44 U.S.C. § 3609 — Roles and responsibilities of the General

Page 211 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3609 1 So in original. Probably should be ‘‘terms’’. § 3607. Definitions (a) IN GENERAL.—Except as provided under subsection (b), the definitions under sections 3502 and 3552 apply to this section through sec- tion 3616. (b) ADDITIONAL DEFINITIONS.—In this section through section 3616: (1) ADMINISTRATOR.—The term ‘‘Adminis- trator’’ means the Administrator of General Services. (2) APPROPRIATE CONGRESSIONAL COMMIT- TEES.—The term ‘‘appropriate congressional committees’’ means the Committee on Home- land Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives. (3) AUTHORIZATION TO OPERATE; FEDERAL IN- FORMATION.—The terms ‘‘authorization to op- erate’’ and ‘‘Federal information’’ have the meaning given those term 1 in Circular A–130 of the Office of Management and Budget enti- tled ‘‘Managing Information as a Strategic Re- source’’, or any successor document. (4) CLOUD COMPUTING.—The term ‘‘cloud computing’’ has the meaning given the term in Special Publication 800–145 of the National Institute of Standards and Technology, or any successor document. (5) CLOUD SERVICE PROVIDER.—The term ‘‘cloud service provider’’ means an entity of- fering cloud computing products or services to agencies. (6) FEDRAMP.—The term ‘‘FedRAMP’’ means the Federal Risk and Authorization Management Program established under sec- tion 3608. (7) FEDRAMP AUTHORIZATION.—The term ‘‘FedRAMP authorization’’ means a certifi- cation that a cloud computing product or serv- ice has— (A) completed a FedRAMP authorization process, as determined by the Adminis- trator; or (B) received a FedRAMP provisional au- thorization to operate, as determined by the FedRAMP Board. (8) FEDRAMP AUTHORIZATION PACKAGE.—The term ‘‘FedRAMP authorization package’’ means the essential information that can be used by an agency to determine whether to au- thorize the operation of an information sys- tem or the use of a designated set of common controls for all cloud computing products and services authorized by FedRAMP. (9) FEDRAMP BOARD.—The term ‘‘FedRAMP Board’’ means the board established under sec- tion 3610. (10) INDEPENDENT ASSESSMENT SERVICE.—The term ‘‘independent assessment service’’ means a third-party organization accredited by the Administrator to undertake conformity as- sessments of cloud service providers and the products or services of cloud service providers. (11) SECRETARY.—The term ‘‘Secretary’’ means the Secretary of Homeland Security. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3449.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries CHANGE OF NAME Committee on Oversight and Reform of House of Rep- resentatives changed to Committee on Oversight and Accountability of House of Representatives by House Resolution No. 5, One Hundred Eighteenth Congress, Jan. 9, 2023. EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION Pub. L. 117–263, div. E, title LIX, § 5921(e), Dec. 23, 2022, 136 Stat. 3458, provided that: ‘‘Nothing in this sec- tion [see Short Title of 2022 Amendment note set out under section 101 of this title] or any amendment made by this section shall be construed as altering or impair- ing the authorities of the Director of the Office of Man- agement and Budget or the Secretary of Homeland Se- curity under subchapter II of chapter 35 of title 44, United States Code.’’ § 3608. Federal risk and authorization manage- ment program There is established within the General Serv- ices Administration the Federal Risk and Au- thorization Management Program. The Admin- istrator, subject to section 3614, shall establish a Government-wide program that provides a standardized, reusable approach to security as- sessment and authorization for cloud computing products and services that process unclassified information used by agencies. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3450.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3609. Roles and responsibilities of the General Services Administration (a) ROLES AND RESPONSIBILITIES.