,i  #aai? ,,congress  #b;d ,session  ,h4
 ,r4 #ajiae  ,,9 ,,! ,,h\se ,,(         
,,repres5tatives  ,octob] #bf1 #bjbf,mr4
 ,mc,cormick introduc$ ! foll[+ bill2   
:i* 0 ref]r$ to ! ,committee on ,sci5ce1
 ,space1 & ,te*nology1 & 9 addition to !
 ,committee on ,ov]sight & ,gov]nm5t    
,re=m1 = a p]iod to be subsequ5tly      
det]m9$ by ! ,speak]1 9 ea* case =      
consid]ation ( su* provisions z fall )9 
! jurisdiction ( ! committee conc]n$  ,a
 ,,bill  ,to require ! ,director ( !    
,national ,in/itute ( ,/&>ds &          
,te*nology to develop new /&>ds1        
me?odologies1 & recomm5dations ) respect
 to ! cyb]security ( cl\d-bas$          
infra/ructure1 & = o!r purposes4  #a4   
,%ort title ,?is ,act may be cit$ z !   
,common-,s5se ,cl\d ,security ,act4  #b4
 ,national ,in/itute ( ,/&>ds &         
,te*nology special publication on !     
cyb]security ( cl\d-bas$ infra/ructure  
7a7 ,9 g5]al ,n lat] ?an #ahj days aft] 
! date ( ! enactm5t ( ?is ,act1 !       
,director ( ! ,national ,in/itute (     

,/&>ds & ,te*nology 79 ?is section      
ref]r$ to z ! ,director7 %all solicit   
?r\gh ! ,f$]al ,regi/] public comm5t on 
! foll[+3  7#a7 ,! exi/+ /&>ds1         
me?odologies1 & recomm5dations ( !      
,in/itute ) respect to ! cyb]security ( 
cl\d-bas$ infra/ructure4  7#b7 ,develop+
 new /&>ds1 me?odologies1 &             
recomm5dations ( ! ,in/itute ) respect  
to su* cyb]security1 t include ! foll[+3
  7,a7 ,/&>ds = manag+ & secur+ !       
digital id5tities utiliz$ ) respect to  
su* infra/ructure1 includ+ /&>ds to l9k 
log9s & o!r access cr$5tials = an       
acc\nt1 :i* may be an ag5tic acc\nt1 to 
a device4  7,b7 ,/&>ds = a sy/em ?r\gh  
:i* cl\d s]vice provid]s are able to    
monitor & address security al]ts &      
unau?oriz$ or malici\s activity4  7,c7  
,recomm5dations reg>d+ ! foll[+3 7i7    
,address+ ! prev5tion1 detection1 &     
mitigation ( intracl\d attacks &        
unau?oriz$ ea/-we/ traffic4  7ii7       
,vett+1 au?oriz+1 & cont9u\sly monitor+ 
?ird-p>ty application integrations &    

s(tw>e-z-a-s]vice applications1 to      
ensure t su* integrations & applications
 h appropriate access to ! cl\d         
environm5ts ( su* provid]s4  7iii7      
,adopt+ artificial intellig5ce tools = !
 detection ( unusual or suspici\s       
activity 9 su* environm5ts1 9 a mann] t 
resembles su* adoption by ! ,f$]al      
,gov]nm5t & o!r public sector entities4 
7,d7 ,a me?odology by :i* su* a provid] 
is able to det]m9e ! bla/ radius ( su*  
provid]4  7b7 ,prototype ,n lat] ?an #ej
 days aft] ! date ( ! solicitation "u   
subsection 7a71 ! ,director %all c>ry   
out ! foll[+3  7#a7 ,publi% 9 ! ,f$]al  
,regi/] a prototype ( ! /&>ds1          
me?odologies1 & recomm5dations ref]r$ to
 9 p>agraph 7#b7 ( su* subsection4  7#b7
 ,solicit ?r\gh ! ,f$]al ,regi/] public 
comm5t on su* prototype4  7c7 ,f9al     
v]sion ,n lat] ?an #ace days aft] !     
publication ( ! prototype ( ! /&>ds1    
me?odologies1 & recomm5dations "u       
subsection 7b71 ! ,director %all publi% 
9 ! ,f$]al ,regi/] a f9al v]sion ( su*  

