---
tags:
  - Federal Agencies
  - Legal Authority
picto:
  source: person
---

<span class="picto">:lucide-person-standing:{ .person title="This content was written by a human just for this page." }</span>

# FedRAMP Authorization Act on Agencies

!!! abstract "OMB Memorandum M-24-15"

    The guidance provided pursuant to Section 3614 is OMB Memorandum [M-24-15](../m-24-15/index.md).

## Sec. 3613. Roles and responsibilities of agencies

### (a) In General

In implementing the requirements of FedRAMP, the head of each agency **shall**, consistent with guidance issued by the Director pursuant to section 3614–

1. promote the use of cloud computing products and services that meet FedRAMP security requirements and other risk- based performance requirements as determined by the Director, in consultation with the Secretary;

2. confirm whether there is a FedRAMP authorization in the secure mechanism provided under section 3609(a)(8) before beginning the process of granting a FedRAMP authorization for a cloud computing product or service;

3. to the extent practicable, for any cloud computing product or service the agency seeks to authorize that has received a FedRAMP authorization, use the existing assessments of security controls and materials within any FedRAMP authorization package for that cloud computing product or service; and

4. provide to the Director data and information required by the Director pursuant to section 3614 to determine how agencies are meeting metrics established by the Administrator.

### (b) Attestation

Upon completing an assessment or authorization activity with respect to a particular cloud computing product or service, if an agency determines that the information and data the agency has reviewed under paragraph (2) or (3) of subsection (a) is wholly or substantially deficient for the purposes of performing an authorization of the cloud computing product or service, the head of the agency **shall** document as part of the resulting FedRAMP authorization package the reasons for this determination.

### \(c) Submission of Authorizations to Operate Required

Upon issuance of an agency authorization to operate based on a FedRAMP authorization, the head of the agency **shall** provide a copy of its authorization to operate letter and any supplementary information required pursuant to section 3609(a) to the Administrator.

### (d) Submission of Policies Required

Not later than 180 days[^1] after the date on which the Director issues guidance in accordance with section 3614 (1), the head of each agency, acting through the chief information officer of the agency, **shall** submit to the Director all agency policies relating to the authorization of cloud computing products and services.

### (e) Presumption of Adequacy

1. In general:

    The assessment of security controls and materials within the authorization package for a FedRAMP authorization **shall** be presumed adequate for use in an agency authorization to operate cloud computing products and services.

2. Information security requirements:

    The presumption under paragraph (1) does not modify or alter:

    <ul>
    (A) the responsibility of any agency to ensure compliance with subchapter II of chapter 35 for any cloud computing product or service used by the agency; or

    (B) the authority of the head of any agency to make a determination that there is a demonstrable need for additional security requirements beyond the security requirements included in a FedRAMP authorization for a particular control implementation.
    </ul>

[^1]: January 21, 2025 (OMB Memorandum M-24-15 was released on July 25, 2025)
