Federal officials would publish cloud security standards and offer certification

The national standards agency would seek public comments, publish a draft for more comments, then publish final cloud security standards and guidance. They would cover cloud computing, storage, and networking services in public, private, or mixed cloud systems. The standards and guidance would address account access, security alerts, attacks within cloud systems, and outside apps. Officials would seek initial comments within 180 days after enactment, publish a draft within 50 days after that request, and publish a final version within 135 days after the draft.

The national standards agency, working with the federal cybersecurity agency, would set up a voluntary cloud security certification program. The program would cover entities that choose to apply for cloud security certification. Accredited, independent private labs would decide whether applicants meet the standards and guidance. The program would have certification levels and list each certification in a public database. Officials would set up the program within one year after publishing the final standards; a lab would decide an application within 90 days after submission.

The federal budget office would update the government’s cloud security review program to match the final standards and guidance. The disclosure requirement would apply to private companies providing cloud services to the federal government. The update would require covered firms to disclose the potential reach of a breach, how they check traffic within their cloud systems, and what access they give outside apps. The update would be due within one year after the final standards and guidance are published.