,,ii  #aag? ,,congress  #a/ ,session    
,s4 #cjii  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,octob] #bh1 #bjba,mr4 
,pet]s 7= himself1 ,ms4 ,hassan1 ,mr4   
,hawley1 & ,mr4 ,da9es7 introduc$ !     
foll[+ bill2 :i* 0 read twice & ref]r$  
to ! ,committee on ,homel& ,security &  
,gov]nm5tal ,affairs  ,a ,,bill  ,to    
am5d title #dd1 ,unit$ ,/ates ,code1 to 
e/abli% ! ,f$]al ,risk & ,au?orization  
,managem5t ,program )9 ! ,g5]al ,s]vices
 ,adm9i/ration1 & = o!r purposes4  #a4  
,%ort title ,?is ,act may be cit$ z !   
,f$]al ,secure ,cl\d ,improvem5t & ,jobs
 ,act ( #bjba4  #b4 ,f9d+s ,congress    
f9ds ! foll[+3 7#a7 ,ensur+ t ! ,f$]al  
,gov]nm5t c securely lev]age cl\d       
comput+ products & s]vices is key to    
exp$it+ ! mod]nization ( legacy         
in=mation te*nology sy/ems1 increas+    
cyb]security )9 & across dep>tm5ts &    
ag5cies1 & support+ ! cont9u$ lead]%ip (
 ! ,unit$ ,/ates 9 te*nology innovation 
& job creation4  7#b7 ,accord+ to       
indep5d5t analysis1 z ( cal5d> ye>      

#bjai1 ! size ( ! cl\d comput+ m>ket _h 
tripl$ s9ce #bjjd1 enabl+ m ?an         
#b1jjj1jjj jobs & add+ m ?an            
#bjj1jjj1jjj1jjj to ! gross dome/ic     
product ( ! ,unit$ ,/ates4  7#c7 ,!     
,f$]al ,gov]nm5t1 across multiple       
presid5tial adm9i/rations & ,congresses1
 has cont9u$ to support ! ability (     
ag5cies to move to ! cl\d1 includ+      
?r\gh-- 7,a7 ,presid5t ,b>ack ,obama's  
,cl\d ,fir/ ,/rategy2  7,b7 ,presid5t   
,donald ,trump's ,cl\d ,sm>t ,/rategy2  
7,c7 ! prioritization ( cl\d security 9 
,executive ,ord] #adbjh 7#hf ,f$4 ,reg4 
#bffcc2 relat+ to improv+ ! ,nation's   
cyb]security71 :i* 0 issu$ by ,presid5t 
,joe ,bid52 &  7,d7 m ?an a decade (    
appropriations & au?orization           
legislation t provides ag5cies )        
relevant au?orities & appropriations to 
mod]nize on-premises in=mation te*nology
 sy/ems & m readily adopt cl\d comput+  
products & s]vices4  7#d7 ,s9ce x 0     
creat$ 9 #bjaa1 ! ,f$]al ,risk &        
,au?orization ,managem5t ,program       

7ref]r$ to 9 ?is section z ,fed,r,a,m,p7
 at ! ,g5]al ,s]vices ,adm9i/ration has 
made /eady & su/a9$ improvem5ts 9       
support+ ! secure au?orization & reuse (
 cl\d comput+ products & s]vices )9 !   
,f$]al ,gov]nm5t1 includ+ by r$uc+ !    
co/s & burd5s on bo? ag5cies & cl\d     
companies to quickly & securely ent] !  
,f$]al m>ket4  7#e7 ,accord+ to data f !
 ,g5]al ,s]vices ,adm9i/ration1 z ( !   
end ( fiscal ye> #bjba1 !re 7 #bci cl\d 
provid]s ) ,fed,r,a,m,p au?orizations1 &
 ^? au?orizations _h be5 reus$ m ?an    
#b1gjj times across v>i\s ag5cies4  7#f7
 ,provid+ a legislative framework =     
,fed,r,a,m,p & new au?orities to !      
,g5]al ,s]vices ,adm9i/ration1 ! ,(fice 
( ,managem5t & ,budget1 & ,f$]al ag5cies
 w-- 7,a7 improve ! spe$ at :i* new cl\d
 comput+ products & s]vices c be        
securely au?oriz$2  7,b7 enhance !      
ability ( ag5cies to effectively        
evaluate ,fed,r,a,m,p au?oriz$ provid]s 
= reuse2  7,c7 r$uce ! co/s & burd5s to 
cl\d provid]s seek+ a ,fed,r,a,m,p      

