HouseH.R. 10915119th Congress
Common-Sense Cloud Security Act
Full Text
Official text as published. Use Ctrl+F / Cmd+F to search within the document.
[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 10915 Introduced in House (IH)]
<DOC>
119th CONGRESS
2d Session
H. R. 10915
To require the Director of the National Institute of Standards and
Technology to develop new standards, methodologies, and recommendations
with respect to the cybersecurity of cloud-based infrastructure, and
for other purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
October 26, 2026
Mr. McCormick introduced the following bill; which was referred to the
Committee on Science, Space, and Technology, and in addition to the
Committee on Oversight and Government Reform, for a period to be
subsequently determined by the Speaker, in each case for consideration
of such provisions as fall within the jurisdiction of the committee
concerned
_______________________________________________________________________
A BILL
To require the Director of the National Institute of Standards and
Technology to develop new standards, methodologies, and recommendations
with respect to the cybersecurity of cloud-based infrastructure, and
for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Common-Sense Cloud Security Act''.
SEC. 2. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY SPECIAL
PUBLICATION ON THE CYBERSECURITY OF CLOUD-BASED
INFRASTRUCTURE.
(a) In General.--Not later than 180 days after the date of the
enactment of this Act, the Director of the National Institute of
Standards and Technology (in this section referred to as the
``Director'') shall solicit through the Federal Register public comment
on the following:
(1) The existing standards, methodologies, and
recommendations of the Institute with respect to the
cybersecurity of cloud-based infrastructure.
(2) Developing new standards, methodologies, and
recommendations of the Institute with respect to such
cybersecurity, that include the following:
(A) Standards for managing and securing the digital
identities utilized with respect to such
infrastructure, including standards to link logins and
other access credentials for an account, which may be
an agentic account, to a device.
(B) Standards for a system through which cloud
service providers are able to monitor and address
security alerts and unauthorized or malicious activity.
(C) Recommendations regarding the following:
(i) Addressing the prevention, detection,
and mitigation of intracloud attacks and
unauthorized east-west traffic.
(ii) Vetting, authorizing, and continuously
monitoring third-party application integrations
and software-as-a-service applications, to
ensure that such integrations and applications
have appropriate access to the cloud
environments of such providers.
(iii) Adopting artificial intelligence
tools for the detection of unusual or
suspicious activity in such environments, in a
manner that resembles such adoption by the
Federal Government and other public sector
entities.
(D) A methodology by which such a provider is able
to determine the blast radius of such provider.
(b) Prototype.--Not later than 50 days after the date of the
solicitation under subsection (a), the Director shall carry out the
following:
(1) Publish in the Federal Register a prototype of the
standards, methodologies, and recommendations referred to in
paragraph (2) of such subsection.
(2) Solicit through the Federal Register public comment on
such prototype.
(c) Final Version.--Not later than 135 days after the publication
of the prototype of the standards, methodologies, and recommendations
under subsection (b), the Director shall publish in the Federal
Register a final version of such standards, methodologies, and
recommendations.
(d) Consultation.--In developing the standards, methodologies, and
recommendations referred to in paragraph (2) of subsection (a), the
Director shall consult with the following:
(1) The Secretary of Defense.
(2) The National Cyber Director.
(3) The Director of the Cybersecurity and Infrastructure
Security Agency.
(4) Cloud service providers.
(5) Owners and operators of critical infrastructure.
(6) Associations of entities in critical infrastructure
sectors, such as banking and finance and public health and
health care.
(7) Entities that satisfy the following requirements (as
determined by the Director):
(A) Are academic or not-for-profit.
(B) Have expertise in cloud security and artificial
intelligence governance.
(e) Certification.--
(1) In general.--Not later than one year after the
publication of the final version of the standards,
methodologies, and recommendations under subsection (c), the
Director, in coordination with Director of the Cybersecurity
and Infrastructure Security Agency, shall establish a program,
to be known as the ``Cloud Security Certification Program'' (in
this section referred to as the ``Program''), that satisfies
the following requirements:
(A) Is voluntary.
