Sec. 1624. Plan for commercial cloud test and evaluation
206 words·~1 min read·
/bill/117/s/4543/rs/section-1624·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense, in consultation with commercial industry, shall submit to the Committee on Armed Services of the Senate and the Committee on Armed Services of the House of Representatives a policy and plan for test and evaluation of the cybersecurity of the clouds of commercial cloud service providers. The policy and plan submitted under subsection
(a)shall include the following: A requirement that all future contracts with cloud service providers include provisions that permit the Department to conduct independent, threat-realistic assessments, including penetration testing, of the commercial cloud infrastructure, including the control plane and virtualization hypervisor. An explanation as to how the Department intends to proceed on amending existing contracts with cloud service providers to permit the same level of rigorous assessments that will be required for all future contracts. Identification and description of any proposed tiered test and evaluation requirements aligned with different impact and classification levels. The policy and plan required under subsection
(a)may provide an authority to waive any requirements described in subsection
(b)conditioned upon the approval of the Chief Information Officer of the Department of Defense and the Director of Operational Test and Evaluation.