9i/ration ! ,f$]al ,risk & ,au?orization ,managem5t ,program4 ,! ,adm9i/rator ( ,g5]al ,s]vices1 9 accordance ) section #cfab1 %all e/abli% a gov]nm5twide program t provides ! au?oritative /&>diz$ approa* to security assessm5t & au?orization = cl\d comput+ products & s]vices t process unclassifi$ in=mation us$ by ag5cies4 7b7 ,compon5ts ( ,fed,r,a,m,p ,! ,jo9t ,au?orization ,bo>d & ! ,fed,r,a,m,p ,program ,managem5t ,(fice are e/abli%$ z compon5ts ( ,fed,r,a,m,p4 #cfjh4 ,fed,r,a,m,p ,program ,managem5t ,(fice 7a7 ,,gsa duties 7#a7 ,roles & responsibilities ,! ,adm9i/rator ( ,g5]al ,s]vices %all-- 7,a7 det]m9e ! categories & *>act]i/ics ( cl\d comput+ products & s]vices t are )9 ! jurisdiction ( ,fed,r,a,m,p & t require a ,fed,r,a,m,p au?orization or a ,fed,r,a,m,p provisional au?orization2 7,b7 develop1 coord9ate1 & implem5t a process = ! ,fed,r,a,m,p ,program ,managem5t ,(fice1 ! ,jo9t ,au?orization ,bo>d1 & ag5cies to review security assessm5ts ( cl\d comput+ products & s]vices pursuant to subsections 7b7 & 7c7 ( section #cfaa1 & appropriate ov]sight ( cont9u\s monitor+ ( cl\d comput+ products & s]vices2 & 7,c7 ensure ! cont9u\s improvem5t ( ,fed,r,a,m,p4 7#b7 ,implem5tation ,! ,adm9i/rator %all ov]see ! implem5tation ( ,fed,r,a,m,p1 includ+-- 7,a7 appo9t+ a ,program ,director to ov]see ! ,fed,r,a,m,p ,program ,managem5t ,(fice2 7,b7 hir+ pr(essional /aff z may be necess>y = ! effective op]ation ( ! ,fed,r,a,m,p ,program ,managem5t ,(fice1 & su* o!r activities z are ess5tial to prop]ly p]=m critical functions2 7,c7 ent]+ into int]ag5cy agreem5ts to detail p]sonnel on a reimbursable or non-reimbursable basis to assi/ ! ,fed,r,a,m,p ,program ,managem5t ,(fice & ! ,jo9t ,au?orization ,bo>d 9 dis*>g+ ! responsibilities ( ! ,(fice "u ?is section2 & 7,d7 su* o!r actions z ! ,adm9i/rator may det]m9e necess>y to c>ry out ?is section4 7b7 ,duties ,! ,fed,r,a,m,p ,program ,managem5t ,(fice %all h ! foll[+ duties3 7#a7 ,provide guidance to indep5d5t assessm5t organizations1 validate ! indep5d5t assessm5ts1 & apply ! requirem5ts & guidel9es adopt$ 9 section #cfji7;c77#e74 7#b7 ,ov]see & issue guidel9es reg>d+ ! necess>y requirem5ts = accr$itation ( ?ird-p>ty organizations seek+ to be aw>d$ accr$itation z indep5d5t assessm5t organizations1 includ+ qualifications1 roles1 & responsibilities ( indep5d5t assessm5t organizations4 7#c7 ,develop templates & o!r mat]ials to support ! ,jo9t ,au?orization ,bo>d & ag5cies 9 ! au?orization ( cl\d comput+ products & s]vices to increase ! spe$1 effectiv5ess1 & transp>5cy ( ! au?orization process1 consi/5t ) /&>ds def9$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology4 7#d7 ,e/abli% & ma9ta9 a public comm5t process = propos$ guidance be=e ! issuance ( su* guidance by ,fed,r,a,m,p4 7#e7 ,review any au?orization to op]ate issu$ by an ag5cy to det]m9e if ! au?orization meets ! requirem5ts & guidel9es adopt$ 9 section #cfji7;c77#e74 7#f7 ,e/abli% frameworks = ag5cies to use au?orization packages process$ by ! ,fed,r,a,m,p ,program ,managem5t ,(fice & ,jo9t ,au?orization ,bo>d4 7#g7 ,coord9ate ) ! ,secret>y ( ,def5se & ! ,secret>y ( ,homel& ,security to e/abli% a framework = cont9u\s monitor+ "u section #ceec & ag5cy reports requir$ "u section #ceed4 7#h7 ,e/abli% a c5traliz$ & secure repository to collect & %>e necess>y data1 includ+ security au?orization packages1 f ! ,jo9t ,au?orization ,bo>d & ag5cies to enable bett] %>+ & reuse ( su* packages across ag5cies4 7c7 ,evaluation ( automation proc$ures 7#a7 ,9 g5]al ,! ,fed,r,a,m,p ,program ,managem5t ,(fice %all assess & evaluate available automation capabilities & proc$ures to improve ! effici5cy & effectiv5ess ( ! issuance ( ,fed,r,a,m,p au?orizations & ,fed,r,a,m,p provisional au?orizations1 includ+ cont9u\s monitor+ ( cl\d comput+ products & s]vices4 7#b7 ,means = automation ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is section1 & updat$ annually !reaft]1 ! ,fed,r,a,m,p ,program ,managem5t ,(fice %all e/abli% a means = ! automation ( security assessm5ts & reviews4 7d7 ,metrics = au?orization ,! ,fed,r,a,m,p ,program ,managem5t ,(fice %all e/abli% annual metrics reg>d+ ! "t & quality ( ! assessm5ts necess>y = completion ( a ,fed,r,a,m,p au?orization process 9 a mann] t c be consi/5tly track$ ov] "t 9 conjunction ) ! p]iodic te/+ & evaluation process pursuant to section #ceed 9 a mann] t m9imizes ! ag5cy report+ burd54 #cfji4 ,jo9t ,au?orization ,bo>d 7a7 ,e/abli%m5t ,! ,jo9t ,au?orization ,bo>d %all consi/ ( cl\d comput+ exp]ts1 appo9t$ by ! ,director 9 consultation ) ! ,adm9i/rator1 f ea* ( ! foll[+3 7#a7 ,! ,dep>tm5t ( ,def5se4 7#b7 ,! ,dep>tm5t ( ,homel& ,security4 7#c7 ,! ,g5]al ,s]vices ,adm9i/ration4 7#d7 ,su* o!r ag5cies z det]m9$ by ! ,director1 9 consultation ) ! ,adm9i/rator4 7b7 ,issuance ( ,fed,r,a,m,p provisional au?orizations ,! ,jo9t ,au?orization ,bo>d %all conduct security assessm5ts ( cl\d comput+ products & s]vices & issue ,fed,r,a,m,p provisional au?orizations to cl\d s]vice provid]s t meet ! requirem5ts & guidel9es e/abli%$ 9 subsection 7c77#e74 7c7 ,duties ,! ,jo9t ,au?orization ,bo>d %all-- 7#a7 develop & make publicly available on a website1 det]m9$ by ! ,adm9i/rator1 crit]ia = prioritiz+ & select+ cl\d comput+ products & s]vices to be assess$ by ! ,jo9t ,au?orization ,bo>d2 7#b7 provide regul> updates to applicant cl\d s]vice provid]s on ! /atus ( any cl\d comput+ product or s]vice dur+ ! assessm5t & au?orization process ( ! ,jo9t ,au?orization ,bo>d2 7#c7 review & validate cl\d comput+ products & s]vices & mat]ials submitt$ by indep5d5t assessm5t organizations or any docum5tation det]m9$ to be necess>y by ! ,jo9t ,au?orization ,bo>d to evaluate ! sy/em security ( a cl\d comput+ product or s]vice2 7#d7 9 consultation ) ! ,fed,r,a,m,p ,program ,managem5t ,(fice1 s]ve z a res\rce = be/ practices to accel]ate ! process = obta9+ a ,fed,r,a,m,p au?orization or ,fed,r,a,m,p provisional au?orization2 7#e7 e/abli% requirem5ts & guidel9es = security assessm5ts ( cl\d comput+ products & s]vices1 consi/5t ) /&>ds def9$ by ! ,national ,in/itute ( ,/&>ds & ,te*nology1 to be us$ by ! ,jo9t ,au?orization ,bo>d & ag5cies2 7#f7 p]=m su* o!r roles & responsibilities z ! ,adm9i/rator may assign1 9 consultation ) ! ,fed,r,a,m,p ,program ,managem5t ,(fice & memb]s ( ! ,jo9t ,au?orization ,bo>d2 & 7#g7 e/abli% metrics & goals = reviews & activities associat$ ) issu+ ,fed,r,a,m,p provisional au?orizations & provide to ! ,fed,r,a,m,p ,program ,managem5t ,(fice4 7d7 ,det]m9ations ( dem& = cl\d comput+ products & s]vices ,! ,jo9t ,au?orization ,bo>d %all consult ) ! ,*ief ,in=mation ,(fic]s ,c\ncil e/abli%$ 9 section #cfjc to e/abli% a process1 t %all be made available on a public website1 = prioritiz+ & accept+ ! cl\d comput+ products & s]vices to be grant$ a ,fed,r,a,m,p provisional au?orization4 7e7 ,detail ( p]sonnel ,to assi/ ! ,jo9t ,au?orization ,bo>d 9 dis*>g+ ! responsibilities "u ?is section1 p]sonnel ( ag5cies may be detail$ to ! ,jo9t ,au?orization ,bo>d = ! p]=mance ( duties describ$ "u subsection 7c74 #cfaj4 ,indep5d5t assessm5t organizations 7a7 ,requirem5ts = accr$itation ,! ,jo9t ,au?orization ,bo>d %all det]m9e ! requirem5ts = ! accr$itation ( a ?ird-p>ty organization seek+ to be accr$it$ z an indep5d5t assessm5t organization1 ensur+ adequate implem5tation ( section #cfji4 ,su* requirem5ts may include develop+ or requir+ c]tification programs = individuals employ$ by ! ?ird-p>ty organization seek+ accr$itation4 ,! ,program ,director ( ! ,fed,r,a,m,p ,program ,managem5t ,(fice %all accr$it any ?ird-p>ty organization t meets ! requirem5ts = accr$itation4 7b7 ,assessm5t ,an indep5d5t assessm5t organization may assess1 validate1 & atte/ to ! quality & compliance ( security assessm5t mat]ials provid$ by cl\d s]vice provid]s z "p ( ! ,fed,r,a,m,p au?orization or ! ,fed,r,a,m,p provisional au?orization process4 #cfaa4 ,roles & responsibilities ( ag5cies 7a7 ,9 g5]al ,9 implem5t+ ! requirem5ts ( ,fed,r,a,m,p1 ! head ( ea* ag5cy %all1 consi/5t ) guidance issu$ by ! ,director pursuant to section #cfab-- 7#a7 create policies to ensure cl\d comput+ products & s]vices us$ by ! ag5cy meet ,fed,r,a,m,p security requirem5ts & o!r risk-bas$ p]=mance requirem5ts z def9$ by ! ,director2 7#b7 issue ag5cy-specific au?orizations to op]ate = cl\d comput+ s]vices 9 compliance ) section #ceed2 7#c7 confirm :e!r !re is a ,fed,r,a,m,p au?orization or ,fed,r,a,m,p provisional au?orization 9 ! cl\d security repository e/abli%$ "u section #cfjh7;b77#h7 be=e beg9n+ ! process to aw>d a ,fed,r,a,m,p au?orization or a ,fed,r,a,m,p provisional au?orization = a cl\d comput+ product or s]vice2 7#d7 to ! ext5t practicable1 = any cl\d comput+ product or s]vice ! ag5cy seeks to au?orize t has receiv$ a ,fed,r,a,m,p au?orization or ,fed,r,a,m,p provisional au?orization1 use ! exi/+ assessm5ts ( security controls & mat]ials )9 ! au?orization package2 & 7#e7 provide data & in=mation requir$ to ! ,director pursuant to section #cfab to det]m9e h[ ag5cies are meet+ metrics z def9$ by ! ,fed,r,a,m,p ,program ,managem5t ,(fice4 7b7 ,submission ( policies requir$ ,n lat] ?an #f mon?s aft] ! date ( ! enactm5t ( ?is section1 ! head ( ea* ag5cy %all submit to ! ,director ! policies creat$ pursuant to subsection 7a77#a7 = review & approval4 7c7 ,submission ( au?orizations ,to op]ate requir$ ,^u issuance ( an ag5cy au?orization to op]ate1 ! head ( ! ag5cy %all provide a copy ( ! au?orization to op]ate lett] & any supplem5t>y in=mation requir$ pursuant to section #cfjh7;b7 to ! ,fed,r,a,m,p ,program ,managem5t ,(fice4 7d7 ,presumption ( adequacy 7#a7 ,9 g5]al ,! assessm5t ( security controls & mat]ials )9 ! au?orization package = a ,fed,r,a,m,p au?orization or ,fed,r,a,m,p provisional au?orization %all be presum$ adequate = use 9 an ag5cy au?orization to op]ate cl\d comput+ products & s]vices4 7#b7 ,in=mation security requirem5ts ,! presumption "u p>agraph 7#a7 does n modify or alt] ! responsibility ( any ag5cy to ensure compliance ) sub*apt] ,,ii ( *apt] #ce = any cl\d comput+ products or s]vices us$ by ! ag5cy4 #cfab4 ,roles & responsibilities ( ! ,(fice ( ,managem5t & ,budget ,! ,director %all h ! foll[+ duties3 7#a7 ,issue guidance to ensure t an ag5cy does n op]ate a ,f$]al ,gov]nm5t cl\d comput+ product or s]vice us+ ,gov]nm5t data )\t an au?orization to op]ate issu$ by ! ag5cy t meets ! requirem5ts ( sub*apt] ,,ii ( *apt] #ce & ! ,fed,r,a,m,p au?orization or ,fed,r,a,m,p provisional au?orization4 7#b7 ,ensure ag5cies are 9 compliance ) any guidance or o!r requirem5ts issu$ relat$ to ,fed,r,a,m,p4 7#c7 ,review1 analyze1 & update guidance on ! adoption1 security1 & use ( cl\d comput+ s]vices us$ by ag5cies4 7#d7 ,ensure ! ,jo9t ,au?orization ,bo>d is 9 compliance ) section #cfji7;c74 7#e7 ,adjudicate disagreem5ts betwe5 ! ,jo9t ,au?orization ,bo>d & cl\d s]vice provid]s seek+ a ,fed,r,a,m,p provisional au?orization4 7#f7 ,promulgate regulations on ! role ( ,fed,r,a,m,p au?orizations & ,fed,r,a,m,p provisional au?orizations 9 ag5cy acquisition ( cl\d comput+ products & s]vices t process unclassifi$ in=mation4 #cfac4 ,au?orization ( appropriations = ,,f$ramp ,!re is au?oriz$ to be appropriat$ #bj1jjj1jjj ea* ye> = ! ,fed,r,a,m,p ,program ,managem5t ,(fice & ! ,jo9t ,au?orization ,bo>d4 #cfad4 ,reports to ,congress2 ,,gao ,report 7a7 ,reports to ,congress ,n lat] ?an #ab mon?s aft] ! date ( ! enactm5t ( ?is section1 & annually !reaft]1 ! ,director %all submit to ! ,committee on ,ov]sight & ,re=m ( ! ,h\se ( ,repres5tatives & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate a report t includes ! foll[+3 7#a7 ,! /atus1 effici5cy1 & effectiv5ess ( ,fed,r,a,m,p ,program ,managem5t ,(fice & ag5cies dur+ ! prec$+ ye> 9 support+ ! spe$1 effectiv5ess1 %>+1 reuse1 & security ( au?orizations to