October 26, 2026
Mr. McCormick introduced the following bill; which was referred to the Committee on Science, Space, and Technology, and in addition to the Committee on Oversight and Government Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned
To require the Director of the National Institute of Standards and Technology to develop new standards, methodologies, and recommendations with respect to the cybersecurity of cloud-based infrastructure, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,
Section 1. Short title
This Act may be cited as the Common-Sense Cloud Security Act
.
Sec. 2. National Institute of Standards and Technology special publication on the cybersecurity of cloud-based infrastructure
(a) In general
Not later than 180 days after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology (in this section referred to as the Director
) shall solicit through the Federal Register public comment on the following:
(1)
The existing standards, methodologies, and recommendations of the Institute with respect to the cybersecurity of cloud-based infrastructure.
(2)
Developing new standards, methodologies, and recommendations of the Institute with respect to such cybersecurity, that include the following:
(A)
Standards for managing and securing the digital identities utilized with respect to such infrastructure, including standards to link logins and other access credentials for an account, which may be an agentic account, to a device.
(B)
Standards for a system through which cloud service providers are able to monitor and address security alerts and unauthorized or malicious activity.
(C)
Recommendations regarding the following:
(i)
Addressing the prevention, detection, and mitigation of intracloud attacks and unauthorized east-west traffic.
(ii)
Vetting, authorizing, and continuously monitoring third-party application integrations and software-as-a-service applications, to ensure that such integrations and applications have appropriate access to the cloud environments of such providers.
(iii)
Adopting artificial intelligence tools for the detection of unusual or suspicious activity in such environments, in a manner that resembles such adoption by the Federal Government and other public sector entities.
(D)
A methodology by which such a provider is able to determine the blast radius of such provider.
(b) Prototype
Not later than 50 days after the date of the solicitation under subsection (a), the Director shall carry out the following:
(1)
Publish in the Federal Register a prototype of the standards, methodologies, and recommendations referred to in paragraph (2) of such subsection.
(2)
Solicit through the Federal Register public comment on such prototype.
(c) Final version
Not later than 135 days after the publication of the prototype of the standards, methodologies, and recommendations under subsection (b), the Director shall publish in the Federal Register a final version of such standards, methodologies, and recommendations.
(d) Consultation
In developing the standards, methodologies, and recommendations referred to in paragraph (2) of subsection (a), the Director shall consult with the following:
(1)
The Secretary of Defense.
(2)
The National Cyber Director.
(3)
The Director of the Cybersecurity and Infrastructure Security Agency.
(4)
Cloud service providers.
(5)
Owners and operators of critical infrastructure.
(6)
Associations of entities in critical infrastructure sectors, such as banking and finance and public health and health care.
(7)
Entities that satisfy the following requirements (as determined by the Director):
(A)
Are academic or not-for-profit.
(B)
Have expertise in cloud security and artificial intelligence governance.
(e) Certification
(1) In general
Not later than one year after the publication of the final version of the standards, methodologies, and recommendations under subsection (c), the Director, in coordination with Director of the Cybersecurity and Infrastructure Security Agency, shall establish a program, to be known as the Cloud Security Certification Program
(in this section referred to as the Program
), that satisfies the following requirements:
(A)
Is voluntary.
(B)
Is modeled to the extent practicable on the IT Security Validation Programs of the National Institute of Standards and Technology, such that third-party, independent, private-sector, accredited testing laboratories conduct evaluations and make determinations on whether to certify an entity’s conformance with such standards, methodologies, and recommendations, including with respect to the following:
(i)
Blast radius.
(ii)
Intracloud attack.
(iii)
Third-party application integration.
(iv)
Workload identity.
(C)
Includes a public database of each such certification.
(D)
Includes tiered certification levels.
(2) Deadline
Not later than 90 days after the date on which an entity submits to a laboratory under the Program an application for a certification described in subparagraph (B) of paragraph (1), such laboratory shall make for such entity a determination under such subparagraph.
(f) Federal Risk and Authorization Management Program
Not later than one year after the publication of the final version of the standards, methodologies, and recommendations under subsection (c), the Director of the Office of Management and Budget, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency and the Administrator of General Services, shall update the Federal Risk and Authorization Management Program to conform with such standards, methodologies, and recommendations, including by requiring each private sector entity that provides cloud services to the Federal Government to disclose to the Director of the Office information relating to the following:
(1)
The aggregate blast radius of such entity.
(2)
East-west traffic monitoring, network traffic inspection, and policy-based filtering conducted by such entity.
(3)
The scope and access levels of any third-party application integrations in the cloud environments of such entity.
(g) Report
Not later than one year after the publication of the final version of the standards, methodologies, and recommendations under subsection (c), the Director shall submit to the Committee on Science, Space, and Technology of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report that includes information relating to the following:
(1)
Implementation by Federal departments and agencies of such standards, methodologies, and recommendations.
(2)
The gaps and challenges, if any, with respect to the adoption of such standards, methodologies, and recommendations by private sector entities.
(3)
Recommendations of the Director for legislative or administrative action with respect to the cybersecurity of cloud-based infrastructure.
(h) Definitions
In this section:
(1) Artificial intelligence
The term artificial intelligence has the meaning given such term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401).
(2) Blast radius
The term blast radius means the maximum potential scope of unauthorized data access or system compromise from a compromised workload, data asset, or credential in a cloud environment.
(3) Cloud-based infrastructure
The term cloud-based infrastructure means computing, storage, and networking services, including infrastructure-as-a-service, platform-as-a-service, and software-as-a-service, provided through a public, private, or hybrid cloud environment.
(4) Critical infrastructure
The term critical infrastructure has the meaning given such term in section 1016 of the USA PATRIOT Act (42 U.S.C. 5195c).
(5) Critical infrastructure sectors
The term critical infrastructure sectors has the meaning given such term in section 2001 of the Homeland Security Act of 2002 (6 U.S.C. 601).
(6) East-west traffic
The term east-west traffic means network traffic between virtual machines, containers, or services in a cloud data center or cloud environment.
(7) Intracloud attack
The term intracloud attack means an action by a threat actor to exploit a vulnerability or misconfiguration of a cloud environment and conduct unauthorized lateral movement, privilege escalation, or data exfiltration with respect to such environment.
(8) Network traffic inspection
The term network traffic inspection means the monitoring, examination, and analysis of network communications to identify, assess, log, or respond to malicious, unauthorized, or anomalous activity or support the enforcement of a cybersecurity policy.
(9) Policy-based filtering
The term policy-based filtering means the application of a predefined security policy to permit, deny, restrict, log, or otherwise control network communications based on the source, destination, or content of such communications or an indicator of malicious or unauthorized activity.
(10) Third-party application integration
The term third-party application integration means the ability of a third party or external software service to interact with a cloud environment through a standardized authorization protocol or application programming interface.
(11) Workload identity
The term workload identity means the digital credentials and tokens utilized by a nonhuman entity to authenticate or access a cloud resource.