au?orization2 &  7,d7 provide = m robu/ 
transp>5cy & dialogue betwe5 indu/ry & !
 ,f$]al ,gov]nm5t to drive /rong]       
adoption ( secure cl\d capabilities1    
create jobs1 & r$uce wa/eful legacy     
in=mation te*nology4  #c4 ,title #dd    
am5dm5ts  7a7 ,am5dm5t ,*apt] #cf (     
title #dd1 ,unit$ ,/ates ,code1 is am5d$
 by add+ at ! end ! foll[+3  #cfjg4     
,def9itions  7a7 ,9 g5]al ,except z     
provid$ "u subsection 7b71 ! def9itions 
"u sections #cejb & #ceeb apply to ?is  
section ?r\gh section #cfaf4  7b7       
,additional def9itions ,9 ?is section   
?r\gh section #cfaf3 7#a7 ,cl\d comput+ 
,! t]m cl\d comput+ has ! mean+ giv5 !  
t]m 9 ,special ,publication #hjj-ade ( !
 ,national ,in/itute ( ,/&>ds &         
,te*nology4  7#b7 ,cl\d s]vice provid]  
,! t]m cl\d s]vice provid] means an     
entity (f]+ cl\d comput+ products or    
s]vices to ag5cies4  7#c7 ,fed,r,a,m,p  
,! t]m ,fed,r,a,m,p means ! ,f$]al ,risk
 & ,au?orization ,managem5t ,program    
e/abli%$ "u section #cfjh4  7#d7        

,fed,r,a,m,p au?orization ,! t]m        
,fed,r,a,m,p au?orization means a       
c]tification t a cl\d comput+ product or
 s]vice has-- 7,a7 complet$ a           
,fed,r,a,m,p au?orization process1 z    
det]m9$ by ! ,adm9i/rator ( ,g5]al      
,s]vices2 or  7,b7 receiv$ a            
,fed,r,a,m,p provisional au?orization to
 op]ate1 z det]m9$ by ! ,fed,r,a,m,p    
,bo>d4  7#e7 ,fed,r,a,m,p au?orization  
package ,! t]m ,fed,r,a,m,p au?orization
 package means ! ess5tial in=mation t c 
be us$ by an ag5cy to det]m9e :e!r to   
au?orize ! op]ation ( an in=mation sy/em
 or ! use ( a designat$ set ( common    
controls = all cl\d comput+ products &  
s]vices au?oriz$ by ,fed,r,a,m,p4  7#f7 
,fed,r,a,m,p ,bo>d ,! t]m ,fed,r,a,m,p  
,bo>d means ! bo>d e/abli%$ "u section  
#cfaj4  7#g7 ,indep5d5t assessm5t       
organization ,! t]m indep5d5t assessm5t 
organization means a ?ird-p>ty          
organization accr$it$ by ! ,adm9i/rator 
( ,g5]al ,s]vices to und]take con=mity  
assessm5ts ( cl\d s]vice provid]s & _!  

products or s]vices4  7#h7 ,secret>y ,! 
t]m ,secret>y means ! ,secret>y (       
,homel& ,security4  #cfjh4 ,f$]al ,risk 
& ,au?orization ,managem5t ,program ,!re
 is e/abli%$ )9 ! ,g5]al ,s]vices       
,adm9i/ration ! ,f$]al ,risk &          
,au?orization ,managem5t ,program4 ,!   
,adm9i/rator ( ,g5]al ,s]vices1 subject 
to section #cfac1 %all e/abli% a        
,gov]nm5t-wide program t provides a     
/&>diz$1 reusable approa* to security   
assessm5t & au?orization = cl\d comput+ 
products & s]vices t process unclassifi$
 in=mation us$ by ag5cies4  #cfji4      
,roles & responsibilities ( ! ,g5]al    
,s]vices ,adm9i/ration  7a7 ,roles &    
responsibilities ,! ,adm9i/rator (      
,g5]al ,s]vices %all-- 7#a7 9           
consultation ) ! ,secret>y1 develop1    
coord9ate1 & implem5t a process to      
support ag5cy review1 reuse1 &          
/&>dization1 :]e appropriate1 ( security
 assessm5ts ( cl\d comput+ products &   
s]vices1 includ+1 z appropriate1        
ov]sight ( cont9u\s monitor+ ( cl\d     

comput+ products & s]vices1 pursuant to 
guidance issu$ by ! ,director pursuant  
to section #cfac2  7#b7 e/abli%         
processes & id5tify crit]ia consi/5t )  
guidance issu$ by ! ,director "u section
 #cfac to make a cl\d comput+ product or
 s]vice eligible = a ,fed,r,a,m,p       
au?orization & validate :e!r a cl\d     
comput+ product or s]vice has a         
,fed,r,a,m,p au?orization2  7#c7 develop
 & publi% templates1 be/ practices1     
te*nical assi/ance1 & o!r mat]ials to   
support ! au?orization ( cl\d comput+   
products & s]vices & increase ! spe$1   
effectiv5ess1 & transp>5cy ( !          
au?orization process1 consi/5t ) /&>ds  
e/abli%$ by ! ,director ( ! ,national   
,in/itute ( ,/&>ds & ,te*nology &       
relevant /atutes2  7#d7 grant           
,fed,r,a,m,p au?orizations to cl\d      
comput+ products & s]vices consi/5t ) ! 
guidance & direction ( ! ,fed,r,a,m,p   
,bo>d2  7#e7 e/abli% & ma9ta9 a public  
comm5t process = propos$ guidance & o!r 
,fed,r,a,m,p directives t may h a direct

