44 U.S.C. § 3614 — Roles and responsibilities of the Office of

Page 214 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3613 tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3613. Roles and responsibilities of agencies (a) IN GENERAL.—In implementing the require- ments of FedRAMP, the head of each agency shall, consistent with guidance issued by the Di- rector pursuant to section 3614— (1) promote the use of cloud computing prod- ucts and services that meet FedRAMP secu- rity requirements and other risk-based per- formance requirements as determined by the Director, in consultation with the Secretary; (2) confirm whether there is a FedRAMP au- thorization in the secure mechanism provided under section 3609(a)(8) before beginning the process of granting a FedRAMP authorization for a cloud computing product or service; (3) to the extent practicable, for any cloud computing product or service the agency seeks to authorize that has received a FedRAMP au- thorization, use the existing assessments of security controls and materials within any FedRAMP authorization package for that cloud computing product or service; and (4) provide to the Director data and informa- tion required by the Director pursuant to sec- tion 3614 to determine how agencies are meet- ing metrics established by the Administrator. (b) ATTESTATION.—Upon completing an assess- ment or authorization activity with respect to a particular cloud computing product or service, if an agency determines that the information and data the agency has reviewed under paragraph (2) or (3) of subsection (a) is wholly or substan- tially deficient for the purposes of performing an authorization of the cloud computing product or service, the head of the agency shall docu- ment as part of the resulting FedRAMP author- ization package the reasons for this determina- tion. (c) SUBMISSION OF AUTHORIZATIONS TO OPERATE REQUIRED.—Upon issuance of an agency author- ization to operate based on a FedRAMP author- ization, the head of the agency shall provide a copy of its authorization to operate letter and any supplementary information required pursu- ant to section 3609(a) to the Administrator. (d) SUBMISSION OF POLICIES REQUIRED.—Not later than 180 days after the date on which the Director issues guidance in accordance with sec- tion 3614(1), the head of each agency, acting through the chief information officer of the agency, shall submit to the Director all agency policies relating to the authorization of cloud computing products and services. (e) PRESUMPTION OF ADEQUACY.— (1) IN GENERAL.—The assessment of security controls and materials within the authoriza- tion package for a FedRAMP authorization shall be presumed adequate for use in an agen- cy authorization to operate cloud computing products and services. (2) INFORMATION SECURITY REQUIREMENTS.— The presumption under paragraph (1) does not modify or alter— (A) the responsibility of any agency to en- sure compliance with subchapter II of chap- ter 35 for any cloud computing product or service used by the agency; or (B) the authority of the head of any agen- cy to make a determination that there is a demonstrable need for additional security requirements beyond the security require- ments included in a FedRAMP authorization for a particular control implementation. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3453.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3614. Roles and responsibilities of the Office of Management and Budget The Director shall— (1) in consultation with the Administrator and the Secretary, issue guidance that— (A) specifies the categories or characteris- tics of cloud computing products and serv- ices that are within the scope of FedRAMP; (B) includes requirements for agencies to obtain a FedRAMP authorization when oper- ating a cloud computing product or service described in subparagraph (A) as a Federal information system; and (C) encompasses, to the greatest extent practicable, all necessary and appropriate cloud computing products and services; (2) issue guidance describing additional re- sponsibilities of FedRAMP and the FedRAMP Board to accelerate the adoption of secure cloud computing products and services by the Federal Government; (3) in consultation with the Administrator, establish a process to periodically review FedRAMP authorization packages to support the secure authorization and reuse of secure cloud products and services; (4) oversee the effectiveness of FedRAMP and the FedRAMP Board, including the com- pliance by the FedRAMP Board with the du- ties described in section 3610(d); and (5) to the greatest extent practicable, en- courage and promote consistency of the as- sessment, authorization, adoption, and use of secure cloud computing products and services within and across agencies. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3454.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Page 215 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3616 Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3615. Reports to Congress; GAO report (a) REPORTS TO CONGRESS.—Not later than 1 year after the date of enactment of this section, and annually thereafter, the Director shall sub- mit to the appropriate congressional commit- tees a report that includes the following: (1) During the preceding year, the status, ef- ficiency, and effectiveness of the General Services Administration under section 3609 and agencies under section 3613 and in sup- porting the speed, effectiveness, sharing, reuse, and security of authorizations to oper- ate for secure cloud computing products and services. (2) Progress towards meeting the metrics re- quired under section 3609(d). (3) Data on FedRAMP authorizations. (4) The average length of time to issue FedRAMP authorizations. (5) The number of FedRAMP authorizations submitted, issued, and denied for the pre- ceding year. (6) A review of progress made during the pre- ceding year in advancing automation tech- niques to securely automate FedRAMP proc- esses and to accelerate reporting under this section. (7) The number and characteristics of au- thorized cloud computing products and serv- ices in use at each agency consistent with guidance provided by the Director under sec- tion 3614. (8) A review of FedRAMP measures to ensure the security of data stored or processed by cloud service providers, which may include— (A) geolocation restrictions for provided products or services; (B) disclosures of foreign elements of sup- ply chains of acquired products or services; (C) continued disclosures of ownership of cloud service providers by foreign entities; and (D) encryption for data processed, stored, or transmitted by cloud service providers. (b) GAO REPORT.—Not later than 180 days after the date of enactment of this section, the Comptroller General of the United States shall report to the appropriate congressional commit- tees an assessment of the following: (1) The costs incurred by agencies and cloud service providers relating to the issuance of FedRAMP authorizations. (2) The extent to which agencies have proc- esses in place to continuously monitor the im- plementation of cloud computing products and services operating as Federal information sys- tems. (3) How often and for which categories of products and services agencies use FedRAMP authorizations. (4) The unique costs and potential burdens incurred by cloud computing companies that are small business concerns (as defined in sec- tion 3(a) of the Small Business Act (15 U.S.C. 632(a)) as a part of the FedRAMP authoriza- tion process. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3455.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Editorial Notes REFERENCES IN TEXT The date of enactment of this section, referred to in text, is the date of enactment of Pub. L. 117–263, which was approved Dec. 23, 2022. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3616. Federal Secure Cloud Advisory Com- mittee (a) ESTABLISHMENT, PURPOSES, AND DUTIES.— (1) ESTABLISHMENT.—There is established a Federal Secure Cloud Advisory Committee (re- ferred to in this section as the ‘‘Committee’’) to ensure effective and ongoing coordination of agency adoption, use, authorization, moni- toring, acquisition, and security of cloud com- puting products and services to enable agency mission and administrative priorities. (2) PURPOSES.—The purposes of the Com- mittee are the following: (A) To examine the operations of FedRAMP and determine ways that author- ization processes can continuously be im- proved, including the following: (i) Measures to increase agency reuse of FedRAMP authorizations. (ii) Proposed actions that can be adopted to reduce the burden, confusion, and cost associated with FedRAMP authorizations for cloud service providers. (iii) Measures to increase the number of FedRAMP authorizations for cloud com- puting products and services offered by small businesses concerns (as defined by section 3(a) of the Small Business Act (15 U.S.C. 632(a)). (iv) Proposed actions that can be adopt- ed to reduce the burden and cost of FedRAMP authorizations for agencies. (B) Collect information and feedback on agency compliance with and implementation of FedRAMP requirements. (C) Serve as a forum that facilitates com- munication and collaboration among the FedRAMP stakeholder community.