/&>ds1 me?odologies1 & recomm5dations4  
7d7 ,consultation ,9 develop+ ! /&>ds1  
me?odologies1 & recomm5dations ref]r$ to
 9 p>agraph 7#b7 ( subsection 7a71 !    
,director %all consult ) ! foll[+3  7#a7
 ,! ,secret>y ( ,def5se4  7#b7 ,!       
,national ,cyb] ,director4  7#c7 ,!     
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy4  7#d7  
,cl\d s]vice provid]s4  7#e7 ,own]s &   
op]ators ( critical infra/ructure4  7#f7
 ,associations ( entities 9 critical    
infra/ructure sectors1 su* z bank+ &    
f9ance & public heal? & heal? c>e4  7#g7
 ,entities t satisfy ! foll[+           
requirem5ts 7z det]m9$ by ! ,director73 
7,a7 ,are academic or n-=-pr(it4  7,b7  
,h exp]tise 9 cl\d security & artificial
 intellig5ce gov]nance4  7e7            
,c]tification  7#a7 ,9 g5]al ,n lat] ?an
 "o ye> aft] ! publication ( ! f9al     
v]sion ( ! /&>ds1 me?odologies1 &       
recomm5dations "u subsection 7c71 !     
,director1 9 coord9ation ) ,director ( !
 ,cyb]security & ,infra/ructure         

,security ,ag5cy1 %all e/abli% a        
program1 to be kn[n z ! ,cl\d ,security 
,c]tification ,program 79 ?is section   
ref]r$ to z ! ,program71 t satisfies !  
foll[+ requirem5ts3  7,a7 ,is volunt>y4 
7,b7 ,is model$ to ! ext5t practicable  
on ! ,,x ,security ,validation ,programs
 ( ! ,national ,in/itute ( ,/&>ds &     
,te*nology1 su* t ?ird-p>ty1 indep5d5t1 
private-sector1 accr$it$ te/+           
laboratories conduct evaluations & make 
det]m9ations on :e!r to c]tify an       
entity's con=mance ) su* /&>ds1         
me?odologies1 & recomm5dations1 includ+ 
) respect to ! foll[+3  7i7 ,bla/       
radius4  7ii7 ,intracl\d attack4  7iii7 
,?ird-p>ty application integration4     
7iv7 ,workload id5tity4  7,c7 ,includes 
a public database ( ea* su*             
c]tification4  7,d7 ,includes ti]$      
c]tification levels4  7#b7 ,deadl9e ,n  
lat] ?an #ij days aft] ! date on :i* an 
entity submits to a laboratory "u !     
,program an application = a c]tification
 describ$ 9 subp>agraph 7,b7 ( p>agraph 

7#a71 su* laboratory %all make = su*    
entity a det]m9ation "u su* subp>agraph4
  7f7 ,f$]al ,risk & ,au?orization      
,managem5t ,program ,n lat] ?an "o ye>  
aft] ! publication ( ! f9al v]sion ( !  
/&>ds1 me?odologies1 & recomm5dations "u
 subsection 7c71 ! ,director ( ! ,(fice 
( ,managem5t & ,budget1 9 coord9ation ) 
! ,director ( ! ,cyb]security &         
,infra/ructure ,security ,ag5cy & !     
,adm9i/rator ( ,g5]al ,s]vices1 %all    
update ! ,f$]al ,risk & ,au?orization   
,managem5t ,program to con=m ) su*      
/&>ds1 me?odologies1 & recomm5dations1  
includ+ by requir+ ea* private sector   
entity t provides cl\d s]vices to !     
,f$]al ,gov]nm5t to disclose to !       
,director ( ! ,(fice in=mation relat+ to
 ! foll[+3  7#a7 ,! aggregate bla/      
radius ( su* entity4  7#b7 ,ea/-we/     
traffic monitor+1 network traffic       
inspection1 & policy-bas$ filt]+        
conduct$ by su* entity4  7#c7 ,! scope &
 access levels ( any ?ird-p>ty          
application integrations 9 ! cl\d       