 impact on cl\d s]vice provid]s &       
ag5cies be=e ! issuance ( su* guidance  
or o!r ,fed,r,a,m,p directives2  7#f7   
coord9ate ) ! ,fed,r,a,m,p ,bo>d1 !     
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy1 & o!r  
entities id5tifi$ by ! ,adm9i/rator (   
,g5]al ,s]vices1 ) ! concurr5ce ( !     
,director & ! ,secret>y1 to e/abli% &   
regul>ly update a framework = cont9u\s  
monitor+ "u section #ceec2  7#g7 provide
 a secure me*anism = /or+ & %>+ necess>y
 data1 includ+ ,fed,r,a,m,p au?orization
 packages1 to enable bett] reuse ( su*  
packages across ag5cies1 includ+ mak+   
available any in=mation & data necess>y 
= ag5cies to fulfill ! requirem5ts (    
section #cfab2  7#h7 provide regul>     
updates to applicant cl\d s]vice        
provid]s on ! /atus ( any cl\d comput+  
product or s]vice dur+ an assessm5t     
process2  7#i7 regul>ly review1 9       
consultation ) ! ,fed,r,a,m,p ,bo>d1 !  
co/s associat$ ) ! indep5d5t assessm5t  
s]vices ( ! ?ird-p>ty organizations     

describ$ 9 section #cfaa2  7#aj7 support
 ! ,f$]al ,secure ,cl\d ,advisory       
,committee e/abli%$ pursuant to section 
#cfaf2 &  7#aa7 take su* o!r actions z !
 ,adm9i/rator ( ,g5]al ,s]vices may     
det]m9e necess>y to c>ry out            
,fed,r,a,m,p4  7b7 ,website  7#a7 ,9    
g5]al ,! ,adm9i/rator ( ,g5]al ,s]vices 
%all ma9ta9 a public website to s]ve z !
 au?oritative repository = ,fed,r,a,m,p1
 includ+ ! timely publication & updates 
= all relevant in=mation1 guidance1     
det]m9ations1 & o!r mat]ials requir$ "u 
subsection 7a74  7#b7 ,crit]ia & process
 = ,fed,r,a,m,p au?orization priorities 
,! ,adm9i/rator ( ,g5]al ,s]vices %all  
develop & make publicly available on !  
website describ$ 9 p>agraph 7#a7 !      
crit]ia & process = prioritiz+ & select+
 cl\d comput+ products & s]vices t w    
receive a ,fed,r,a,m,p au?orization1 9  
consultation ) ! ,fed,r,a,m,p ,bo>d & ! 
,*ief ,in=mation ,(fic]s ,c\ncil4  7c7  
,evaluation ( automation proc$ures  7#a7
 ,9 g5]al ,! ,adm9i/rator ( ,g5]al      

,s]vices1 9 coord9ation ) ! ,secret>y1  
%all assess & evaluate available        
automation capabilities & proc$ures to  
improve ! effici5cy & effectiv5ess ( !  
issuance ( ,fed,r,a,m,p au?orizations1  
includ+ cont9u\s monitor+ ( cl\d comput+
 products & s]vices4  7#b7 ,means =     
automation ,n lat] ?an #a ye> aft] !    
date ( enactm5t ( ?is section1 & updat$ 
regul>ly !reaft]1 ! ,adm9i/rator (      
,g5]al ,s]vices %all e/abli% a means = !
 automation ( security assessm5ts &     
reviews4  7d7 ,metrics = au?orization ,!
 ,adm9i/rator ( ,g5]al ,s]vices %all    
e/abli% annual metrics reg>d+ ! "t &    
quality ( ! assessm5ts necess>y =       
completion ( a ,fed,r,a,m,p au?orization
 process 9 a mann] t c be consi/5tly    
track$ ov] "t 9 conjunction ) ! p]iodic 
te/+ & evaluation process pursuant to   
section #ceed 9 a mann] t m9imizes !    
ag5cy report+ burd54  #cfaj4            
,fed,r,a,m,p ,bo>d  7a7 ,e/abli%m5t ,!re
 is e/abli%$ a ,fed,r,a,m,p ,bo>d to    
provide input & recomm5dations to !     

