§3610 Fedramp Board

Summary

Creates a FedRAMP Board to give the Administrator advice and recommendations on rules and priorities for security assessments of cloud products and services. The Board will have no more than 7 senior officials or experts chosen by the Director, after talking with the Administrator. Members must come from agencies including the Department of Defense, the Department of Homeland Security, the General Services Administration, and any other agencies the Director selects. Members must have technical skills in areas like cloud computing, cybersecurity, privacy, risk management, and other skills the Director needs. The Board must help speed up FedRAMP authorizations, set and update security rules that follow NIST standards, watch how agencies set and check FedRAMP requirements (including periodic review of the agency determinations in section 3613(b)), and promote clear, consistent communication between agencies and cloud providers. It will also do other tasks the Director gives with the Administrator’s agreement. The Board may work with the Chief Information Officers Council to make a process for choosing and accepting cloud services for FedRAMP authorization, and that process may be posted on the website under section 3609(b).