environm5ts ( su* entity4  7g7 ,report  
,n lat] ?an "o ye> aft] ! publication ( 
! f9al v]sion ( ! /&>ds1 me?odologies1 &
 recomm5dations "u subsection 7c71 !    
,director %all submit to ! ,committee on
 ,sci5ce1 ,space1 & ,te*nology ( ! ,h\se
 ( ,repres5tatives & ! ,committee on    
,comm]ce1 ,sci5ce1 & ,transportation ( !
 ,s5ate a report t includes in=mation   
relat+ to ! foll[+3  7#a7 ,implem5tation
 by ,f$]al dep>tm5ts & ag5cies ( su*    
/&>ds1 me?odologies1 & recomm5dations4  
7#b7 ,! gaps & *all5ges1 if any1 )      
respect to ! adoption ( su* /&>ds1      
me?odologies1 & recomm5dations by       
private sector entities4  7#c7          
,recomm5dations ( ! ,director =         
legislative or adm9i/rative action )    
respect to ! cyb]security ( cl\d-bas$   
infra/ructure4  7h7 ,def9itions ,9 ?is  
section3  7#a7 ,artificial intellig5ce  
,! t]m artificial intellig5ce has !     
mean+ giv5 su* t]m 9 section #ejjb ( !  
,national ,artificial ,intellig5ce      
,initiative ,act ( #bjbj 7#ae ,u4,s4,c4 

#idja74  7#b7 ,bla/ radius ,! t]m bla/  
radius means ! maximum pot5tial scope ( 
unau?oriz$ data access or sy/em         
compromise f a compromis$ workload1 data
 asset1 or cr$5tial 9 a cl\d environm5t4
  7#c7 ,cl\d-bas$ infra/ructure ,! t]m  
cl\d-bas$ infra/ructure means comput+1  
/orage1 & network+ s]vices1 includ+     
infra/ructure-z-a-s]vice1               
plat=m-z-a-s]vice1 & s(tw>e-z-a-s]vice1 
provid$ ?r\gh a public1 private1 or     
hybrid cl\d environm5t4  7#d7 ,critical 
infra/ructure ,! t]m critical           
infra/ructure has ! mean+ giv5 su* t]m 9
 section #ajaf ( ! ,,usa ,,patriot ,act 
7#db ,u4,s4,c4 #eaie;c74  7#e7 ,critical
 infra/ructure sectors ,! t]m critical  
infra/ructure sectors has ! mean+ giv5  
su* t]m 9 section #bjja ( ! ,homel&     
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#fja74  7#f7 ,ea/-we/ traffic ,! t]m    
ea/-we/ traffic means network traffic   
betwe5 virtual ma*9es1 conta9]s1 or     
s]vices 9 a cl\d data c5t] or cl\d      
environm5t4  7#g7 ,intracl\d attack ,!  

t]m intracl\d attack means an action by 
a ?reat actor to exploit a vuln]ability 
or misconfiguration ( a cl\d environm5t 
& conduct unau?oriz$ lat]al movem5t1    
privilege escalation1 or data           
exfiltration ) respect to su*           
environm5t4  7#h7 ,network traffic      
inspection ,! t]m network traffic       
inspection means ! monitor+1 exam9ation1
 & analysis ( network communications to 
id5tify1 assess1 log1 or respond to     
malici\s1 unau?oriz$1 or anomal\s       
activity or support ! en=cem5t ( a      
cyb]security policy4  7#i7 ,policy-bas$ 
filt]+ ,! t]m policy-bas$ filt]+ means !
 application ( a pr$ef9$ security policy
 to p]mit1 d5y1 re/rict1 log1 or o!rwise
 control network communications bas$ on 
! s\rce1 de/9ation1 or cont5t ( su*     
communications or an indicator (        
malici\s or unau?oriz$ activity4  7#aj7 
,?ird-p>ty application integration ,!   
t]m ?ird-p>ty application integration   
means ! ability ( a ?ird p>ty or ext]nal
 s(tw>e s]vice to int]act ) a cl\d      

environm5t ?r\gh a /&>diz$ au?orization 
protocol or application programm+       
int]face4  7#aa7 ,workload id5tity ,!   
t]m workload id5tity means ! digital    
cr$5tials & tok5s utiliz$ by a nonhuman 
entity to au!nticate or access a cl\d   
res\rce4