,adm9i/rator ( ,g5]al ,s]vices reg>d+ ! 
requirem5ts & guidel9es =1 & !          
prioritization (1 security assessm5ts ( 
cl\d comput+ products & s]vices4  7b7   
,memb]%ip ,! ,fed,r,a,m,p ,bo>d %all    
consi/ ( n m ?an #g s5ior (ficials or   
exp]ts f ag5cies appo9t$ by ! ,director1
 9 consultation ) ! ,adm9i/rator (      
,g5]al ,s]vices1 f ea* ( ! foll[+3 7#a7 
,! ,dep>tm5t ( ,def5se4  7#b7 ,!        
,dep>tm5t ( ,homel& ,security4  7#c7 ,! 
,g5]al ,s]vices ,adm9i/ration4  7#d7    
,su* o!r ag5cies z det]m9$ by !         
,director1 9 consultation ) !           
,adm9i/rator ( ,g5]al ,s]vices4  7c7    
,qualifications ,memb]s ( ! ,fed,r,a,m,p
 ,bo>d appo9t$ "u subsection 7b7 %all h 
te*nical exp]tise 9 doma9s relevant to  
,fed,r,a,m,p1 su* z-- 7#a7 cl\d comput+2
  7#b7 cyb]security2  7#c7 privacy2     
7#d7 risk managem5t2 &  7#e7 o!r        
compet5cies id5tifi$ by ! ,director to  
support ! secure au?orization ( cl\d    
s]vices & products4  7d7 ,duties ,!     
,fed,r,a,m,p ,bo>d %all-- 7#a7 9        

consultation ) ! ,adm9i/rator ( ,g5]al  
,s]vices1 s]ve z a res\rce = be/        
practices to accel]ate ! process =      
obta9+ a ,fed,r,a,m,p au?orization2     
7#b7 e/abli% & regul>ly update          
requirem5ts & guidel9es = security      
au?orizations ( cl\d comput+ products & 
s]vices1 consi/5t ) /&>ds e/abli%$ by ! 
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology1 to be us$ 9 !      
det]m9ation ( ,fed,r,a,m,p              
au?orizations2  7#c7 monitor & ov]see1  
to ! greate/ ext5t practicable1 !       
processes & proc$ures by :i* ag5cies    
det]m9e & validate requirem5ts = a      
,fed,r,a,m,p au?orization1 includ+      
p]iodic review ( ! ag5cy det]m9ations   
describ$ 9 section #cfab7;b72  7#d7     
ensure consi/5cy & transp>5cy betwe5    
ag5cies & cl\d s]vice provid]s 9 a mann]
 t m9imizes confusion & eng5d]s tru/2 & 
7#e7 p]=m su* o!r roles &               
responsibilities z ! ,director may      
assign1 ) concurr5ce f ! ,adm9i/rator ( 
,g5]al ,s]vices4  7e7 ,det]m9ations (   

dem& = cl\d comput+ products & s]vices  
,! ,fed,r,a,m,p ,bo>d may consult ) !   
,*ief ,in=mation ,(fic]s ,c\ncil to     
e/abli% a process1 :i* may be made      
available on ! website ma9ta9$ "u       
section #cfji7;b71 = prioritiz+ &       
accept+ ! cl\d comput+ products &       
s]vices to be grant$ a ,fed,r,a,m,p     
au?orization4  #cfaa4 ,indep5d5t        
assessm5t organizations  7a7            
,requirem5ts = accr$itation ,!          
,adm9i/rator ( ,g5]al ,s]vices may1     
consi/5t ) guidance issu$ by !          
,director1 det]m9e ! requirem5ts =      
accr$itation ( a ?ird-p>ty organization 
to p]=m indep5d5t assessm5ts & o!r      
activities t w improve ! ov]all p]=mance
 ( ,fed,r,a,m,p & r$uce ! co/ (         
,fed,r,a,m,p au?orizations = cl\d s]vice
 provid]s4 ,su* requirem5ts may include 
develop+ or requir+ c]tification        
programs = individuals employ$ by !     
?ird-p>ty organization seek+            
accr$itation4  7b7 ,c]tification ,!     
,adm9i/rator ( ,g5]al ,s]vices may      

accr$it any ?ird-p>ty organization t    
meets ! requirem5ts = accr$itation      
det]m9$ "u subsection 7a74 ,if accr$it$ 
pursuant to ! requirem5ts det]m9$ "u    
subsection 7a71 a c]tifi$ indep5d5t     
assessm5t organization may assess1      
validate1 & atte/ to ! quality &        
compliance ( security assessm5t mat]ials
 provid$ by cl\d s]vice provid]s4       
#cfab4 ,roles & responsibilities (      
ag5cies  7a7 ,9 g5]al ,9 implem5t+ !    
requirem5ts ( ,fed,r,a,m,p1 ! head ( ea*
 ag5cy %all1 consi/5t ) guidance issu$  
by ! ,director pursuant to section      
#cfac-- 7#a7 promote ! use ( cl\d       
comput+ products & s]vices t meet       
,fed,r,a,m,p security requirem5ts & o!r 
risk-bas$ p]=mance requirem5ts z det]m9$
 by ! ,director1 9 consultation ) !     
,secret>y2  7#b7 confirm :e!r !re is a  
,fed,r,a,m,p au?orization 9 ! secure    
me*anism provid$ "u section             
#cfji7;a77#g7 be=e beg9n+ ! process (   
grant+ a ,fed,r,a,m,p au?orization = a  
cl\d comput+ product or s]vice2  7#c7 to

