§3610 Fedramp Board

Summary

Creates a FedRAMP Board to advise the Administrator on what security checks cloud products and services must meet and how to set priorities for those checks. The Board will have up to 7 senior officials or experts picked by the Director with the Administrator’s input. Members come from the Department of Defense, Department of Homeland Security, General Services Administration, and other agencies the Director names. Board members must have technical experience in areas like cloud computing, cybersecurity, privacy, and risk management. The Board will help speed up FedRAMP approvals by sharing best practices; write and update security rules and guidance that follow NIST standards; watch how agencies set and confirm authorization requirements and do periodic reviews; promote clear, consistent rules between agencies and cloud providers; and carry out other tasks the Director assigns with the Administrator’s agreement. The Board may work with the Chief Information Officers Council to make and, if needed, post a process for prioritizing which cloud products get FedRAMP authorization.