op]ate = cl\d comput+ products & s]vices1 includ+ progress t[>ds meet+ ! metrics adopt$ by ! ,fed,r,a,m,p ,program ,managem5t ,(fice pursuant to section #cfjh7;d7 & ! ,jo9t ,au?orization ,bo>d pursuant to section #cfji7;c77#e74 7#b7 ,data on ,fed,r,a,m,p au?orizations & ,fed,r,a,m,p provisional au?orizations4 7#c7 ,! av]age l5g? ( "t = ! ,jo9t ,au?orization ,bo>d to review applications = & issue ,fed,r,a,m,p provisional au?orizations4 7#d7 ,! av]age l5g? ( "t = ! ,fed,r,a,m,p ,program ,managem5t ,(fice to review au?orizations to op]ate4 7#e7 ,! numb] ( ,fed,r,a,m,p au?orizations & ,fed,r,a,m,p provisional au?orizations issu$ = ! previ\s ye>4 7#f7 ,a review ( progress made dur+ ! prec$+ ye> 9 advanc+ automation te*niques to securely automate ,fed,r,a,m,p processes & to accel]ate report+ z describ$ 9 ?is section4 7#g7 ,! numb] & *>act]i/ics ( au?oriz$ cl\d comput+ products & s]vices 9 use at ea* ag5cy consi/5t ) guidance provid$ by ! ,director 9 section #cfab4 7#h7 ,! co/ incurr$ by ag5cies & cl\d s]vice provid]s relat$ to ! issuance ( ,fed,r,a,m,p au?orizations & ,fed,r,a,m,p provisional au?orizations1 includ+ in=mation responsive to ! report requir$ 9 subsection 7b74 7b7 ,,gao report ,n lat] ?an #f mon?s aft] ! date ( ! enactm5t ( ?is section1 ! ,comptroll] ,g5]al ( ! ,unit$ ,/ates %all publi% a report t includes an assessm5t ( ! co/ incurr$ by ag5cies & cl\d s]vice provid]s relat$ to ! issuance ( ,fed,r,a,m,p au?orizations & ,fed,r,a,m,p provisional au?orizations4 #cfae4 ,f$]al ,secure ,cl\d ,advisory ,committee 7a7 ,e/abli%m5t1 purposes1 & duties 7#a7 ,e/abli%m5t ,!re is e/abli%$ a ,f$]al ,secure ,cl\d ,advisory ,committee 7ref]r$ to 9 ?is section z ! ,committee7 to ensure effective & ongo+ coord9ation ( ag5cy adoption1 use1 au?orization1 monitor+1 acquisition1 & security ( cl\d comput+ products & s]vices to enable ag5cy mission & adm9i/rative priorities4 7#b7 ,purposes ,! purposes ( ! ,committee are ! foll[+3 7,a7 ,to exam9e ! op]ations ( ,fed,r,a,m,p & det]m9e ways t au?orization processes c cont9u\sly be improv$1 includ+ ! foll[+3 7i7 ,measures to increase ag5cy re-use ( ,fed,r,a,m,p provisional au?orizations4 7ii7 ,propos$ actions t c be adopt$ to r$uce ! co/ ( ,fed,r,a,m,p au?orizations & ,fed,r,a,m,p provisional au?orizations = cl\d s]vice provid]s4 7iii7 ,measures to increase ! numb] ( ,fed,r,a,m,p au?orizations & ,fed,r,a,m,p provisional au?orizations = cl\d comput+ s]vices (f]$ by small bus9esses 7z def9$ by section #c7;a7 ( ! ,small ,bus9ess ,act 7#ae ,u4,s4,c4 #fcb7;a774 7,b7 ,collect in=mation & fe$back on ag5cy compliance ) & implem5tation ( ,fed,r,a,m,p requirem5ts4 7,c7 ,s]ve z a =um t facilitates communication & collaboration among ! ,fed,r,a,m,p /akehold] community4 7#c7 ,duties ,! duties ( ! ,committee are1 at a m9imum1 to provide advice & recomm5dations to ! ,adm9i/rator1 ! ,jo9t ,au?orization ,bo>d1 & to ag5cies on te*nical1 f9ancial1 programmatic1 & op]ational matt]s