 ! ext5t practicable1 = any cl\d comput+
 product or s]vice ! ag5cy seeks to     
au?orize t has receiv$ a ,fed,r,a,m,p   
au?orization1 use ! exi/+ assessm5ts (  
security controls & mat]ials )9 !       
,fed,r,a,m,p au?orization package2 &    
7#d7 provide data & in=mation requir$ to
 ! ,director pursuant to section #cfac  
to det]m9e h[ ag5cies are meet+ metrics 
e/abli%$ by ! ,adm9i/rator ( ,g5]al     
,s]vices4  7b7 ,atte/ation ,^u complet+ 
an assessm5t or au?orization activity ) 
respect to a p>ticul> cl\d comput+      
product or s]vice1 if an ag5cy det]m9es 
t ! in=mation & data ! ag5cy has review$
 "u p>agraph 7#b7 or 7#c7 ( subsection  
7a7 is :olly or sub/antially defici5t = 
! purposes ( p]=m+ an au?orization ( !  
cl\d comput+ product or s]vice1 ! head (
 ! ag5cy %all docum5t z "p ( ! result+  
,fed,r,a,m,p au?orization package !     
reasons = ?is det]m9ation4  7c7         
,submission ( au?orizations ,to op]ate  
requir$ ,^u issuance ( an ag5cy         
au?orization to op]ate bas$ on a        

,fed,r,a,m,p au?orization1 ! head ( !   
ag5cy %all provide a copy ( its         
au?orization to op]ate lett] & any      
supplem5t>y in=mation requir$ pursuant  
to section #cfji7;a7 to ! ,adm9i/rator (
 ,g5]al ,s]vices4  7d7 ,submission (    
policies requir$ ,n lat] ?an #ahj days  
aft] ! date on :i* ! ,director issues   
guidance 9 accordance ) section #cfac1 !
 head ( ea* ag5cy1 act+ ?r\gh ! ag5cy   
*ief in=mation (fic] ( ! ag5cy1 %all    
submit to ! ,director all ag5cy policies
 relat+ to ! au?orization ( cl\d comput+
 products & s]vices4  7e7 ,presumption (
 adequacy  7#a7 ,9 g5]al ,! assessm5t ( 
security controls & mat]ials )9 !       
au?orization package = a ,fed,r,a,m,p   
au?orization %all be presum$ adequate = 
use 9 an ag5cy au?orization to op]ate   
cl\d comput+ products & s]vices4  7#b7  
,in=mation security requirem5ts ,!      
presumption "u p>agraph 7#a7 does n     
modify or alt]-- 7,a7 ! responsibility (
 any ag5cy to ensure compliance )       
sub*apt] ,,ii ( *apt] #ce = any cl\d    

comput+ products or s]vices us$ by !    
ag5cy2 or  7,b7 ! au?ority ( ! head (   
any ag5cy to make a det]m9ation t !re is
 a demon/rable ne$ = additional security
 requirem5ts beyond ! security          
requirem5ts includ$ 9 a ,fed,r,a,m,p    
au?orization = a p>ticul> control       
implem5tation4  #cfac4 ,roles &         
responsibilities ( ! ,(fice ( ,managem5t
 & ,budget  7a7 ,roles &                
responsibilities ,! ,director %all--    
7#a7 9 consultation ) ! ,adm9i/rator (  
,g5]al ,s]vices & ! ,secret>y1 issue    
guidance t-- 7,a7 specifies ! categories
 or *>act]i/ics ( cl\d comput+ products 
& s]vices t are )9 ! scope (            
,fed,r,a,m,p2  7,b7 includes requirem5ts
 = ag5cies to obta9 a ,fed,r,a,m,p      
au?orization :5 op]at+ a cl\d comput+   
product or s]vice describ$ 9 subp>agraph
 7,a7 z a ,f$]al in=mation sy/em2 &     
7,c7 encompasses1 to ! greate/ ext5t    
practicable1 all necess>y & appropriate 
cl\d comput+ products & s]vices2  7#b7  
issue guidance describ+ additional      

