; and (5) if applicable, ensure that any contract is in compliance with FedRAMP requirements. (b) Submission of policies required Not later than 6 months after the date of the enactment of this section, Federal agency cloud customers shall submit to the Director the policies created pursuant to subsection (a)(1) for review and approval. (c) Submission of authorizations To operate required Upon issuance of an authorization to operate, the head of the relevant agency shall provide a copy of the authorization to operate letter to the FedRAMP Program Management Office and the cloud service provider to enable the FedRAMP Program Management Office to track and assess all forms of authorizations to operate on a Governmentwide basis. (d) Presumption of adequacy Any provisional authorization to operate issued by the Joint Authorization Board shall be considered to be presumptively adequate by agencies, subject to technical or programmatic rebuttal by an agency that disagrees with adequacy or sufficiency of the certification. This rebuttable presumption of adequacy shall not derogate, modify, or alter the responsibility of any agency to ensure compliance with the subchapter II of chapter 35 for any Federal cloud computing services that the agency deploys. (e) Waiver or exception The Chief Information Officer of each agency may request a waiver or exception to specific FedRAMP requirements. Such request for waiver shall be in accordance with the determinations and finding issued under section 3612(2). The determination and findings shall be submitted to the FedRAMP Program Management Office and the Director, along with such supporting articles as may be required under guidelines issued by FedRAMP. (f) Agency reports required Not later than 90 days after the date of which any guidance is issued pursuant to section 3608(b)(4) from the FedRAMP Program Management Office, the head of each agency shall submit to the Director a report on cloud computing usage and the potential demand for cloud computing. 3612. Roles and