Browse Arkansas Code titles and sections
44 U.S.C. § 3610 — FedRAMP Board
Federal law — U.S. Code and appendices · legal_authorities
**(a) Establishment.—** There is established a FedRAMP Board to provide input and recommendations to the Administrator regarding the requirements and guidelines for, and the prioritization of, security assessments of cloud computing products and services.
**(b) Membership.—** The FedRAMP Board shall consist of not more than 7 senior officials or experts from agencies appointed by the Director, in consultation with the Administrator, from each of the following:
(1) The Department of Defense.
(2) The Department of Homeland Security.
(3) The General Services Administration.
(4) Such other agencies as determined by the Director, in consultation with the Administrator.
**(c) Qualifications.—** Members of the FedRAMP Board appointed under subsection (b) shall have technical expertise in domains relevant to FedRAMP, such as—
(1) cloud computing;
(2) cybersecurity;
(3) privacy;
(4) risk management; and
(5) other competencies identified by the Director to support the secure authorization of cloud services and products.
**(d) Duties.—** The FedRAMP Board shall—
(1) in consultation with the Administrator, serve as a resource for best practices to accelerate the process for obtaining a FedRAMP authorization;
(2) establish and regularly update requirements and guidelines for security authorizations of cloud computing products and services, consistent with standards and guidelines established by the Director of the National Institute of Standards and Technology, to be used in the determination of FedRAMP authorizations;
(3) monitor and oversee, to the greatest extent practicable, the processes and procedures by which agencies determine and validate requirements for a FedRAMP authorization, including periodic review of the agency determinations described in section 3613
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3610
Stored review status: release_metadata_unconfirmed. A text match is a research starting point; applicability is not established.
Original supplied file — preserved unchanged
Download original Markdown file
File SHA-256: 3484e01997dbb2e459617e249d603b9f2f2bb415cc398f3a2584089f9d8cd878. The original may include catalog metadata, neighboring provisions, or embedded records outside this collection's scope. Search shows only the selected federal record. Historical editions and unverified snapshots are not a statement of current law.
Authority boundary: historical or unconfirmed source not current law verified.
Open the recorded source website ↗
Record provenance
Stable record: federal_law:legal_authorities:record_usc_edfdb73fefc2dc92a63eef77
Source file: Laws/federal/codes/united-states-code/title-44/section-3610-fedramp-board--f774a056fa.md
Pages: Not recorded – Not recorded
Passage SHA-256: a2cd03d3534121a96a32cce91d20b90a16af4cf60926946976f44f7eede6edd2
Source location: Title 44, Chapter 36, § 3610; chapter-036-management-and-promotion-of-electronic-government-services.md
Stored source content
**(a) Establishment.—** There is established a FedRAMP Board to provide input and recommendations to the Administrator regarding the requirements and guidelines for, and the prioritization of, security assessments of cloud computing products and services.
**(b) Membership.—** The FedRAMP Board shall consist of not more than 7 senior officials or experts from agencies appointed by the Director, in consultation with the Administrator, from each of the following:
(1) The Department of Defense.
(2) The Department of Homeland Security.
(3) The General Services Administration.
(4) Such other agencies as determined by the Director, in consultation with the Administrator.
**(c) Qualifications.—** Members of the FedRAMP Board appointed under subsection (b) shall have technical expertise in domains relevant to FedRAMP, such as—
(1) cloud computing;
(2) cybersecurity;
(3) privacy;
(4) risk management; and
(5) other competencies identified by the Director to support the secure authorization of cloud services and products.
**(d) Duties.—** The FedRAMP Board shall—
(1) in consultation with the Administrator, serve as a resource for best practices to accelerate the process for obtaining a FedRAMP authorization;
(2) establish and regularly update requirements and guidelines for security authorizations of cloud computing products and services, consistent with standards and guidelines established by the Director of the National Institute of Standards and Technology, to be used in the determination of FedRAMP authorizations;
(3) monitor and oversee, to the greatest extent practicable, the processes and procedures by which agencies determine and validate requirements for a FedRAMP authorization, including periodic review of the agency determinations described in section 3613(b);
(4) ensure consistency and transparency between agencies and cloud service providers in a manner that minimizes confusion and engenders trust; and
(5) perform such other roles and responsibilities as the Director may assign, with concurrence from the Administrator.