reg>d+ secure adoption ( cl\d comput+ products & s]vices4 7b7 ,memb]s 7#a7 ,composition ,! ,committee %all be compris$ ( n m ?an #ae memb]s :o are qualifi$ repres5tatives f ! public & private sectors1 appo9t$ by ! ,adm9i/rator1 9 consultation ) ! ,adm9i/rator ( ! ,(fice ( ,electronic ,gov]nm5t1 z foll[s3 7,a7 ,! ,adm9i/rator or ! ,adm9i/rator's designee1 :o %all be ! ,*air ( ! ,committee4 7,b7 ,at lea/ "o repres5tative ea* f ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! ,national ,in/itute ( ,/&>ds & ,te*nology4 7,c7 ,at lea/ two (ficials :o s]ve z ! ,*ief ,in=mation ,security ,(fic] )9 an ag5cy1 :o %all be requir$ to ma9ta9 su* a position ?r\gh\t ! duration ( _! s]vice on ! ,committee4 7,d7 ,at lea/ "o (ficial s]v+ z ,*ief ,procurem5t ,(fic] 7or equival5t7 9 an ag5cy1 :o %all be requir$ to ma9ta9 su* a position ?r\gh\t ! duration ( _! s]vice on ! ,committee4 7,e7 ,at lea/ "o individual repres5t+ an indep5d5t assessm5t organization4 7,f7 ,no few] ?an five repres5tatives f unique bus9esses t prim>ily provide cl\d comput+ s]vices or products1 includ+ at lea/ two repres5tatives f a small bus9ess 7z def9$ by section #c7;a7 ( ! ,small ,bus9ess ,act 7#ae ,u4,s4,c4 #fcb7;a7774 7,g7 ,at lea/ two o!r ,gov]nm5t repres5tatives z ! ,adm9i/rator det]m9es to be necess>y to provide suffici5t balance1 insights1 or exp]tise to ! ,committee4 7#b7 ,deadl9e = appo9tm5t ,ea* memb] ( ! ,committee %all be appo9t$ n lat] ?an #cj days aft] ! date ( ! enactm5t ( ?is section4 7#c7 ,p]iod ( appo9tm5t2 vacancies 7,a7 ,9 g5]al ,ea* non-,f$]al memb] ( ! ,committee %all be appo9t$ = a t]m ( #c ye>s1 except t ! initial t]ms = memb]s may be /agg]$ #a-1 #b-1 or #c-ye> t]ms to e/abli% a rotation 9 :i* "o-?ird ( ! memb]s are select$ ea* ye>4 ,any su* memb] may be appo9t$ = n m ?an #b consecutive t]ms4 7,b7 ,vacancies ,any vacancy 9 ! ,committee %all n affect its p[]s1 b %all be fill$ 9 ! same mann] 9 :i* ! orig9al appo9tm5t 0 made4 ,any memb] appo9t$ to fill a vacancy occurr+ be=e ! expiration ( ! t]m = :i* ! memb]'s pr$ecessor 0 appo9t$ %all be appo9t$ only = ! rema9d] ( t t]m4 ,a memb] may s]ve aft] ! expiration ( t memb]'s t]m until a successor has tak5 (fice4 7c7 ,meet+s & rules ( proc$ures 7#a7 ,meet+s ,! ,committee %all hold n few] ?an ?ree meet+s 9 a cal5d> ye>1 at su* "t & place z det]m9$ by ! ,*air4 7#b7 ,initial meet+ ,n lat] ?an #abj days aft] ! date ( ! enactm5t ( ?is section1 ! ,committee %all meet & beg9 ! op]ations ( ! ,committee4 7#c7 ,rules ( proc$ure ,! ,committee may e/abli% rules = ! conduct ( ! bus9ess ( ! ,committee1 if su* rules are n inconsi/5t ) ?is section or o!r applicable law4 7d7 ,employee /atus 7#a7 ,9 g5]al ,a memb] ( ! ,committee 7o!r ?an a memb] :o is appo9t$ to ! ,committee 9 connection ) ano!r ,f$]al appo9tm5t7 %all n be consid]$ an employee ( ! ,f$]al ,gov]nm5t by reason ( any s]vice z su* a memb]1 except = ! purposes ( section #egjc ( title #e1 relat+ to travel exp5ses4 7#b7 ,pay n