§3609 Roles and Responsibilities of the General Services Administration

Summary

Make the General Services Administration run and manage FedRAMP for cloud services used by federal agencies. GSA must set up and run a process to help agencies review, reuse, and standardize security checks for cloud products and services, and oversee ongoing monitoring under guidance from the Director (section 3614). GSA must decide how a cloud product becomes eligible for FedRAMP approval and check that approvals are real. GSA must create templates, best practices, and help materials, set clear rules about what is included in an approval package, grant FedRAMP authorizations with the FedRAMP Board’s guidance, and keep a public comment process before issuing guidance. GSA must also coordinate with the FedRAMP Board, the Director of CISA, and others to build a continuous monitoring framework (section 3553), provide a secure way to store and share authorization packages and needed data (including for section 3613), give applicants regular status updates, review costs for independent assessments (section 3611) and foreign-interest information (section 3612), check software provenance rules with partners, support the Federal Secure Cloud Advisory Committee (section 3616), and take other actions needed to run FedRAMP. GSA must maintain a public website as the official FedRAMP repository and post the criteria and process for prioritizing which cloud services get FedRAMP authorizations, working with the FedRAMP Board and the Chief Information Officers Council. GSA must evaluate automation tools to make authorizations and continuous monitoring faster, and put in place an automated process within 1 year after the law is enacted and keep it updated. GSA must also set yearly metrics on the time and quality of assessments so progress can be tracked over time, aligned with periodic testing under section 3554, while minimizing agency reporting burden.