FedRAMP Authorization Act

FedRAMP Authorization Act

This bill provides statutory authority for the Federal Risk and Authorization Management Program (FedRAMP) within the General Services Administration (GSA).

The GSA must establish a government-wide program that provides the authoritative standardized approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies. Agencies must ensure that their cloud computing services meet GSA requirements.

The Government Accountability Office must report to Congress assessing

• the costs incurred by agencies and cloud service providers relating to the issuance of FedRAMP authorizations,
• the extent to which agencies have processes in place to continuously monitor the implementation of cloud computing products and services operating as federal information systems,
• how often and for which categories of products and services agencies use FedRAMP authorizations, and
• the unique costs and potential burdens incurred by cloud computing companies that are small business concerns as a part of the FedRAMP authorization process.

The bill establishes the Federal Secure Cloud Advisory Committee.

The FedRAMP Authorization Act, also known as Bill 117 hr 8956, is a piece of legislation currently being considered by the US Congress. The purpose of this bill is to streamline and improve the Federal Risk and Authorization Management Program (FedRAMP), which is responsible for ensuring the security of cloud computing services used by federal agencies.

The FedRAMP Authorization Act aims to enhance the efficiency and effectiveness of the FedRAMP process by establishing clear guidelines and deadlines for agencies to follow when authorizing cloud services. This includes requiring agencies to complete security assessments within a certain timeframe and to make decisions on authorizations within 90 days.

Additionally, the bill seeks to improve transparency and accountability within the FedRAMP program by requiring regular reporting on the status of authorizations and the implementation of security controls. It also calls for the establishment of a FedRAMP Advisory Board to provide guidance and oversight to the program. Overall, the FedRAMP Authorization Act is designed to strengthen the security of cloud computing services used by the federal government and to ensure that agencies are able to quickly and efficiently authorize these services while maintaining high standards of security.