§3609 Roles and Responsibilities of the General Services Administration

Summary

The Administrator must run and improve the FedRAMP program so federal agencies can review, authorize, and reuse security assessments for cloud services. Working with the Secretary and other officials, the Administrator must create processes and rules for when a cloud product can get FedRAMP approval and how to check that approval. The Administrator must make and share templates, best practices, and guidance that follow NIST standards. The Administrator must decide what is covered in an authorization package, give FedRAMP authorizations following the FedRAMP Board’s guidance, and keep a public comment process before issuing new FedRAMP rules. The Administrator must also coordinate on a continuous-monitoring framework (section 3553), securely store and share authorization data so agencies can reuse packages and meet section 3613, update applicants on assessment status, review costs of independent assessors (section 3611) and foreign-interest information (section 3612), check rules for tracing software origin, support the Federal Secure Cloud Advisory Committee (section 3616), and take other needed actions to run FedRAMP. The Administrator must keep a public website with up-to-date FedRAMP materials and publish how priorities and selections for authorization are made with the FedRAMP Board and the Chief Information Officers Council. The Administrator must evaluate automation to speed authorizations and continuous monitoring and must establish automated security-assessment tools not later than 1 year after the date of enactment and update them regularly. The Administrator must also set yearly, trackable metrics on the time and quality of assessments, aligned with the testing process in section 3554, while keeping agency reporting low.