; and (5) provide data and information required to the Director pursuant to section 3612 to determine how agencies are meeting metrics as defined by the FedRAMP Program Management Office. (b) Submission of policies required Not later than 6 months after the date of the enactment of this section, the head of each agency shall submit to the Director the policies created pursuant to subsection (a)(1) for review and approval. (c) Submission of authorizations To operate required Upon issuance of an authorization to operate, the head of each agency shall provide a copy of the authorization to operate letter and any supplementary information required pursuant to section 3608(b) to the FedRAMP Program Management Office. (d) Presumption of adequacy (1) In general The assessment of security controls and materials within the authorization package for provisional authorizations to operate issued by the Joint Authorization Board and agency authorizations to operate that receive FedRAMP authorization from the Program Management Office shall be presumed adequate for use in agency authorizations of cloud computing products and services. (2) Information security requirements The presumption under paragraph (1) does not modify or alter the responsibility of any agency to ensure compliance with subchapter II of chapter 35 for any cloud computing products or services used by the agency. 3612. Roles and responsibilities of the Office of Management and Budget The Director shall have the following duties: (1) Issue guidance to ensure that an agency does not operate a Federal Government cloud computing service using Government data without issuing an authorization to operate issued by the agency that meets the requirements of subchapter II of chapter 35 and FedRAMP. (2) Ensure agencies are in compliance with any guidance or other requirements issued related to FedRAMP. (3) Review, analyze, and update guidance on the adoption, security, and use of cloud computing services used by agencies. (4) Ensure the Joint Authorization Board is in