Browse Arkansas Code titles and sections
44 U.S.C. § 3608 — Federal risk and authorization management program
Federal law — U.S. Code and appendices · legal_authorities
There is established within the General Services Administration the Federal Risk and Authorization Management Program. The Administrator, subject to section 3614, shall establish a Government-wide program that provides a standardized, reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies.
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3608
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: b13f84029c212338584c1faa7f2c0db48290c0bc32e54878fffc80f229c7cee2. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_9b0edf6ac9bf9e6d1832b584
Source file: Laws/federal/codes/united-states-code/title-44/section-3608-federal-risk-and-authorization-management-program--03577e5610.md
Pages: Not recorded – Not recorded
Passage SHA-256: 508a6f77f45677944d2a48d14f0356bf89652b2decdac22c864068e03a3cb03c
Source location: Title 44, Chapter 36, § 3608; chapter-036-management-and-promotion-of-electronic-government-services.md
Stored source content
There is established within the General Services Administration the Federal Risk and Authorization Management Program. The Administrator, subject to section 3614, shall establish a Government-wide program that provides a standardized, reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In General.—** Except as provided under subsection (b), the definitions under sections 3502 and 3552 apply to this section through section 3616.
**(b) Additional Definitions.—** In this section through section 3616:
(1) **Administrator.—** — The term “Administrator” means the Administrator of General Services.
(2) **Appropriate congressional committees.—** — The term “appropriate congressional committees” means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives.
(3) **Authorization to operate; federal information.—** — The terms “authorization to operate” and “Federal information” have the meaning given those term 11 So in original. Probably should be “terms”. in Circular A–130 of the Office of Management and Budget entitled “Managing Information as a Strategic Resource”, or any successor document.
(4) **Cloud computing.—** — The term “cloud computing” has the meaning given the term in Special Publication 800–145 of the National Institute of Standards and Technology, or any successor document.
(5) **Cloud service provider.—** — The term “cloud service provider” means an entity offering cloud computing products or services to agencies.
(6) **FedRAMP.—** — The term “FedRAMP” means the Federal Risk and Authorization Management Program established under section 3608.
(7) **FedRAMP authorization.—** — The term “FedRAMP authorization” means a certification that a cloud computing product or service has—
(A) completed a FedRAMP authorization process, as determined by the Administrator; or
(B) received a FedRAMP provisional authorization to operate, as determined by the FedRAMP Board.
(8) **Fedramp authorization package.—** — The term “FedRAMP authorization packa
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3607
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Additional Responsibilities of Chief Information Officer of Department of Defense.—** In addition to the responsibilities provided for in chapter 35 of title 44 and in [section 11315 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11315&num=0&edition=prelim), the Chief Information Officer of the Department of Defense shall—
(1) review and provide recommendations to the Secretary of Defense on Department of Defense budget requests for information technology and national security systems;
(2) ensure the interoperability of information technology and national security systems throughout the Department of Defense;
(3) ensure that information technology and national security systems standards that will apply throughout the Department of Defense are prescribed;
(4) provide for the elimination of duplicate information technology and national security systems within and between the military departments and Defense Agencies; and
(5) maintain a consolidated inventory of Department of Defense mission critical and mission essential information systems, identify interfaces between those systems and other information systems, and develop and maintain contingency plans for responding to a disruption in the operation of any of those information systems.
**(b) Additional Responsibilities of Chief Information Officer of Military Departments.—** In addition to the responsibilities provided for in chapter 35 of title 44 and in [section 11315 of title 40](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title40-section11315&num=0&edition=prelim), the Chief Information Officer of a military department, with respect to the military department concerned, shall—
(1) review budget requests for all information technology and nation
Source: Supplied U.S. Code snapshot — release unconfirmed · 10 U.S.C. § 2223
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
**(a) Authority.—** The Secretary of Defense or the Secretary of a military department may engage in basic research, applied research, advanced research, and development projects that—
(1) are necessary to the responsibilities of such Secretary’s department in the field of research and development; and
(2) either—
(A) relate to weapon systems and other military needs; or
(B) are of potential interest to the Department of Defense.
**(b) Authorized Means.—** The Secretary of Defense or the Secretary of a military department may perform research and development projects—
(1) by contract, cooperative agreement, or grant, in accordance with chapter 63 of title 31;
(2) through one or more military departments;
(3) by using employees and consultants of the Department of Defense;
(4) by mutual agreement with the head of any other department or agency of the Federal Government;
(5) by transactions (other than contracts, cooperative agreements, and grants) entered into pursuant to section 4021 or 4022 of this title; or
(6) by purchases through procurement for experimental purposes pursuant to [section 4023 of this title](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title10-section4023&num=0&edition=prelim).
**(c) Requirement of Potential Department of Defense Interest.—** Funds appropriated to the Department of Defense or to a military department may not be used to finance any research project or study unless the project or study is, in the opinion of the Secretary of Defense or the Secretary of that military department, respectively, of potential interest to the Department of Defense or to such military department, respectively.
**(d) Additional Provisions Applicable to Cooperative Agreements.—** Additional authorities, conditions, and requiremen
Source: Supplied U.S. Code snapshot — release unconfirmed · 10 U.S.C. § 4001
Stored review status: release_metadata_unconfirmed. Incoming connection: Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 211
TITLE 44—PUBLIC PRINTING AND DOCUMENTS
§ 3609
1 So in original. Probably should be ‘‘terms’’.
§ 3607. Definitions
(a) IN
GENERAL.—Except as provided under
subsection (b), the definitions under sections
3502 and 3552 apply to this section through sec-
tion 3616.
(b) ADDITIONAL DEFINITIONS.—In this section
through section 3616:
(1) ADMINISTRATOR.—The term ‘‘Adminis-
trator’’ means the Administrator of General
Services.
(2)
APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional
committees’’ means the Committee on Home-
land Security and Governmental Affairs of the
Senate and the Committee on Oversight and
Reform of the House of Representatives.
(3) AUTHORIZATION TO OPERATE; FEDERAL IN-
FORMATION.—The terms ‘‘authorization to op-
erate’’ and ‘‘Federal information’’ have the
meaning given those term 1 in Circular A–130
of the Office of Management and Budget enti-
tled ‘‘Managing Information as a Strategic Re-
source’’, or any successor document.
(4) CLOUD
COMPUTING.—The term ‘‘cloud
computing’’ has the meaning given the term
in Special Publication 800–145 of the National
Institute of Standards and Technology, or any
successor document.
(5) CLOUD
SERVICE
PROVIDER.—The term
‘‘cloud service provider’’ means an entity of-
fering cloud computing products or services to
agencies.
(6)
FEDRAMP.—The
term
‘‘FedRAMP’’
means the Federal Risk and Authorization
Management Program established under sec-
tion 3608.
(7) FEDRAMP
AUTHORIZATION.—The term
‘‘FedRAMP authorization’’ means a certifi-
cation that a cloud computing product or serv-
ice has—
(A) completed a FedRAMP authorization
process, as determined by the Adminis-
trator; or
(B) received a FedRAMP provisional au-
thorization to operate, as determined by the
FedRAMP
Source: Supplied 2024 U.S. Code historical extraction · 44 U.S.C. § 3608
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.