U.S. Congress weighs cloud bill

The Common-Sense Cloud Security Act has been introduced as H.R. 10915 in the 119th Congress, second session. At the same time, a coalition of 35 industry groups asked the leaders of the House and Senate Armed Services committees to keep a provision in the annual defense policy bill that would extend the 2015 Cybersecurity Information Sharing Act through 2035. The current extension expires Dec. 11, according to the coverage cited.

What does the cloud bill propose?

The bill, introduced by Rep. Rich McCormick, would direct NIST to update cybersecurity protocols for cloud environments and set up a voluntary certification program for cloud services. Security Today also described it as covering threat detection, digital identity, supply chain issues and breach assessment.

InsideCyberSec added, without official confirmation in the material available, that NIST would have specific deadlines to work on the proposal: request public comments within 180 days of enactment, publish a prototype 50 days later and a final version 135 days after the prototype. The same report said the scope would include device-linked identity, alert and malicious activity monitoring, third-party integration reviews, AI-based suspicious behavior detection and a method for determining a provider's blast radius.

Industrial Cyber, also without official confirmation in the material provided, detailed operational elements of the program: a public certification registry, tiered levels, independent accredited private labs and a 90-day window for those labs to decide on an application.

What is industry seeking on threat sharing?

The coalition wants Congress to preserve legal protection for sharing cyber threat information for another decade, through 2035, rather than let the current continuity expire on Dec. 11. GovExec reported on the request, and CyberScoop said the House version of the fiscal 2027 defense bill includes a 10-year extension of the 2015 Cybersecurity Information Sharing Act.

In both cases, the central issue is the same legal extension, although the coverage places the process in different legislative venues. GovExec described the industry request before the Armed Services committees of both chambers, while CyberScoop reported that the House version of the NDAA already includes that extension.