(B) Is modeled to the extent practicable on the IT
Security Validation Programs of the National Institute
of Standards and Technology, such that third-party,
independent, private-sector, accredited testing
laboratories conduct evaluations and make
determinations on whether to certify an entity's
conformance with such standards, methodologies, and
recommendations, including with respect to the
following:
(i) Blast radius.
(ii) Intracloud attack.
(iii) Third-party application integration.
(iv) Workload identity.
(C) Includes a public database of each such
certification.
(D) Includes tiered certification levels.
(2) Deadline.--Not later than 90 days after the date on
which an entity submits to a laboratory under the Program an
application for a certification described in subparagraph (B)
of paragraph (1), such laboratory shall make for such entity a
determination under such subparagraph.
(f) Federal Risk and Authorization Management Program.--Not later
than one year after the publication of the final version of the
standards, methodologies, and recommendations under subsection (c), the
Director of the Office of Management and Budget, in coordination with
the Director of the Cybersecurity and Infrastructure Security Agency
and the Administrator of General Services, shall update the Federal
Risk and Authorization Management Program to conform with such
standards, methodologies, and recommendations, including by requiring
each private sector entity that provides cloud services to the Federal
Government to disclose to the Director of the Office information
relating to the following:
(1) The aggregate blast radius of such entity.
(2) East-west traffic monitoring, network traffic
inspection, and policy-based filtering conducted by such
entity.
(3) The scope and access levels of any third-party
application integrations in the cloud environments of such
entity.
(g) Report.--Not later than one year after the publication of the
final version of the standards, methodologies, and recommendations
under subsection (c), the Director shall submit to the Committee on
Science, Space, and Technology of the House of Representatives and the
Committee on Commerce, Science, and Transportation of the Senate a
report that includes information relating to the following:
(1) Implementation by Federal departments and agencies of
such standards, methodologies, and recommendations.
(2) The gaps and challenges, if any, with respect to the
adoption of such standards, methodologies, and recommendations
by private sector entities.
(3) Recommendations of the Director for legislative or
administrative action with respect to the cybersecurity of
cloud-based infrastructure.
(h) Definitions.--In this section:
(1) Artificial intelligence.--The term ``artificial
intelligence'' has the meaning given such term in section 5002
of the National Artificial Intelligence Initiative Act of 2020
(15 U.S.C. 9401).
(2) Blast radius.--The term ``blast radius'' means the
maximum potential scope of unauthorized data access or system
compromise from a compromised workload, data asset, or
credential in a cloud environment.
(3) Cloud-based infrastructure.--The term ``cloud-based
infrastructure'' means computing, storage, and networking
services, including infrastructure-as-a-service, platform-as-a-
service, and software-as-a-service, provided through a public,
private, or hybrid cloud environment.
(4) Critical infrastructure.--The term ``critical
infrastructure'' has the meaning given such term in section
1016 of the USA PATRIOT Act (42 U.S.C. 5195c).
(5) Critical infrastructure sectors.--The term ``critical
infrastructure sectors'' has the meaning given such term in
section 2001 of the Homeland Security Act of 2002 (6 U.S.C.
601).
(6) East-west traffic.--The term ``east-west traffic''
means network traffic between virtual machines, containers, or
services in a cloud data center or cloud environment.
(7) Intracloud attack.--The term ``intracloud attack''
means an action by a threat actor to exploit a vulnerability or
misconfiguration of a cloud environment and conduct
unauthorized lateral movement, privilege escalation, or data
exfiltration with respect to such environment.
(8) Network traffic inspection.--The term ``network traffic
inspection'' means the monitoring, examination, and analysis of
network communications to identify, assess, log, or respond to
malicious, unauthorized, or anomalous activity or support the
enforcement of a cybersecurity policy.
(9) Policy-based filtering.--The term ``policy-based
filtering'' means the application of a predefined security
policy to permit, deny, restrict, log, or otherwise control
network communications based on the source, destination, or
content of such communications or an indicator of malicious or
unauthorized activity.
(10) Third-party application integration.--The term
``third-party application integration'' means the ability of a
third party or external software service to interact with a
cloud environment through a standardized authorization protocol
or application programming interface.
(11) Workload identity.--The term ``workload identity''
means the digital credentials and tokens utilized by a nonhuman
entity to authenticate or access a cloud resource.
<all>