§3616 Federal Secure Cloud Advisory Committee

Summary

Creates a Federal Secure Cloud Advisory Committee to help agencies use cloud services safely and smoothly. The Committee must review how FedRAMP authorizations work and suggest ways to improve them. It looks for ways to make agencies reuse authorizations more, cut costs and confusion for cloud providers and agencies, and boost authorizations for small businesses. The group also gathers feedback on how agencies follow FedRAMP rules and gives advice to the Administrator, the FedRAMP Board, and agencies on technical, financial, program, and operations issues. The Administrator, after talking with the Director, must appoint up to 15 members within 90 days. The group must include the Administrator (or a designee) as chair, reps from CISA and NIST, at least two agency Chief Information Security Officers, at least one agency Chief Procurement Officer, at least one independent assessor, at least five cloud-provider businesses (including at least two small businesses), and at least two other federal reps. Nonfederal members serve 3-year terms (initial terms may be staggered 1–3 years) and may serve no more than two back-to-back terms. The Committee must meet at least three times a year and begin work within 120 days. Nonfederal members are not federal employees but may get travel expenses under 5 U.S.C. 5703. Section 14 of the Federal Advisory Committee Act (5 U.S.C. App.) does not apply. The Committee can have interim reports and must send a report to the Administrator and Congress within 540 days and then yearly.