,i  #aacth ,,congress  #b;d ,session    
,h4 ,r4 #deje  ,,in ,,the ,,house ,,of  
,,representatives  ,april #bh1 #bjad    
,ms4 ,tsongas 7for herself1 ,mr4        
,kilmer1 ,mr4 ,larsen of ,washington1   
and ,mr4 ,connolly7 introduced the      
following bill2 which was referred to   
the ,committee on ,armed ,services1 and 
in addition to the ,committee on        
,oversight and ,government ,reform1 for 
a period to be subsequently determined  
by the ,speaker1 in each case for       
consideration of such provisions as fall
 within the jurisdiction of the         
committee concerned  ,a ,,bill  ,to     
direct the ,comptroller ,general of the 
,united ,states and the ,chief          
,information ,officer of the ,department
 of ,defense to assess the cloud        
security requirements of the ,department
 of ,defense4  #a4 ,short title ,this   
,act may be cited as the ,,dod ,cloud   
,security ,act4  #b4 ,assessment of     
,department of ,defense cloud security  
requirements  7a7 ,comptroller ,general 

responsibilities ,the ,comptroller      
,general of the ,united ,states shall-- 
7#a7 review and summarize the best      
practices relating to cloud security by 
reviewing the practices of other        
,federal departments and agencies and   
commercial cloud providers2  7#b7 assess
 the cloud capacity of the ,department  
of ,defense and such other departments  
and agencies by assessing how and to    
what extent the ,department has adopted 
commercial cloud2 and  7#c7 assess the  
opportunities for the ,department to    
utilize cloud computing in lieu of or in
 addition to conventional computing4    
7b7 ,chief ,information ,officer        
responsibilities ,the ,chief            
,information ,officer of the ,department
 of ,defense shall--  7#a7 determine the
 security requirements that are         
necessary for any cloud service to store
 ,department of ,defense information1   
including--  7,a7 by individually       
detailing security requirements for each
 ,department of ,defense impact level   

and security classification level2 and  
7,b7 by providing a justification to the
 ,committees on ,armed ,services of the 
,senate and ,house of ,representatives  
for any discrepancy between security    
requirements for different provider     
types2  7#b7 conduct a threat-based     
assessment of whether security controls 
resident in commercial cloud services   
and the cloud services of other ,federal
 departments and agencies meet the      
security requirements determined under  
paragraph 7#b71 including--  7,a7 by    
determining what services can and cannot
 be provided by commercial cloud        
vendors1 based on such security         
requirements2  7,b7 by providing        
justification for why such              
determinations were made by citing1 as  
appropriate1 industry responses to      
requests for information and capability 
statement that confirm the conclusions  
of the ,department of ,defense2 and     
7,c7 by requesting that commercial      
vendors submit their plans for how they 

can adapt their systems to the unique   
and dynamic cyber defense requirements  
of the ,department of ,defense2  7#c7   
require any government-owned1 operated1 
or unique system that is or will be     
designed to provide cloud capabilities  
for the ,department of ,defense to be   
certified and accredited through the    
same process1 and to the same standards1
 that is used to certify and accredit   
commercial service providers2 and  7#d7 
ensure that1 as part of any ,department 
of ,defense pilot demonstrations with   
commercial cloud vendors--  7,a7 an     
analysis is conducted of--  7i7         
requiring the ,defense ,information     
,systems ,agency to work with commercial
 service providers to extend the        
,department of ,defense ,information    
,network to commercial service providers
 that are issued provisional authority  
to operate for ,department of ,defense  
impact levels #a and #b in order to     
leverage the commercial service         
providers for secure connections to the 

,department of ,defense ,information    
,network2  7ii7 the benefits and        
challenges relating to how the secure   
connections would be enabled and        
delivered as a service by the ,,disa    
cloud broker to the commercial service  
providers who have achieved provisional 
authority to operate for ,department of 
,defense impact levels #a and #b2  7iii7
 requiring the ,defense ,information    
,systems ,agency to address the ability 
of commercial service providers to      
provide service for ,department of      
,defense impact levels #c through #e    
using logical separation2  7iv7 the     
ability of commercial service providers 
to provide innovative solutions to the  
separation of customer data and         
supporting resources that do not rely on
 physical separation2  7v7 the benefits 
and challenges regarding the            
consideration of such solutions for     
equivalence to physical separation2 and 
7vi7 the benefits and challenges of     
hybrid solutions for providing cloud    

services2 and  7,b7 the ,chief          
,information ,officer provides to the   
,committees on ,armed ,services of the  
,senate and ,house of ,representatives a
 briefing on the matters referred to in 
subparagraph 7,a7 by not later than #cj 
days after the conclusion of such pilot 
demonstration4