responsibilities ( ,fed,r,a,m,p & !     
,fed,r,a,m,p ,bo>d to accel]ate !       
adoption ( secure cl\d comput+ s]vices  
by ! ,f$]al ,gov]nm5t2  7#c7 ov]see !   
effectiv5ess ( ,fed,r,a,m,p & !         
,fed,r,a,m,p ,bo>d1 includ+ ! compliance
 by ! ,fed,r,a,m,p ,bo>d ) ! duties     
describ$ 9 section #cfaj7;d72 &  7#d7 to
 ! greate/ ext5t practicable1 enc\rage &
 promote consi/5cy ( ! assessm5t1       
au?orization1 adoption1 & use ( cl\d    
comput+ products & s]vices )9 & across  
ag5cies4  #cfad4 ,au?orization (        
appropriations = ,fed,r,a,m,p ,!re is   
au?oriz$ to be appropriat$ to !         
,adm9i/rator ( ,g5]al ,s]vices          
#bj1jjj1jjj = ea* fiscal ye> =          
,fed,r,a,m,p & ! ,fed,r,a,m,p ,bo>d4    
#cfae4 ,reports to congress2 ,,gao      
report  7a7 ,reports to congress ,n lat]
 ?an #a ye> aft] ! date ( enactm5t ( ?is
 section1 & annually !reaft]1 !         
,director %all submit to ! ,committee on
 ,ov]sight & ,re=m ( ! ,h\se (          
,repres5tatives & ! ,committee on       

,homel& ,security & ,gov]nm5tal ,affairs
 ( ! ,s5ate a report t includes !       
foll[+3 7#a7 ,dur+ ! prec$+ ye>1 !      
/atus1 effici5cy1 & effectiv5ess ( !    
,g5]al ,s]vices ,adm9i/ration "u section
 #cfji & ag5cies "u section #cfab & 9   
support+ ! spe$1 effectiv5ess1 %>+1     
reuse1 & security ( au?orizations to    
op]ate = cl\d comput+ products &        
s]vices4  7#b7 ,progress t[>ds meet+ !  
metrics requir$ "u section #cfji7;d74   
7#c7 ,data on ,fed,r,a,m,p              
au?orizations4  7#d7 ,! av]age l5g? ( "t
 to issue ,fed,r,a,m,p au?orizations4   
7#e7 ,! numb] ( ,fed,r,a,m,p            
au?orizations submitt$1 issu$1 & d5i$ = 
! prec$+ ye>4  7#f7 ,a review ( progress
 made dur+ ! prec$+ ye> 9 advanc+       
automation te*niques to securely        
automate ,fed,r,a,m,p processes & to    
accel]ate report+ "u ?is section4  7#g7 
,! numb] & *>act]i/ics ( au?oriz$ cl\d  
comput+ products & s]vices 9 use at ea* 
ag5cy consi/5t ) guidance provid$ by !  
,director "u section #cfac4  7b7 ,,gao  

report ,n lat] ?an #ahj days aft] ! date
 ( enactm5t ( ?is section1 ! ,comptroll]
 ,g5]al ( ! ,unit$ ,/ates %all publi% a 
report t includes an assessm5t ( !      
foll[+3 7#a7 ,! co/s incurr$ by ag5cies 
& cl\d s]vice provid]s relat+ to !      
issuance ( ,fed,r,a,m,p au?orizations4  
7#b7 ,! ext5t to :i* ag5cies h processes
 9 place to cont9u\sly monitor cl\d     
comput+ products & s]vices op]at+ z     
,f$]al in=mation sy/ems4  7#c7 ,h[ (t5 &
 = :i* categories ( products ag5cies use
 ,fed,r,a,m,p au?orizations4  7#d7 ,!   
unique co/s & pot5tial burd5s incurr$ by
 cl\d comput+ companies t are small     
bus9ess conc]ns 7z def9$ 9 section      
#c7;a7 ( ! ,small ,bus9ess ,act 7#ae    
,u4,s4,c4 #fcb7;a777 z a "p ( !         
,fed,r,a,m,p au?orization process4      
#cfaf4 ,f$]al ,secure ,cl\d ,advisory   
,committee  7a7 ,e/abli%m5t1 purposes1 &
 duties  7#a7 ,e/abli%m5t ,!re is       
e/abli%$ a ,f$]al ,secure ,cl\d         
,advisory ,committee 7ref]r$ to 9 ?is   
section z ! ,committee7 to ensure       

effective & ongo+ coord9ation ( ag5cy   
adoption1 use1 au?orization1 monitor+1  
acquisition1 & security ( cl\d comput+  
products & s]vices to enable ag5cy      
mission & adm9i/rative priorities4  7#b7
 ,purposes ,! purposes ( ! ,committee   
are ! foll[+3 7,a7 ,to exam9e !         
op]ations ( ,fed,r,a,m,p & det]m9e ways 
t au?orization processes c cont9u\sly be
 improv$1 includ+ ! foll[+3 7i7         
,measures to increase ag5cy reuse (     
,fed,r,a,m,p au?orizations4  7ii7       
,propos$ actions t c be adopt$ to r$uce 
! burd51 confusion1 & co/ associat$ )   
,fed,r,a,m,p au?orizations = cl\d s]vice
 provid]s4  7iii7 ,measures to increase 
! numb] ( ,fed,r,a,m,p au?orizations =  
cl\d comput+ s]vices (f]$ by small      
bus9esses conc]ns 7z def9$ by section   
#c7;a7 ( ! ,small ,bus9ess ,act 7#ae    
,u4,s4,c4 #fcb7;a7774  7iv7 ,propos$    
actions t c be adopt$ to r$uce ! burd5 &
 co/ ( ,fed,r,a,m,p au?orizations =     
ag5cies4  7,b7 ,collect in=mation &     
fe$back on ag5cy compliance ) &         

