§3615 Reports to Congress; Gao Report

Summary

The Director must send Congress a report no later than 1 year after this law is passed and every year after that. The report must say how well the General Services Administration (under section 3609) and agencies (under section 3613) are helping speed, share, reuse, and secure cloud service authorizations. It must show progress on the metrics in section 3609(d); give FedRAMP data such as average time to approve and counts of submissions, approvals, and denials; describe work to automate FedRAMP processes; list the authorized cloud products and their key features at each agency under guidance in section 3614; and review FedRAMP security steps like geolocation limits, foreign supply-chain and ownership disclosures, and encryption. Not later than 180 days after enactment, the Comptroller General must report to Congress on the costs to agencies and cloud providers for FedRAMP authorizations, whether agencies have continuous monitoring in place, how often and for which types of services agencies use FedRAMP, and any unique costs or burdens on small business cloud companies as defined in section 3(a) of the Small Business Act (15 U.S.C. 632(a)).