H.R. bills (117th Congress)
117th CONGRESS
1st Session
Received; read twice and referred to the Committee on Homeland Security and Governmental Affairs
To enhance the innovation, security, and availability of cloud computing products and services used in the Federal Government by establishing the Federal Risk and Authorization Management Program within the General Services Administration and by establishing a risk management, authorization, and continuous monitoring process to enable the Federal Government to leverage cloud computing products and services using a risk-based approach consistent with the Federal Information Security Modernization Act of 2014 and cloud-based operations, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the “Federal Risk and Authorization Management Program Authorization Act of 2021” or the “FedRAMP Authorization Act”.
SEC. 2. CODIFICATION OF THE FEDRAMP PROGRAM.
(a) Amendment.—Chapter 36 of title 44, United States Code, is amended by adding at the end the following new sections:
Ҥ 3607. Federal Risk and Authorization Management Program
“(a) Establishment.—There is established within the General Services Administration the Federal Risk and Authorization Management Program. The Administrator of General Services, in accordance with section 3612, shall establish a governmentwide program that provides the authoritative standardized approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies.
“(b) Components Of FedRAMP.—The Joint Authorization Board and the FedRAMP Program Management Office are established as components of FedRAMP.
Ҥ 3608. FedRAMP Program Management Office
“(a) GSA Duties.—
“(1) ROLES AND RESPONSIBILITIES.—The Administrator of General Services shall—
“(A) determine the categories and characteristics of cloud computing products and services that are within the jurisdiction of FedRAMP and that require a FedRAMP authorization or a FedRAMP provisional authorization;
“(B) develop, coordinate, and implement a process for the FedRAMP Program Management Office, the Joint Authorization Board, and agencies to review security assessments of cloud computing products and services pursuant to subsections (b) and (c) of section 3611, and appropriate oversight of continuous monitoring of cloud computing products and services; and
“(C) ensure the continuous improvement of FedRAMP.
“(2) IMPLEMENTATION.—The Administrator shall oversee the implementation of FedRAMP, including—
“(A) appointing a Program Director to oversee the FedRAMP Program Management Office;
“(B) hiring professional staff as may be necessary for the effective operation of the FedRAMP Program Management Office, and such other activities as are essential to properly perform critical functions;
“(C) entering into interagency agreements to detail personnel on a reimbursable or non-reimbursable basis to assist the FedRAMP Program Management Office and the Joint Authorization Board in discharging the responsibilities of the Office under this section; and
“(D) such other actions as the Administrator may determine necessary to carry out this section.
“(b) Duties.—The FedRAMP Program Management Office shall have the following duties:
“(1) Provide guidance to independent assessment organizations, validate the independent assessments, and apply the requirements and guidelines adopted in section 3609(c)(5).
“(2) Oversee and issue guidelines regarding the necessary requirements for accreditation of third-party organizations seeking to be awarded accreditation as independent assessment organizations, including qualifications, roles, and responsibilities of independent assessment organizations.
“(3) Develop templates and other materials to support the Joint Authorization Board and agencies in the authorization of cloud computing products and services to increase the speed, effectiveness, and transparency of the authorization process, consistent with standards defined by the National Institute of Standards and Technology.
“(4) Establish and maintain a public comment process for proposed guidance before the issuance of such guidance by FedRAMP.
“(5) Review any authorization to operate issued by an agency to determine if the authorization meets the requirements and guidelines adopted in section 3609(c)(5).