p]mitt$ ,a memb] ( ! ,committee cov]$ by p>agraph 7#a7 may n receive pay by reason ( s]vice on ! ,committee4 7e7 ,applicability to ! ,f$]al ,advisory ,committee ,act ,section #ad ( ! ,f$]al ,advisory ,committee ,act 7#e ,u4,s4,c4 ,app47 %all n apply to ! ,committee4 7f7 ,he>+s & evid5ce ,! ,committee1 or on ! au?ority ( ! ,committee1 any subcommittee1 may1 = ! purposes ( c>ry+ out ?is section1 hold he>+s1 sit & act at su* times & places1 take te/imony1 receive evid5ce1 & adm9i/] oa?s4 7g7 ,contract+ ,! ,committee1 may1 to su* ext5t & 9 su* am\nts z are provid$ 9 appropriation ,acts1 ent] into contracts to enable ! ,committee to dis*>ge its duties "u ?is section4 7h7 ,in=mation f ,f$]al ag5cies 7#a7 ,9 g5]al ,! ,committee is au?oriz$ to secure directly f any executive dep>tm5t1 bureau1 ag5cy1 bo>d1 commission1 (fice1 indep5d5t e/abli%m5t1 or in/rum5tality ( ! ,gov]nm5t1 in=mation1 sugge/ions1 e/imates1 & /ati/ics = ! purposes ( ! ,committee4 ,ea* dep>tm5t1 bureau1 ag5cy1 bo>d1 commission1 (fice1 indep5d5t e/abli%m5t1 or in/rum5tality %all1 to ! ext5t au?oriz$ by law1 furni% su* in=mation1 sugge/ions1 e/imates1 & /ati/ics directly to ! ,committee1 ^u reque/ made by ! ,*air1 ! ,*air ( any subcommittee creat$ by a majority ( ! ,committee1 or any memb] designat$ by a majority ( ! ,committee4 7#b7 ,receipt1 h&l+1 /orage1 & dissem9ation ,in=mation may only be receiv$1 h&l$1 /or$1 & dissem9at$ by memb]s ( ! ,committee & its /aff consi/5t ) all applicable /atutes1 regulations1 & ,executive ord]s4 7i7 ,detail ( employees ,any ,f$]al ,gov]nm5t employee may be detail$ to ! ,committee )\t reimbursem5t f ! ,committee1 & su* detailee %all reta9 ! rights1 /atus1 & privileges ( 8 or h] regul> employm5t )\t int]ruption4 7j7 ,po/al s]vices ,! ,committee may use ! ,unit$ ,/ates mails 9 ! same mann] & "u ! same conditions z ag5cies4 7k7 ,exp]t & consultant s]vices ,! ,committee is au?oriz$ to procure ! s]vices ( exp]ts & consultants 9 accordance ) section #caji ( title #e1 b at rates n to exce$ ! daily rate paid a p]son occupy+ a position at ,level ,,iv ( ! ,executive ,s*$ule "u section #ecae ( title #e4 7l7 ,reports 7#a7 ,int]im reports ,! ,committee may submit to ! ,adm9i/rator & ,congress int]im reports conta9+ su* f9d+s1 conclusions1 & recomm5dations z h be5 agre$ to by ! ,committee4 7#b7 ,annual reports ,n lat] ?an #ah mon?s aft] ! date ( ! enactm5t ( ?is section1 & annually !reaft]1 ! ,committee %all submit to ! ,adm9i/rator & ,congress a f9al report conta9+ su* f9d+s1 conclusions1 & recomm5dations z h be5 agre$ to by ! ,committee4 #cfaf4 ,def9itions 7a7 ,9 g5]al ,except z provid$ "u subsection 7b71 ! def9itions "u sections #cejb & #ceeb apply to sections #cfjg ?r\gh ?is section4 7b7 ,additional def9itions ,9 sections #cfjg ?r\gh ?is section3 7#a7 ,adm9i/rator ,! t]m ,adm9i/rator means ! ,adm9i/rator ( ,g5]al ,s]vices4 7#b7 ,au?orization package ,! t]m au?orization package-- 7,a7 means ! ess5tial in=mation