House Passes Bill to Codify—and Improve—GSA's Cloud Security Program

Just over eight years after the Federal Risk and Authorization Management Program, or FedRAMP, was established, House lawmakers passed a bill that would codify the program in law, add annual funding for the next five years and mandate much-needed reforms.

The FedRAMP Authorization Act passed the House by a voice vote Thursday, authorizing up to $20 million a year for the next five years and requiring the FedRAMP program management office to make some improvements, including automating the process.

Automation will be a central focus for the program for the coming year, FedRAMP Director Ashley Mahan told Nextgov in a recent interview. While 2020 efforts will focus on preparing the process for automation, eventually the entire lifecycle will be digitized from pre-approval to material collection and validation to continuous monitoring into the future.

FedRAMP has been working with the National Institute of Standards and Technology on the Open Security Control Assessment Language, or OSCAL, which seeks to digitize the early stages of the authorization process.

At the end of 2019, the project released a draft of a new System Security Plan—one of the central documents for starting the process for getting an authority to operate, or ATO—written entirely in XML and JSON. Mahan said she hopes to have that draft finalized by late spring and then move on to the coding the documentation for the rest of the process.

“The hope is, by the end of this year, we have, largely, the entire authorization package in this machine-readable format,” she said. “We believe that will set that foundation for future automation efforts.”

With the documentation in machine-readable format, Mahan said her office, as well as private-sector stakeholders and others, can begin developing tools to help automate the rest of the process.

“This opens the door for innovation, for industry to come in and start developing and crafting tools,” she said. “There’s tools that we think we could build, too, to aid the review. We would open source these things … then, people could take it, use it, make it better, do what they want with it. I think that there’s a lot of opportunity there from the industry side, as well as our side.”

The bill also requires federal agencies to default to reusing existing ATOs for cloud products cleared by other agencies, a process known as reciprocity.

“The bill addresses many of the concerns around duplication … by establishing—and this is really important—a presumption of adequacy for cloud technologies that have already received FedRAMP certification,” said Rep. Gerry Connolly, D-Va., author of the bill and a longtime advocate of FedRAMP and the government’s shift toward cloud services. “The presumption of adequacy means the FedRAMP offering has met baseline standards already established by the program and should be considered approved for use across the federal government, except where very specialized services would be required.

The bill requires federal agencies to check “a centralized and secure repository” of information and authorization packages to be created by the Joint Authorization Board, or JAB, the body that issues provisional ATOs. The legislation would also establish the Federal Secure Cloud Advisory Committee “comprised of not more than 15 members who are qualified representatives from the public and private sectors,” appointed by the administrator of the JAB.

Mahan told Nextgov the program has already made progress increasing reuse throughout the government, with a 50% rise in reciprocation in fiscal 2019. She attributed the jump to greater outreach. One major agency that got the message was the Defense Department, which issued a memo in August requiring its programs to default to reusing an ATO whenever possible.

“We have listened to all the great feedback that we have received over the last year,” she said. “We’re putting together a strategy for FedRAMP’s future that incorporates automation, providing more opportunities to connect the community with one another and really trying to provide that simplified user experience and providing guidance and clarity into the process and security requirements.”

With passage in the House, the FedRAMP Authorization Act now moves to the Senate for consideration.