—The Admin- istrator shall— (1) in consultation with the Secretary, de- velop, coordinate, and implement a process to support agency review, reuse, and standardiza- tion, where appropriate, of security assess- ments of cloud computing products and serv- Page 212 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3610 ices, including, as appropriate, oversight of continuous monitoring of cloud computing products and services, pursuant to guidance issued by the Director pursuant to section 3614; (2) establish processes and identify criteria consistent with guidance issued by the Direc- tor under section 3614 to make a cloud com- puting product or service eligible for a FedRAMP authorization and validate whether a cloud computing product or service has a FedRAMP authorization; (3) develop and publish templates, best prac- tices, technical assistance, and other mate- rials to support the authorization of cloud computing products and services and increase the speed, effectiveness, and transparency of the authorization process, consistent with standards and guidelines established by the Director of the National Institute of Stand- ards and Technology and relevant statutes; (4) establish and update guidance on the boundaries of FedRAMP authorization pack- ages to enhance the security and protection of Federal information and promote trans- parency for agencies and users as to which services are included in the scope of a FedRAMP authorization; (5) grant FedRAMP authorizations to cloud computing products and services consistent with the guidance and direction of the FedRAMP Board; (6) establish and maintain a public comment process for proposed guidance and other FedRAMP directives that may have a direct impact on cloud service providers and agencies before the issuance of such guidance or other FedRAMP directives; (7) coordinate with the FedRAMP Board, the Director of the Cybersecurity and Infrastruc- ture Security Agency, and other entities iden- tified by the Administrator, with the concur- rence of the Director and the Secretary, to es- tablish and regularly update a framework for continuous monitoring under section 3553; (8) provide a secure mechanism for storing and sharing necessary data, including FedRAMP authorization packages, to enable better reuse of such packages across agencies, including making available any information and data necessary for agencies to fulfill the requirements of section 3613; (9) provide regular updates to applicant cloud service providers on the status of any cloud computing product or service during an assessment process; (10) regularly review, in consultation with the FedRAMP Board— (A) the costs associated with the inde- pendent assessment services described in section 3611; and (B) the information relating to foreign in- terests submitted pursuant to section 3612; (11) in coordination with the Director, the Secretary, and other stakeholders, as appro- priate, determine the sufficiency of underlying requirements to identify and assess the prove- nance of the software in cloud services and products; (12) support the Federal Secure Cloud Advi- sory Committee established pursuant to sec- tion 3616; and (13) take such other actions as the Adminis- trator may determine necessary to carry out FedRAMP. (b) WEBSITE.— (1) IN GENERAL.—The Administrator shall maintain a public website to serve as the au- thoritative repository for FedRAMP, includ- ing the timely publication and updates for all relevant information, guidance, determina- tions, and other materials required under sub- section (a). (2) CRITERIA AND PROCESS FOR FEDRAMP AU- THORIZATION PRIORITIES.—The Administrator shall develop and make publicly available on the website described in paragraph (1) the cri- teria and process for prioritizing and selecting cloud computing products and services that will receive a FedRAMP authorization, in con- sultation with the FedRAMP Board and the Chief Information Officers Council. (c) EVALUATION OF AUTOMATION PROCEDURES.— (1) IN GENERAL.—The Administrator, in co- ordination with the Secretary, shall assess and evaluate available automation capabilities and procedures to improve the efficiency and effectiveness of the issuance of FedRAMP au- thorizations, including continuous monitoring of cloud computing products and services. (2) MEANS FOR AUTOMATION.—Not later than 1 year after the date of enactment of this sec- tion, and updated regularly thereafter, the Ad- ministrator shall establish a means for the au- tomation of security assessments and reviews. (d) METRICS FOR AUTHORIZATION.—The Admin- istrator shall establish annual metrics regarding the time and quality of the assessments nec- essary for completion of a FedRAMP authoriza- tion process in a manner that can be consist- ently tracked over time in conjunction with the periodic testing and evaluation process pursuant to section 3554 in a manner that minimizes the agency reporting burden. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3450.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Editorial Notes REFERENCES IN TEXT The date of enactment of this section, referred to in subsec. (c)(2), is the date of enactment of Pub. L. 117–263, which was approved Dec. 23, 2022. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3610. FedRAMP Board (a) ESTABLISHMENT.—There is established a FedRAMP Board to provide input and rec-