us$ to det]m9e :e!r to au?orize ! op]ation ( an in=mation sy/em or ! use ( a designat$ set ( common controls2 & 7,b7 at a m9imum1 includes ! in=mation sy/em security plan1 privacy plan1 security control assessm5t1 privacy control assessm5t1 & any relevant plans ( action & mile/ones4 7#c7 ,cl\d comput+ ,! t]m cl\d comput+ has ! mean+ giv5 t t]m by ! ,national ,in/itutes ( ,/&>ds & ,te*nology 9 ,,ni/ ,special ,publication #hjj-ade & any am5datory or sup]s$+ docum5t !reto4 7#d7 ,cl\d s]vice provid] ,! t]m cl\d s]vice provid] means an entity (f]+ cl\d comput+ products or s]vices to ag5cies4 7#e7 ,director ,! t]m ,director means ! ,director ( ! ,(fice ( ,managem5t & ,budget4 7#f7 ,fed,r,a,m,p ,! t]m ,fed,r,a,m,p means ! ,f$]al ,risk & ,au?orization ,managem5t ,program e/abli%$ "u section #cfjg7;a74 7#g7 ,fed,r,a,m,p au?orization ,! t]m ,fed,r,a,m,p au?orization means a c]tification t a cl\d comput+ product or s]vice receiv$ f an ag5cy t provides an au?orization to op]ate & ! ,fed,r,a,m,p ,program ,managem5t ,(fice has det]m9$ ! product or s]vice has complet$ ! ,fed,r,a,m,p au?orization process4 7#h7 ,fed,r,a,m,p program managem5t (fice ,! t]m ,fed,r,a,m,p ,program ,managem5t ,(fice means ! (fice t adm9i/]s ,fed,r,a,m,p e/abli%$ "u section #cfjg7;b74 7#i7 ,fed,r,a,m,p provisional au?orization ,! t]m ,fed,r,a,m,p provisional au?orization means a c]tification t a cl\d comput+ product or s]vice has receiv$ f ! ,jo9t ,au?orization ,bo>d t approves a provisional au?orization to op]ate4 7#aj7 ,indep5d5t assessm5t organization ,! t]m indep5d5t assessm5t organization means a ?ird-p>ty organization accr$it$ by ! ,program ,director ( ! ,fed,r,a,m,p ,program ,managem5t ,(fice to und]take con=mity assessm5ts ( cl\d s]vice provid]s & _! products or s]vices4 7#aa7 ,jo9t ,au?orization ,bo>d ,! t]m ,jo9t ,au?orization ,bo>d means ! ,jo9t ,au?orization ,bo>d e/abli%$ "u section #cfjg7;b74 4 7b7 ,te*nical & con=m+ am5dm5t ,! table ( sections = *apt] #cf ( title #dd1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+ new items3 #cfjg4 ,f$]al ,risk & ,au?orization ,managem5t ,program4 #cfjh4 ,fed,r,a,m,p ,program ,managem5t ,(fice4 #cfji4 ,jo9t ,au?orization ,bo>d4 #cfaj4 ,indep5d5t assessm5t organizations4 #cfaa4 ,roles & responsibilities ( ag5cies4 #cfab4 ,roles & responsibilities ( ! ,(fice ( ,managem5t & ,budget4 #cfac4 ,au?orization ( appropriations = ,,f$ramp4 #cfad4 ,reports to ,congress4 #cfae4 ,f$]al ,secure ,cl\d ,advisory ,committee4 #cfaf4 ,def9itions4 4 7c7 ,sunset ,?is ,act & any am5dm5t made by ?is ,act %all be repeal$ on ! date t is #aj ye>s aft] ! date ( ! enactm5t ( ?is ,act4 7d7 ,rule ( con/ruction ,no?+ 9 ?is ,act or any am5dm5t made by ?is ,act %all be con/ru$ z alt]+ or impair+ ! au?orities ( ! ,director ( ! ,(fice ( ,managem5t & ,budget or ! ,secret>y ( ,homel& ,security "u sub*apt] ,,ii ( *apt] #ce ( title #dd1 ,unit$ ,/ates ,code4 ,pass$ ! ,h\se ( ,repres5tatives ,janu>y #e1 #bjba4;,cl]k4