§3613 Roles and responsibilities of agencies

Summary

Require agencies to favor and use cloud services that meet FedRAMP security and the Director’s risk rules (made with input from the Secretary). Before an agency starts its own authorization for a cloud service, it must check the secure system under section 3609(a)(8) to see if a FedRAMP authorization already exists. When possible, agencies should reuse the security assessments and materials from an existing FedRAMP authorization. Agencies must give the Director the data called for under section 3614 so the Director can track agency performance. If an agency finds the FedRAMP package is missing or clearly inadequate, the agency must explain those reasons in its authorization file. When an agency issues an authorization based on FedRAMP, it must send the authorization letter and any extra information required under section 3609(a) to the Administrator. Within 180 days after the Director issues guidance under section 3614(1), each agency head, through the agency’s CIO, must send all of the agency’s cloud-authorization policies to the Director. FedRAMP authorization packages are presumed usable by agencies, but that presumption does not remove an agency’s duties under subchapter II of chapter 35 or the agency head’s right to require extra security controls when needed.