implem5tation ( ,fed,r,a,m,p            
requirem5ts4  7,c7 ,s]ve z a =um t      
facilitates communication &             
collaboration among ! ,fed,r,a,m,p      
/akehold] community4  7#c7 ,duties ,!   
duties ( ! ,committee include provid+   
advice & recomm5dations to !            
,adm9i/rator ( ,g5]al ,s]vices1 !       
,fed,r,a,m,p ,bo>d1 & ag5cies on        
te*nical1 f9ancial1 programmatic1 &     
op]ational matt]s reg>d+ secure adoption
 ( cl\d comput+ products & s]vices4  7b7
 ,memb]s  7#a7 ,composition ,!          
,committee %all be compris$ ( n m ?an   
#ae memb]s :o are qualifi$              
repres5tatives f ! public & private     
sectors1 appo9t$ by ! ,adm9i/rator (    
,g5]al ,s]vices1 9 consultation ) !     
,director1 z foll[s3 7,a7 ,!            
,adm9i/rator ( ,g5]al ,s]vices or !     
,adm9i/rator ( ,g5]al ,s]vices's        
designee1 :o %all be ! ,*air ( !        
,committee4  7,b7 ,at lea/ #a           
repres5tative ea* f ! ,cyb]security &   
,infra/ructure ,security ,ag5cy & !     

,national ,in/itute ( ,/&>ds &          
,te*nology4  7,c7 ,at lea/ #b (ficials  
:o s]ve z ! ,*ief ,in=mation ,security  
,(fic] )9 an ag5cy1 :o %all be requir$  
to ma9ta9 su* a position ?r\gh\t !      
duration ( _! s]vice on ! ,committee4   
7,d7 ,at lea/ #a (ficial s]v+ z ,*ief   
,procurem5t ,(fic] 7or equival5t7 9 an  
ag5cy1 :o %all be requir$ to ma9ta9 su* 
a position ?r\gh\t ! duration ( _!      
s]vice on ! ,committee4  7,e7 ,at lea/  
#a individual repres5t+ an indep5d5t    
assessm5t organization4  7,f7 ,no few]  
?an #e repres5tatives f unique bus9esses
 t prim>ily provide cl\d comput+ s]vices
 or products1 includ+ at lea/ two       
repres5tatives f a small bus9ess conc]n 
7z def9$ by section #c7;a7 ( ! ,small   
,bus9ess ,act 7#ae ,u4,s4,c4 #fcb7;a7774
  7,g7 ,at lea/ #b o!r repres5tatives ( 
! ,f$]al ,gov]nm5t z ! ,adm9i/rator (   
,g5]al ,s]vices det]m9es necess>y to    
provide suffici5t balance1 insights1 or 
exp]tise to ! ,committee4  7#b7 ,deadl9e
 = appo9tm5t ,ea* memb] ( ! ,committee  

%all be appo9t$ n lat] ?an #ij days aft]
 ! date ( enactm5t ( ?is section4  7#c7 
,p]iod ( appo9tm5t2 vacancies  7,a7 ,9  
g5]al ,ea* non-,f$]al memb] ( !         
,committee %all be appo9t$ = a t]m ( #c 
ye>s1 except t ! initial t]ms = memb]s  
may be /agg]$ #a-1 #b-1 or #c-ye> t]ms  
to e/abli% a rotation 9 :i* "o-?ird ( ! 
memb]s are select$ ea* ye>4 ,any su*    
memb] may be appo9t$ = n m ?an #b       
consecutive t]ms4  7,b7 ,vacancies ,any 
vacancy 9 ! ,committee %all n affect its
 p[]s1 b %all be fill$ 9 ! same mann] 9 
:i* ! orig9al appo9tm5t 0 made4 ,any    
memb] appo9t$ to fill a vacancy occurr+ 
be=e ! expiration ( ! t]m = :i* !       
memb]'s pr$ecessor 0 appo9t$ %all be    
appo9t$ only = ! rema9d] ( t t]m4 ,a    
memb] may s]ve aft] ! expiration ( t    
memb]'s t]m until a successor has tak5  
(fice4  7c7 ,meet+s & rules ( proc$ures 
7#a7 ,meet+s ,! ,committee %all hold n  
few] ?an #c meet+s 9 a cal5d> ye>1 at   
su* "t & place z det]m9$ by ! ,*air4    
7#b7 ,initial meet+ ,n lat] ?an #abj    

