McCormick introduces Common

A U.S. Republican Representative from Georgia introduced the Common-Sense Cloud Security Act to strengthen cloud cybersecurity by directing the National Institute of Standards and Technology (NIST) to develop updated standards for protecting sensitive data, preventing cyberattacks and securing critical infrastructure. The legislation would strengthen protections against unauthorized access and malicious activity while establishing a voluntary certification program to help cloud service providers meet modern cybersecurity standards.

Rich McCormick identified that the move addresses risks to information stored and accessed through cloud-based systems, including financial information, medical records, national security data and critical infrastructure systems. The proposed legislation would require NIST to work with federal cybersecurity officials, cloud service providers, critical infrastructure operators and academic experts to address cloud vulnerabilities, including through the use of artificial intelligence to detect suspicious activity.

Furthermore, it would also direct NIST to report to Congress on federal implementation, private-sector adoption challenges and recommendations for improving cloud security, update the Federal Risk and Authorization Management Program (FedRAMP), and establish a voluntary, tiered cloud security certification program based on independent, accredited testing. Other provisions would strengthen third-party software integration vetting, authorization and continuous monitoring, improve methods for assessing the scope and spread of cloud security breaches, and enhance digital identity protections by linking account credentials to specific devices.

“In 2026, nearly everything we do relies on the cloud. From our financial information and medical records to our national security and critical infrastructure, our most sensitive information is stored and accessed through cloud-based systems,” Congressman McCormick said in a media statement this week. “Our adversaries, including China, are constantly looking for ways to exploit vulnerabilities, launch cyberattacks, and steal sensitive American information. We cannot afford to leave Americans exposed to these threats. The Common-Sense Cloud Security Act strengthens our cyber defenses, protects sensitive information, and keeps America one step ahead of our adversaries.”

The Common-Sense Cloud Security Act would require the director of the National Institute of Standards and Technology (NIST) to solicit public through the Federal Register within 180 days of the act’s enactment. The would cover the institute’s existing standards, methodologies and recommendations on the cybersecurity of cloud-based infrastructure. They would also cover the development of new ones.

The new standards, methodologies and recommendations would include standards for managing and securing the digital identities used with cloud infrastructure. These would include standards to link logins and other access credentials for an account, which may be an agentic account, to a device. They would also include standards for a system through which cloud service providers can monitor and address security alerts and unauthorized or malicious activity.

The new work would also produce recommendations on three areas. The first is preventing, detecting and mitigating intracloud attacks and unauthorized east-west traffic. The second is vetting, authorizing and continuously monitoring third-party application integrations and software-as-a-service applications to ensure they have appropriate access to providers’ cloud environments. The third is adopting artificial intelligence tools to detect unusual or suspicious activity in those environments, in a manner that resembles adoption by the federal government and other public sector entities. In addition, the work would include a methodology by which a cloud provider can determine its blast radius.

The Act would also require the director of the National Institute of Standards and Technology to solicit public through the Federal Register within 180 days of the Act’s enactment. The would cover the institute’s existing standards, methodologies and recommendations on the cybersecurity of cloud-based infrastructure, as well as the development of new ones. The new work would include standards for managing and securing digital identities used with cloud infrastructure, including standards to link logins and other access credentials for an account, which may be an agentic account, to a device. It would also include standards for a system through which cloud service providers can monitor and address security alerts and unauthorized or malicious activity.

The new work would also produce recommendations in three areas. The first is preventing, detecting and mitigating intracloud attacks and unauthorized east-west traffic. The second is vetting, authorizing and continuously monitoring third-party application integrations and software-as-a-service applications to ensure they have appropriate access to providers’ cloud environments. The third is adopting artificial intelligence tools to detect unusual or suspicious activity in those environments, in a manner that resembles adoption by the federal government and other public sector entities. The work would also include a methodology by which a cloud provider can determine its blast radius.

Within 50 days of the solicitation, the director would publish a prototype of the standards, methodologies and recommendations in the Federal Register and seek public on it. Within 135 days of publishing the prototype, the director would publish a final version. In developing the final version, the director would consult the Secretary of Defense, the national cyber director, the director of the Cybersecurity and Infrastructure Security Agency, cloud service providers, and owners and operators of critical infrastructure. The director would also consult associations in critical infrastructure sectors, such as banking and finance and public health and health care, as well as academic or not-for-profit entities with expertise in cloud security and artificial intelligence governance.

The Common-Sense Cloud Security Act also prescribed that within one year of the final version’s publication, the director, in coordination with the CISA director, would establish a voluntary Cloud Security Certification Program. The program would be modeled, to the extent practicable, on NIST’s IT Security Validation Programs. Third-party, independent, accredited private-sector testing laboratories would evaluate whether to certify an entity’s conformance with the standards, including on blast radius, intracloud attacks, third-party application integration and workload identity. The program would include a public database of certifications and tiered certification levels, and laboratories would have to decide within 90 days of receiving an application.

Within the same one-year period, the director of the Office of Management and Budget, in coordination with the CISA director and the administrator of General Services, would update the Federal Risk and Authorization Management Program to conform with the new standards. The update would require each private sector entity providing cloud services to the federal government to disclose its aggregate blast radius. Providers would also have to disclose their east-west traffic monitoring, network traffic inspection and policy-based filtering, as well as the scope and access levels of any third-party application integrations in their cloud environments.

Within one year of the final version’s publication, the NIST director would also submit a report to the House Committee on Science, Space, and Technology and the Senate Committee on Commerce, Science, and Transportation. The report would cover how federal departments and agencies have implemented the standards, and any gaps and challenges private sector entities face in adopting them.