§3616 Federal Secure Cloud Advisory Committee

Summary

Creates a Federal Secure Cloud Advisory Committee to help agencies adopt, buy, authorize, monitor, and secure cloud services and to improve FedRAMP. The committee must study FedRAMP and recommend ways to speed up and cut the cost and confusion of authorizations, increase reuse of authorizations, boost authorizations for small businesses, collect agency feedback on FedRAMP compliance, and act as a forum for stakeholders. It will give advice and recommendations to the Administrator, the FedRAMP Board, and agencies on technical, financial, program, and operational issues. The committee will have up to 15 members appointed by the Administrator, in consultation with the Director, and must include the Administrator (or designee) as Chair, at least 1 rep each from CISA and NIST, at least 2 agency Chief Information Security Officers, at least 1 agency Chief Procurement Officer, 1 independent assessment service rep, at least 5 cloud provider company reps (including at least 2 from small businesses), and at least 2 other federal reps. Members must be appointed within 90 days of enactment. Non-federal members serve 3-year terms (initial terms may be staggered 1, 2, or 3 years) and may serve no more than 2 consecutive terms. The committee must meet at least 3 times a year, begin operations within 120 days of enactment, and may set its own rules. Non-federal members are not federal employees and receive no pay, but may get travel expenses under section 5703. Section 14 of the Federal Advisory Committee Act does not apply. Federal employees may be detailed to the committee without reimbursement. The committee may send interim reports, and must send a report to the Administrator and Congress no later than 540 days after enactment and annually after that.