Common-Sense Cloud Security Act

banking and finance and public health and health care. (7) Entities that satisfy the following requirements (as determined by the Director): (A) Are academic or not-for-profit. (B) Have expertise in cloud security and artificial intelligence governance. (e) Certification.-- (1) In general.--Not later than one year after the publication of the final version of the standards, methodologies, and recommendations under subsection (c), the Director, in coordination with Director of the Cybersecurity and Infrastructure Security Agency, shall establish a program, to be known as the ``Cloud Security Certification Program'' (in this section referred to as the ``Program''), that satisfies the following requirements: (A) Is voluntary. (B) Is modeled to the extent practicable on the IT Security Validation Programs of the National Institute of Standards and Technology, such that third-party, independent, private-sector, accredited testing laboratories conduct evaluations and make determinations on whether to certify an entity's conformance with such standards, methodologies, and recommendations, including with respect to the following: (i) Blast radius. (ii) Intracloud attack. (iii) Third-party application integration. (iv) Workload identity. (C) Includes a public database of each such certification. (D) Includes tiered certification levels. (2) Deadline.--Not later than 90 days after the date on which an entity submits to a laboratory under the Program an application for a certification described in subparagraph (B) of paragraph (1), such laboratory shall make for such entity a determination under such subparagraph. (f) Federal Risk and Authorization Management Program.--Not later than one year after the publication of the final version of the standards, methodologies, and recommendations under subsection (c), the Director of the Office of Management and Budget, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency and the Administrator of General Services, shall update the Federal Risk and Authorization Management Program to conform with such standards, methodologies, and recommendations, including by requiring each private sector entity that provides cloud services to the Federal Government to disclose to the Director of the Office information relating to the following: (1) The aggregate blast radius of such entity. (2) East-west traffic monitoring, network traffic inspection, and policy-based filtering conducted by such entity. (3) The scope and access levels of any third-party application integrations in the cloud environments of such entity. (g) Report.--Not later than one year after the publication of the final version of the standards, methodologies, and recommendations under subsection (c), the Director shall submit to the Committee on Science, Space, and Technology of the House of Representatives and the Committee on Commerce, Science, and Transportation of the Senate a report that includes information relating to the following: (1) Implementation by Federal departments and agencies of such standards, methodologies, and recommendations. (2) The gaps and challenges, if any, with respect to the adoption of such standards, methodologies, and recommendations by private sector entities. (3) Recommendations of the Director for legislative or administrative action with respect to the cybersecurity of cloud-based infrastructure. (h) Definitions.--In this section: (1) Artificial intelligence.--The term ``artificial intelligence'' has the meaning given such term in section 5002 of the National Artificial Intelligence Initiative Act of 2020 (15 U.S.C. 9401). (2) Blast radius.--The term ``blast radius'' means the maximum potential scope of unauthorized data access or system compromise from a compromised workload, data asset, or credential in a cloud environment. (3) Cloud-based infrastructure.--The term ``cloud-based infrastructure'' means computing, storage, and networking services, including infrastructure-as-a-service, platform-as-a- service, and software-as-a-service, provided through a public, private, or hybrid cloud environment. (4) Critical infrastructure.--The term ``critical infrastructure'' has the meaning given such term in section 1016 of the USA PATRIOT Act (42 U.S.C. 5195c). (5) Critical infrastructure sectors.--The term ``critical infrastructure sectors'' has the meaning given such term in section 2001 of the Homeland Security Act of 2002 (6 U.S.C. 601). (6) East-west traffic.--The term ``east-west traffic'' means network traffic between virtual machines, containers, or services in a cloud data center or cloud environment. (7) Intracloud attack.--The term ``intracloud attack'' means an action by a threat actor to exploit a vulnerability or misconfiguration of a cloud environment and conduct unauthorized lateral movement, privilege escalation, or data exfiltration with respect to such environment. (8) Network traffic inspection.--The term ``network traffic inspection'' means the monitoring, examination, and analysis of network communications to identify, assess, log, or respond to malicious, unauthorized, or anomalous activity or support the enforcement of a cybersecurity policy. (9) Policy-based filtering.--The term ``policy-based filtering'' means the application of a predefined security policy to permit, deny, restrict, log, or otherwise control network communications based on the source, destination, or content of such communications or an indicator of malicious or unauthorized activity. (10) Third-party application integration.--The term ``third-party application integration'' means the ability of a third party or external software service to interact with a cloud environment through a standardized authorization protocol or application programming interface. (11) Workload identity.--The term ``workload identity'' means the digital credentials and tokens utilized by a nonhuman entity to authenticate or access a cloud resource. <all>