; and (B) at a minimum, includes the information system security plan, privacy plan, security control assessment, privacy control assessment, and any relevant plans of action and milestones. (3) Cloud broker The term cloud broker means an entity that manages the use, performance, and delivery of cloud computing services and negotiates relationships between cloud service providers and cloud consumers. (4) Cloud computing The term cloud computing has the meaning given that term by the National Institutes of Standards and Technology in NIST Special Publication 800–145 and any amendatory or superseding document thereto. (5) Cloud service provider The term cloud service provider means a non-Federal entity offering cloud computing services to agencies. (6) FedRAMP The term FedRAMP means the Federal Risk and Authorization Management Program established under section 3607(a). (7) FedRAMP Authorization The term FedRAMP authorization means a cloud computing product or service that has received an agency authorization to operate and has been certified by the FedRAMP Program Management Office to meet requirements and guidelines established by the FedRAMP Program Management Office. (8) FedRAMP Program Management Office The term FedRAMP Program Management Office means the office that administers FedRAMP. (9) Independent assessment organization The term independent assessment organization means a third-party organization accredited by the Program Director of the FedRAMP Program Management Office to undertake conformity assessments of cloud service providers. (10) Joint Authorization Board The term Joint Authorization Board means the Joint Authorization Board established under section 3609. (11) Security architecture The term security architecture means a set of physical and logical security-relevant representations of system architecture that conveys information about how the system is partitioned into security domains and makes use of security-relevant elements to enforce security policies within and between security domains