44 U.S.C. § 3610 — FedRAMP Board

Page 212 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3610 ices, including, as appropriate, oversight of continuous monitoring of cloud computing products and services, pursuant to guidance issued by the Director pursuant to section 3614; (2) establish processes and identify criteria consistent with guidance issued by the Direc- tor under section 3614 to make a cloud com- puting product or service eligible for a FedRAMP authorization and validate whether a cloud computing product or service has a FedRAMP authorization; (3) develop and publish templates, best prac- tices, technical assistance, and other mate- rials to support the authorization of cloud computing products and services and increase the speed, effectiveness, and transparency of the authorization process, consistent with standards and guidelines established by the Director of the National Institute of Stand- ards and Technology and relevant statutes; (4) establish and update guidance on the boundaries of FedRAMP authorization pack- ages to enhance the security and protection of Federal information and promote trans- parency for agencies and users as to which services are included in the scope of a FedRAMP authorization; (5) grant FedRAMP authorizations to cloud computing products and services consistent with the guidance and direction of the FedRAMP Board; (6) establish and maintain a public comment process for proposed guidance and other FedRAMP directives that may have a direct impact on cloud service providers and agencies before the issuance of such guidance or other FedRAMP directives; (7) coordinate with the FedRAMP Board, the Director of the Cybersecurity and Infrastruc- ture Security Agency, and other entities iden- tified by the Administrator, with the concur- rence of the Director and the Secretary, to es- tablish and regularly update a framework for continuous monitoring under section 3553; (8) provide a secure mechanism for storing and sharing necessary data, including FedRAMP authorization packages, to enable better reuse of such packages across agencies, including making available any information and data necessary for agencies to fulfill the requirements of section 3613; (9) provide regular updates to applicant cloud service providers on the status of any cloud computing product or service during an assessment process; (10) regularly review, in consultation with the FedRAMP Board— (A) the costs associated with the inde- pendent assessment services described in section 3611; and (B) the information relating to foreign in- terests submitted pursuant to section 3612; (11) in coordination with the Director, the Secretary, and other stakeholders, as appro- priate, determine the sufficiency of underlying requirements to identify and assess the prove- nance of the software in cloud services and products; (12) support the Federal Secure Cloud Advi- sory Committee established pursuant to sec- tion 3616; and (13) take such other actions as the Adminis- trator may determine necessary to carry out FedRAMP. (b) WEBSITE.— (1) IN GENERAL.—The Administrator shall maintain a public website to serve as the au- thoritative repository for FedRAMP, includ- ing the timely publication and updates for all relevant information, guidance, determina- tions, and other materials required under sub- section (a). (2) CRITERIA AND PROCESS FOR FEDRAMP AU- THORIZATION PRIORITIES.—The Administrator shall develop and make publicly available on the website described in paragraph (1) the cri- teria and process for prioritizing and selecting cloud computing products and services that will receive a FedRAMP authorization, in con- sultation with the FedRAMP Board and the Chief Information Officers Council. (c) EVALUATION OF AUTOMATION PROCEDURES.— (1) IN GENERAL.—The Administrator, in co- ordination with the Secretary, shall assess and evaluate available automation capabilities and procedures to improve the efficiency and effectiveness of the issuance of FedRAMP au- thorizations, including continuous monitoring of cloud computing products and services. (2) MEANS FOR AUTOMATION.—Not later than 1 year after the date of enactment of this sec- tion, and updated regularly thereafter, the Ad- ministrator shall establish a means for the au- tomation of security assessments and reviews. (d) METRICS FOR AUTHORIZATION.—The Admin- istrator shall establish annual metrics regarding the time and quality of the assessments nec- essary for completion of a FedRAMP authoriza- tion process in a manner that can be consist- ently tracked over time in conjunction with the periodic testing and evaluation process pursuant to section 3554 in a manner that minimizes the agency reporting burden. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3450.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Editorial Notes REFERENCES IN TEXT The date of enactment of this section, referred to in subsec. (c)(2), is the date of enactment of Pub. L. 117–263, which was approved Dec. 23, 2022. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3610. FedRAMP Board (a) ESTABLISHMENT.—There is established a FedRAMP Board to provide input and rec- Page 213 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3612 ommendations to the Administrator regarding the requirements and guidelines for, and the prioritization of, security assessments of cloud computing products and services. (b) MEMBERSHIP.—The FedRAMP Board shall consist of not more than 7 senior officials or ex- perts from agencies appointed by the Director, in consultation with the Administrator, from each of the following: (1) The Department of Defense. (2) The Department of Homeland Security. (3) The General Services Administration. (4) Such other agencies as determined by the Director, in consultation with the Adminis- trator. (c) QUALIFICATIONS.—Members of the FedRAMP Board appointed under subsection (b) shall have technical expertise in domains rel- evant to FedRAMP, such as— (1) cloud computing; (2) cybersecurity; (3) privacy; (4) risk management; and (5) other competencies identified by the Di- rector to support the secure authorization of cloud services and products. (d) DUTIES.—The FedRAMP Board shall— (1) in consultation with the Administrator, serve as a resource for best practices to accel- erate the process for obtaining a FedRAMP authorization; (2) establish and regularly update require- ments and guidelines for security authoriza- tions of cloud computing products and serv- ices, consistent with standards and guidelines established by the Director of the National In- stitute of Standards and Technology, to be used in the determination of FedRAMP au- thorizations; (3) monitor and oversee, to the greatest ex- tent practicable, the processes and procedures by which agencies determine and validate re- quirements for a FedRAMP authorization, in- cluding periodic review of the agency deter- minations described in section 3613(b); (4) ensure consistency and transparency be- tween agencies and cloud service providers in a manner that minimizes confusion and engen- ders trust; and (5) perform such other roles and responsibil- ities as the Director may assign, with concur- rence from the Administrator. (e) DETERMINATIONS OF DEMAND FOR CLOUD COMPUTING PRODUCTS AND SERVICES.—The FedRAMP Board may consult with the Chief In- formation Officers Council to establish a proc- ess, which may be made available on the website maintained under section 3609(b), for prioritizing and accepting the cloud computing products and services to be granted a FedRAMP authoriza- tion. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3452.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3611. Independent assessment The Administrator may determine whether FedRAMP may use an independent assessment service to analyze, validate, and attest to the quality and compliance of security assessment materials provided by cloud service providers during the course of a determination of whether to use a cloud computing product or service. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3453.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3612. Declaration of foreign interests (a) IN GENERAL.—An independent assessment service that performs services described in sec- tion 3611 shall annually submit to the Adminis- trator information relating to any foreign inter- est, foreign influence, or foreign control of the independent assessment service. (b) UPDATES.—Not later than 48 hours after there is a change in foreign ownership or control of an independent assessment service that per- forms services described in section 3611, the independent assessment service shall submit to the Administrator an update to the information submitted under subsection (a). (c) CERTIFICATION.—The Administrator may require a representative of an independent as- sessment service to certify the accuracy and completeness of any information submitted under this section. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3453.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec-