1. Short title This Act may be cited as the Federal Risk and Authorization Management Program Reform Act of 2018 or the FedRAMP Authorization Act . 2. Codification of the FedRAMP program (a) Amendment Chapter 36 of title 44, United States Code, is amended by adding at the end the following new sections: 3607. Federal Risk and Authorization Management Program (a) Establishment There is established within the General Services Administration, an office to be known as the FedRAMP Program Management Office that shall be responsible for the Federal Risk and Authorization Management Program. FedRAMP is a specific Government certification program that examines and accredits cloud service providers that offer Federal cloud computing services for sale, lease, or purchase to Federal agency cloud customers. The FedRAMP Program Management Office embodies the goal of a qualify once, use many times process through the issuance of certifications in the form of provisional authorizations to operate. (b) Components of FedRAMP There are established as components of FedRAMP the Joint Authorization Board and the Program Management Office, or such successor offices as the Office of Management and Budget, through the Office of Electronic Government may determine. (c) FedRAMP duties The Director of the Office of Management and Budget and the Administrator of General Services, or their designees, shall work together to do the following: (1) Issue guidance on categories and characteristics of information technology goods or services that are within the jurisdiction of FedRAMP and that require FedRAMP certification. (2) Issue guidance for the establishment and implementation of FedRAMP to conduct security assessments, reviews, and appropriate oversight of continuous monitoring of cloud services used by agencies. (3) Not later than 180 days after the date of the enactment of this section, and annually thereafter, submit to Congress a report on the status and performance of the FedRAMP Program Management Office, including the status and