,,ii  #aagth ,,congress  #ast ,session  
,s4 #cdjh  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,december #ae1 
#bjba,mr4 ,ossoff introduced the        
following bill2 which was read twice and
 referred to the ,committee on ,homeland
 ,security and ,governmental ,affairs   
,a ,,bill  ,to amend chapter #cf of     
title #dd1 ,united ,states ,code1 to    
require reporting regarding the security
 of cloud computing products and        
services4  #a4 ,short title ,this ,act  
may be cited as the ,federal ,cloud     
,risk ,management ,improvements ,act4   
#b4 ,reporting regarding security of    
cloud computing products and services   
7a7 ,in general ,chapter #cf of title   
#dd1 ,united ,states ,code1 is amended  
by adding at the end the following3     
#cfjg4 ,reporting regarding security of 
cloud computing products and services   
7a7 ,definitions ,in this section3 7#a7 
,agency ,the term agency has the meaning
 given the term in section #cejb4  7#b7 
,cloud computing ,the term cloud        

computing has the meaning given the term
 in ,special ,publication #hjj-ade of   
the ,national ,institute of ,standards  
and ,technology1 or any successor       
document4  7#c7 ,cloud service provider 
,the term cloud service provider means  
an entity offering cloud computing      
products or services to agencies4  7b7  
,reporting ,not later than #a year after
 the date of enactment of this section1 
and annually thereafter1 the            
,administrator of ,general ,services    
shall submit to the ,committee on       
,homeland ,security and ,governmental   
,affairs of the ,senate and the         
,committee on ,oversight and ,reform of 
the ,house of ,representatives a report 
that includes a review of measures taken
 under the ,federal ,risk and           
,authorization ,management ,program1 or 
any successor thereto1 to ensure the    
security of data stored or processed by 
cloud service providers1 which may      
include-- 7#a7 geolocation restrictions 
for provided products or services2  7#b7

 disclosures of foreign elements of     
supply chains of acquired products or   
services2  7#c7 regular disclosures of  
ownership of cloud service providers by 
foreign entities2 and  7#d7 encryption  
requirements for data processed1 stored1
 or transmitted by cloud service        
providers4  4  7b7 ,conforming amendment
 ,the table of sections for chapter #cf 
of title #dd1 ,united ,states ,code1 is 
amended by adding at the end the        
following3  #cfjg4 ,reporting regarding 
security of cloud computing products and
 services4  4