; (3) obtain such professional staff as may be necessary for the effective operation of FedRAMP and such other activities as are essential to properly perform critical functions; (4) such other roles and responsibilities as the FedRAMP Program Management Office may assign, as agreed to by the FedRAMP Program Management Office and members of the Joint Authorization Board; and (5) appoint technical representatives responsible for FedRAMP activities within each Joint Authorization Board agency. 3610. Roles and responsibilities of third party assessment organizations (a) Requirements for certification The FedRAMP Program Management Office, in consultation with the Joint Authorization Board, shall determine the requirements for certification of third party assessment organizations. Such requirements may include developing or requiring certification programs for individuals employed by the third party assessment organizations who lead FedRAMP assessment teams. (b) Assessment Accredited third party assessment organizations shall assess, validate, and attest to the quality and compliance of security assessment materials provided by cloud service providers. (c) Summary risk report Accredited third party assessment organizations shall develop a risk report that summarizes the security assessment report to complement the existing authorization package artifacts and serve as an authorization decision making tool. 3611. Roles and responsibilities of agencies (a) In general In implementing and enforcing the requirements of FedRAMP, Federal agency cloud customers shall— (1) create policies to implement FedRAMP requirements; (2) issue agency-specific authorizations to operate for Federal cloud computing services in compliance with subchapter II of chapter 35; (3) be in compliance with any FedRAMP requirements, unless a waiver is issued by the Director; (4) provide data to the Director on how agencies are meeting metrics as defined by the FedRAMP Program Management Office pursuant to section 3614(b)