1. Short title This Act may be cited as the Federal Risk and Authorization Management Program Authorization Act of 2019 or the FedRAMP Authorization Act . 2. Codification of the FedRAMP program (a) Amendment Chapter 36 of title 44, United States Code, is amended by adding at the end the following new sections: 3607. Federal Risk and Authorization Management Program (a) Establishment There is established within the General Services Administration the Federal Risk and Authorization Management Program. The Administrator of General Services, in accordance with the guidelines established pursuant to section 3612, shall establish a governmentwide program that provides the authoritative standardized approach to security assessment and authorization for cloud computing products and services that process unclassified information used by agencies. (b) Components of FedRAMP There are established as components of FedRAMP the Joint Authorization Board and the Program Management Office, or such successor offices as the Administrator may determine. 3608. FedRAMP Program Management Office (a) GSA Duties (1) Roles and responsibilities The Administrator of General Services shall— (A) determine the categories and characteristics of information technology goods or services that are within the jurisdiction of FedRAMP and that require FedRAMP authorization from the Joint Authorization Board or the FedRAMP Program Management Office, including the role of cloud brokers and cloud service integrators; (B) develop, coordinate, and implement a process for the FedRAMP Program Management Office and the Joint Authorization Board to conduct security assessments of cloud computing services, review authorizations and assessments submitted by agencies pursuant to subsections (b) and (c) of section 3611, and appropriate oversight of continuous monitoring of cloud computing services; (C) oversee the administration of the Federal Secure Cloud Advisory Committee, established pursuant to section 3615