44 U.S.C. § 3608 — Federal risk and authorization manage-

Page 211 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3609 1 So in original. Probably should be ‘‘terms’’. § 3607. Definitions (a) IN GENERAL.—Except as provided under subsection (b), the definitions under sections 3502 and 3552 apply to this section through sec- tion 3616. (b) ADDITIONAL DEFINITIONS.—In this section through section 3616: (1) ADMINISTRATOR.—The term ‘‘Adminis- trator’’ means the Administrator of General Services. (2) APPROPRIATE CONGRESSIONAL COMMIT- TEES.—The term ‘‘appropriate congressional committees’’ means the Committee on Home- land Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives. (3) AUTHORIZATION TO OPERATE; FEDERAL IN- FORMATION.—The terms ‘‘authorization to op- erate’’ and ‘‘Federal information’’ have the meaning given those term 1 in Circular A–130 of the Office of Management and Budget enti- tled ‘‘Managing Information as a Strategic Re- source’’, or any successor document. (4) CLOUD COMPUTING.—The term ‘‘cloud computing’’ has the meaning given the term in Special Publication 800–145 of the National Institute of Standards and Technology, or any successor document. (5) CLOUD SERVICE PROVIDER.—The term ‘‘cloud service provider’’ means an entity of- fering cloud computing products or services to agencies. (6) FEDRAMP.—The term ‘‘FedRAMP’’ means the Federal Risk and Authorization Management Program established under sec- tion 3608. (7) FEDRAMP AUTHORIZATION.—The term ‘‘FedRAMP authorization’’ means a certifi- cation that a cloud computing product or serv- ice has— (A) completed a FedRAMP authorization process, as determined by the Adminis- trator; or (B) received a FedRAMP provisional au- thorization to operate, as determined by the FedRAMP Board. (8) FEDRAMP AUTHORIZATION PACKAGE.—The term ‘‘FedRAMP authorization package’’ means the essential information that can be used by an agency to determine whether to au- thorize the operation of an information sys- tem or the use of a designated set of common controls for all cloud computing products and services authorized by FedRAMP. (9) FEDRAMP BOARD.—The term ‘‘FedRAMP Board’’ means the board established under sec- tion 3610. (10) INDEPENDENT ASSESSMENT SERVICE.—The term ‘‘independent assessment service’’ means a third-party organization accredited by the Administrator to undertake conformity as- sessments of cloud service providers and the products or services of cloud service providers. (11) SECRETARY.—The term ‘‘Secretary’’ means the Secretary of Homeland Security. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3449.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries CHANGE OF NAME Committee on Oversight and Reform of House of Rep- resentatives changed to Committee on Oversight and Accountability of House of Representatives by House Resolution No. 5, One Hundred Eighteenth Congress, Jan. 9, 2023. EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION Pub. L. 117–263, div. E, title LIX, § 5921(e), Dec. 23, 2022, 136 Stat. 3458, provided that: ‘‘Nothing in this sec- tion [see Short Title of 2022 Amendment note set out under section 101 of this title] or any amendment made by this section shall be construed as altering or impair- ing the authorities of the Director of the Office of Man- agement and Budget or the Secretary of Homeland Se- curity under subchapter II of chapter 35 of title 44, United States Code.’’ § 3608. Federal risk and authorization manage- ment program There is established within the General Serv- ices Administration the Federal Risk and Au- thorization Management Program. The Admin- istrator, subject to section 3614, shall establish a Government-wide program that provides a standardized, reusable approach to security as- sessment and authorization for cloud computing products and services that process unclassified information used by agencies. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3450.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3609. Roles and responsibilities of the General Services Administration (a) ROLES AND RESPONSIBILITIES.—The Admin- istrator shall— (1) in consultation with the Secretary, de- velop, coordinate, and implement a process to support agency review, reuse, and standardiza- tion, where appropriate, of security assess- ments of cloud computing products and serv-