0
FedRAMP Authorization Act
5/11/2023, 3:46 PM
Summary of Bill HR 21
The bill aims to improve the Federal Risk and Authorization Management Program (FedRAMP), which is responsible for ensuring that cloud service providers meet the necessary security standards to be used by federal agencies. By streamlining the authorization process, the bill seeks to make it easier for agencies to adopt cloud services while still maintaining high levels of security.
Some key provisions of the FedRAMP Authorization Act include requiring the General Services Administration (GSA) to establish a process for expedited authorization of cloud service providers, as well as mandating regular updates to the FedRAMP security standards to keep pace with evolving technology and threats. Overall, the FedRAMP Authorization Act is aimed at modernizing and improving the security of cloud services used by the federal government, while also making it easier for agencies to adopt these services.
Congressional Summary of HR 21
Federal Risk and Authorization Management Program Authorization Act of 2021 or the FedRAMP Authorization Act
This bill provides statutory authority for the Federal Risk and Authorization Management Program (FedRAMP) within the General Services Administration (GSA).
The GSA must establish a government-wide program that provides the authoritative standardized approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies. Agencies must ensure that their cloud computing services meet GSA requirements.
The bill establishes the Joint Authorization Board to conduct security assessments of cloud computing services and issue provisional authorizations to operate to cloud service providers that meet FedRAMP security guidelines.
The GSA shall (1) publish a report that includes an assessment of the cost incurred by agencies and cloud service providers related to the issuance of FedRAMP authorizations and provisional authorizations, (2) determine the requirements for certification of independent assessment organizations, and (3) establish the Federal Secure Cloud Advisory Committee.
