United StatesFedRAMP Authorization Act, Federal Risk and Authorization Management Program
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Reporting
As of .
What it requires
- This Act reaches your organization through federal agencies: its sections direct the General Services Administration, the FedRAMP Board, the Office of Management and Budget and each agency, and a cloud service provider, an entity offering cloud computing products or services to agencies, meets it through its dealings with an agency, so read this instrument by hand if you sell or want to sell a cloud product or service to a federal agency.
- If an agency will operate your cloud computing product or service as a Federal information system, obtain a FedRAMP authorization for it, a certification that it completed the Administrator's FedRAMP authorization process or received a FedRAMP provisional authorization to operate, because the Director's guidance must require agencies to obtain one.
- If you provide an independent assessment service that performs services described in 44 U.S.C. 3611, submit to the Administrator each year information relating to any foreign interest, foreign influence, or foreign control of the service, and submit an update not later than 48 hours after a change in foreign ownership or control.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
General Services Administration (the Administrator, FedRAMP and the FedRAMP Board); Office of Management and Budget (the Director, who oversees the effectiveness of FedRAMP and the FedRAMP Board)
What this law does
The FedRAMP Authorization Act was added to chapter 36 of title 44 of the United States Code by section 5921 of Public Law 117-263 on . It establishes within the General Services Administration the Federal Risk and Authorization Management Program, a Government-wide program that provides a standardized, reusable approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies.
The Administrator of General Services grants FedRAMP authorizations to cloud computing products and services consistent with the guidance and direction of the FedRAMP Board. Each agency head must promote the use of cloud computing products and services that meet FedRAMP security requirements.
The Director of the Office of Management and Budget must issue guidance that includes requirements for agencies to obtain a FedRAMP authorization when operating a covered cloud computing product or service as a Federal information system. An independent assessment service that performs services described in the Act must annually submit to the Administrator information relating to any foreign interest, foreign influence, or foreign control of the service.
That service must submit an update not later than 48 hours after a change in foreign ownership or control. The repeal of the Act's sections is effective on the date that is 5 years after .
When LexLint raises it
When your app profile says your app provides cloud services.