44 U.S.C. § 3610 — FedRAMP Board

(a) Establishment. A FedRAMP Board is established to give the Administrator input and recommendations about requirements, guidelines, and priorities for security assessments of cloud-computing products and services. (b) Membership. The Director, consulting with the Administrator, appoints no more than 7 senior agency officials or experts from: (1) Defense; (2) Homeland Security; (3) the General Services Administration; and (4) other agencies the Director identifies with the Administrator. (c) Qualifications. Members must have technical expertise relevant to FedRAMP, including (1) cloud computing, (2) cybersecurity, (3) privacy, (4) risk management, and (5) other competencies the Director identifies to support secure authorization of cloud services and products. (d) Duties. The Board must: (1) consult with the Administrator and serve as a best-practices resource to speed FedRAMP authorization; (2) establish and regularly update authorization requirements and guidelines consistent with NIST Director standards and guidelines; (3) monitor and oversee, as far as practicable, agency processes for determining and validating authorization requirements, including periodic review of determinations under section 3613(b); (4) promote consistency and transparency between agencies and cloud providers while minimizing confusion and building trust; and (5) perform other roles the Director assigns with the Administrator’s concurrence. (e) Demand determinations. The Board may consult the Chief Information Officers Council to create a process, possibly on the website under section 3609(b), for prioritizing and accepting cloud products and services to receive authorization.