days aft] ! date ( enactm5t ( ?is       
section1 ! ,committee %all meet & beg9 !
 op]ations ( ! ,committee4  7#c7 ,rules 
( proc$ure ,! ,committee may e/abli%    
rules = ! conduct ( ! bus9ess ( !       
,committee if su* rules are n inconsi/5t
 ) ?is section or o!r applicable law4   
7d7 ,employee /atus  7#a7 ,9 g5]al ,a   
memb] ( ! ,committee 7o!r ?an a memb] :o
 is appo9t$ to ! ,committee 9 connection
 ) ano!r ,f$]al appo9tm5t7 %all n be    
consid]$ an employee ( ! ,f$]al         
,gov]nm5t by reason ( any s]vice z su* a
 memb]1 except = ! purposes ( section   
#egjc ( title #e1 relat+ to travel      
exp5ses4  7#b7 ,pay n p]mitt$ ,a memb] (
 ! ,committee cov]$ by p>agraph 7#a7 may
 n receive pay by reason ( s]vice on !  
,committee4  7e7 ,applicability to !    
f$]al advisory committee act ,section   
#ad ( ! ,f$]al ,advisory ,committee ,act
 7#e ,u4,s4,c4 ,app47 %all n apply to ! 
,committee4  7f7 ,detail ( employees    
,any ,f$]al ,gov]nm5t employee may be   
detail$ to ! ,committee )\t reimbursem5t

 f ! ,committee1 & su* detailee %all    
reta9 ! rights1 /atus1 & privileges ( 8 
or h] regul> employm5t )\t int]ruption4 
7g7 ,po/al s]vices ,! ,committee may use
 ! ,unit$ ,/ates mails 9 ! same mann] & 
"u ! same conditions z ag5cies4  7h7    
,reports  7#a7 ,int]im reports ,!       
,committee may submit to ! ,adm9i/rator 
( ,g5]al ,s]vices & ,congress int]im    
reports conta9+ su* f9d+s1 conclusions1 
& recomm5dations z h be5 agre$ to by !  
,committee4  7#b7 ,annual reports ,n    
lat] ?an #edj days aft] ! date (        
enactm5t ( ?is section1 & annually      
!reaft]1 ! ,committee %all submit to !  
,adm9i/rator ( ,g5]al ,s]vices &        
,congress a f9al report conta9+ su*     
f9d+s1 conclusions1 & recomm5dations z h
 be5 agre$ to by ! ,committee4  4  7b7  
,te*nical & con=m+ am5dm5t ,! table (   
sections = *apt] #cf ( title #dd1 ,unit$
 ,/ates ,code1 is am5d$ by add+ at ! end
 ! foll[+ new items3  #cfjg4            
,def9itions4 #cfjh4 ,f$]al ,risk &      
,au?orization ,managem5t ,program4      

#cfji4 ,roles & responsibilities ( !    
,g5]al ,s]vices ,adm9i/ration4 #cfaj4   
,fed,r,a,m,p ,bo>d4 #cfaa4 ,indep5d5t   
assessm5t organizations4 #cfab4 ,roles &
 responsibilities ( ag5cies4 #cfac4     
,roles & responsibilities ( ! ,(fice (  
,managem5t & ,budget4 #cfad4            
,au?orization ( appropriations =        
,fed,r,a,m,p4 #cfae4 ,reports to        
congress2 ,,gao report4 #cfaf4 ,f$]al   
,secure ,cl\d ,advisory ,committee4  4  
7c7 ,sunset  7#a7 ,9 g5]al ,effective on
 ! date t is #e ye>s aft] ! date (      
enactm5t ( ?is ,act1 *apt] #cf ( title  
#dd1 ,unit$ ,/ates ,code1 is am5d$ by   
/rik+ sections #cfjg ?r\gh #cfaf4  7#b7 
,con=m+ am5dm5t ,effective on ! date t  
is #e ye>s aft] ! date ( enactm5t ( ?is 
,act1 ! table ( sections = *apt] #cf (  
title #dd1 ,unit$ ,/ates ,code1 is am5d$
 by /rik+ ! items relat+ to sections    
#cfjg ?r\gh #cfaf4  7d7 ,rule (         
con/ruction ,no?+ 9 ?is section or any  
am5dm5t made by ?is section %all be     
con/ru$ z alt]+ or impair+ ! au?orities 

( ! ,director ( ! ,(fice ( ,managem5t & 
,budget or ! ,secret>y ( ,homel&        
,security "u sub*apt] ,,ii ( *apt] #ce (
 title #dd1 ,unit$ ,/ates ,code4