44 U.S.C. § 3611 — Independent assessment

Page 213 TITLE 44—PUBLIC PRINTING AND DOCUMENTS § 3612 ommendations to the Administrator regarding the requirements and guidelines for, and the prioritization of, security assessments of cloud computing products and services. (b) MEMBERSHIP.—The FedRAMP Board shall consist of not more than 7 senior officials or ex- perts from agencies appointed by the Director, in consultation with the Administrator, from each of the following: (1) The Department of Defense. (2) The Department of Homeland Security. (3) The General Services Administration. (4) Such other agencies as determined by the Director, in consultation with the Adminis- trator. (c) QUALIFICATIONS.—Members of the FedRAMP Board appointed under subsection (b) shall have technical expertise in domains rel- evant to FedRAMP, such as— (1) cloud computing; (2) cybersecurity; (3) privacy; (4) risk management; and (5) other competencies identified by the Di- rector to support the secure authorization of cloud services and products. (d) DUTIES.—The FedRAMP Board shall— (1) in consultation with the Administrator, serve as a resource for best practices to accel- erate the process for obtaining a FedRAMP authorization; (2) establish and regularly update require- ments and guidelines for security authoriza- tions of cloud computing products and serv- ices, consistent with standards and guidelines established by the Director of the National In- stitute of Standards and Technology, to be used in the determination of FedRAMP au- thorizations; (3) monitor and oversee, to the greatest ex- tent practicable, the processes and procedures by which agencies determine and validate re- quirements for a FedRAMP authorization, in- cluding periodic review of the agency deter- minations described in section 3613(b); (4) ensure consistency and transparency be- tween agencies and cloud service providers in a manner that minimizes confusion and engen- ders trust; and (5) perform such other roles and responsibil- ities as the Director may assign, with concur- rence from the Administrator. (e) DETERMINATIONS OF DEMAND FOR CLOUD COMPUTING PRODUCTS AND SERVICES.—The FedRAMP Board may consult with the Chief In- formation Officers Council to establish a proc- ess, which may be made available on the website maintained under section 3609(b), for prioritizing and accepting the cloud computing products and services to be granted a FedRAMP authoriza- tion. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3452.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3611. Independent assessment The Administrator may determine whether FedRAMP may use an independent assessment service to analyze, validate, and attest to the quality and compliance of security assessment materials provided by cloud service providers during the course of a determination of whether to use a cloud computing product or service. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3453.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec- tion is effective on the date that is 5 years after Dec. 23, 2022. CONSTRUCTION For rule of construction regarding section 5921 of Pub. L. 117–263, see section 5921(e) of Pub. L. 117–263, set out as a note under section 3607 of this title. § 3612. Declaration of foreign interests (a) IN GENERAL.—An independent assessment service that performs services described in sec- tion 3611 shall annually submit to the Adminis- trator information relating to any foreign inter- est, foreign influence, or foreign control of the independent assessment service. (b) UPDATES.—Not later than 48 hours after there is a change in foreign ownership or control of an independent assessment service that per- forms services described in section 3611, the independent assessment service shall submit to the Administrator an update to the information submitted under subsection (a). (c) CERTIFICATION.—The Administrator may require a representative of an independent as- sessment service to certify the accuracy and completeness of any information submitted under this section. (Added Pub. L. 117–263, div. E, title LIX, § 5921(b), Dec. 23, 2022, 136 Stat. 3453.) REPEAL OF SECTION For repeal of section by section 5921(d)(1) of Pub. L. 117–263, see Effective Date of Repeal note below. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF REPEAL Pub. L. 117–263, div. E, title LIX, § 5921(d)(1), Dec. 23, 2022, 136 Stat. 3458, provided that the repeal of this sec-