Sec. 1692. Prohibition on access to Department of Defense cloud-based resources by certain individuals
417 words·~2 min read·
/bill/119/s/1071/eah/section-1692A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
The Secretary of Defense shall prohibit any individual physically located in a covered nation from having any of the accesses described in paragraph (2). The accesses described in this paragraph are the following: Physical access to any facility, hardware, or equipment that hosts or operates a Department of Defense cloud computing system. Logical or remote access to a Department of Defense cloud computing system, including with respect to management interfaces, virtualization platforms, security controls, or monitoring systems.
Logical or remote access to Department of Defense data or workloads on a Department of Defense cloud computing system, including with respect to applications, configurations, network architecture, data schemas, security settings, access logs or other information that could compromise the confidentiality, integrity, or availability of the system, software, or data. Indirect access to confidential and technical information not publicly available about a Department of Defense cloud computing system through observation, documentation, briefings, or other communication means (excluding administrative data normally shared to support business operations and compliance requirements applied to publicly traded companies).
The Secretary shall— review all relevant guidance, directives, procedures, requirements, and regulations of the Department of Defense, including the Cloud Computing Security Requirements Guide, the Security Technical Implementation Guides, and related instructions of the Department; and make such revisions as may be necessary to ensure conformity and compliance with subsection (a). The Secretary shall provide to the congressional defense committees briefings on the implementation of this section as follows:
Not later than June 1, 2026, an initial briefing on the implementation status, including policies, procedures, and controls implemented to carry out this section. Not later than June 1, 2027, and annually thereafter through 2028, briefings on the implementation progress, effectiveness of controls, security incidents, and recommendations for legislative or administrative action. Nothing in this section shall be construed to prohibit or restrict— software development activities, including the development, modification, or contribution to open-source code and software; or collaboration on or access to publicly available open-source software components that may be incorporated into Department of Defense cloud computing systems. ln this section:
The term covered nation has the meaning given that term in section 4872 of title 10, United States Code. The term Department of Defense cloud computing system means any cloud computing (as defined by section 239.7601 of the Defense Federal Acquisition Regulation Supplement) environment accredited by the Secretary of Defense for controlled unclassified information or classified information, or a cloud computing environment that is a national security system (as defined by section 3552(b)(6) of title 44).