**(e) Determinations of Demand for Cloud Computing Products and Services.—** The FedRAMP Board may consult with the Chief Information Officers Council to establish a process, which may be made available on the website maintained under section 3609(b), for prioritizing and accepting the cloud computing products and services to be granted a FedRAMP authorization.
Cross-references
Connections may be documented source relationships, shared citations or nearby passages. Each explains its basis; a connection alone does not establish applicability to your situation.
Federal law — U.S. Code and appendices · legal_authorities
**(a) In General.—** Except as provided under subsection (b), the definitions under sections 3502 and 3552 apply to this section through section 3616.
**(b) Additional Definitions.—** In this section through section 3616:
(1) **Administrator.—** — The term “Administrator” means the Administrator of General Services.
(2) **Appropriate congressional committees.—** — The term “appropriate congressional committees” means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives.
(3) **Authorization to operate; federal information.—** — The terms “authorization to operate” and “Federal information” have the meaning given those term 11 So in original. Probably should be “terms”. in Circular A–130 of the Office of Management and Budget entitled “Managing Information as a Strategic Resource”, or any successor document.
(4) **Cloud computing.—** — The term “cloud computing” has the meaning given the term in Special Publication 800–145 of the National Institute of Standards and Technology, or any successor document.
(5) **Cloud service provider.—** — The term “cloud service provider” means an entity offering cloud computing products or services to agencies.
(6) **FedRAMP.—** — The term “FedRAMP” means the Federal Risk and Authorization Management Program established under section 3608.
(7) **FedRAMP authorization.—** — The term “FedRAMP authorization” means a certification that a cloud computing product or service has—
(A) completed a FedRAMP authorization process, as determined by the Administrator; or
(B) received a FedRAMP provisional authorization to operate, as determined by the FedRAMP Board.
(8) **Fedramp authorization package.—** — The term “FedRAMP authorization packa
Source: Supplied U.S. Code snapshot — release unconfirmed · 44 U.S.C. § 3607
Stored review status: release_metadata_unconfirmed. Explicit cross-reference supplied in source Markdown; currentness and applicability require review.
Federal law — U.S. Code and appendices · legal_authorities
Page 212
TITLE 44—PUBLIC PRINTING AND DOCUMENTS
§ 3610
ices, including, as appropriate, oversight of
continuous monitoring of cloud computing
products and services, pursuant to guidance
issued by the Director pursuant to section
3614;
(2) establish processes and identify criteria
consistent with guidance issued by the Direc-
tor under section 3614 to make a cloud com-
puting product or service eligible for a
FedRAMP authorization and validate whether
a cloud computing product or service has a
FedRAMP authorization;
(3) develop and publish templates, best prac-
tices, technical assistance, and other mate-
rials to support the authorization of cloud
computing products and services and increase
the speed, effectiveness, and transparency of
the authorization process, consistent with
standards and guidelines established by the
Director of the National Institute of Stand-
ards and Technology and relevant statutes;
(4) establish and update guidance on the
boundaries of FedRAMP authorization pack-
ages to enhance the security and protection of
Federal
information
and
promote
trans-
parency for agencies and users as to which
services are included in the scope of a
FedRAMP authorization;
(5) grant FedRAMP authorizations to cloud
computing products and services consistent
with the guidance and direction of the
FedRAMP Board;
(6) establish and maintain a public comment
process for proposed guidance and other
FedRAMP directives that may have a direct
impact on cloud service providers and agencies
before the issuance of such guidance or other
FedRAMP directives;
(7) coordinate with the FedRAMP Board, the
Director of the Cybersecurity and Infrastruc-
ture Security Agency, and other entities iden-
tified by the Administrator, with the concur-
rence o
Source: Supplied 2024 U.S. Code historical extraction · 44 U.S.C. § 3610
Stored review status: historical_2024_not_currentness_verified. Same stored citation; legal effect and authority still require review.