§3613 Roles and Responsibilities of Agencies

Summary

Each agency head must follow the Director’s FedRAMP guidance. They must promote cloud services that meet FedRAMP and other risk-based rules set by the Director with the Secretary. Before starting an agency authorization, the agency must check the secure system under section 3609(a)(8) to see if a FedRAMP authorization already exists. When practical, the agency must use the security assessments and materials from an existing FedRAMP authorization. Agencies must give the Director any data he asks for under section 3614 so he can track how agencies meet the Administrator’s metrics. If the FedRAMP materials are missing or mostly inadequate, the agency head must explain why in the agency’s FedRAMP authorization package. When an agency issues an authorization to operate based on a FedRAMP authorization, it must send its authorization letter and any extra documents required under section 3609(a) to the Administrator. Within 180 days after the Director issues guidance under section 3614(1), each agency head, through the agency chief information officer, must send all agency cloud-authorization policies to the Director. A FedRAMP assessment is presumed adequate for an agency authorization, but agencies still must follow subchapter II of chapter 35 and may add extra security rules if there is a clear need.