configurations within a single cloud service and among cloud services. (10) Establish a centralized and secure repository to collect and share necessary data, including security authorization packages, from the Joint Authorization Board and agencies to enable better sharing and reuse to such packages across agencies. (c) Evaluation of automation procedures (1) In general The FedRAMP Program Management Office shall assess and evaluate available automation capabilities and procedures to improve the efficiency and effectiveness of the issuance of provisional authorizations to operate issued by the Joint Authorization Board and FedRAMP authorizations, including better control inheritance and continuous monitoring of cloud environments and among cloud environments. (2) Means for automation Not later than 1 year after the date of the enactment of this section and updated annually thereafter, the FedRAMP Program Management Office shall establish a means for the automation of security assessments and reviews. (d) Metrics for authorization The FedRAMP Program Management Office shall establish annual metrics regarding the time and quality of the assessments necessary for completion of a FedRAMP authorization process in a manner that can be consistently tracked over time in conjunction with the periodic testing and evaluation process pursuant to section 3553 in a manner that minimizes the agency reporting burden. 3609. Joint Authorization Board (a) Establishment There is established the Joint Authorization Board which shall consist of 3 security experts, appointed by the Director in consultation with the Administrator, from each of the following: (1) The Department of Defense. (2) The Department of Homeland Security. (3) The General Services Administration. (b) Issuance of provisional authorizations To operate The Joint Authorization Board shall conduct security assessments of cloud computing services and issue provisional authorizations to operate to cloud service providers that meet FedRAMP security guidelines set forth