Common-Sense Cloud Security Act (119th Congress)
AI-generated text. This page was generated using artificial intelligence.
Common-Sense Cloud Security Act
United States
Proposed federal legislation
H.R. 10915, 119th Congress, introduced print
Introduced and referred to two House committees October 26, 2026; not enacted.
Proposed staged deadlines contingent on enactment and later NIST publication.
October 29, 2026 — complete introduced text and current official history.
Status
The Common-Sense Cloud Security Act, H.R. 10915, is a proposal introduced by Representative Richard McCormick on October 26, 2026. It was referred to the House Science, Space, and Technology Committee and additionally to Oversight and Government Reform. The current official history records no later action. The proposed standards, certification and federal procurement changes described below depend on enactment.[1]
Proposed cloud-security standards
Section 2(a) would require NIST to solicit public comment within 180 days after enactment on existing cloud-security standards and new standards, methodologies and recommendations. The specified subjects include device-linked digital identities, including agentic accounts; provider security alerts; intracloud attacks and lateral traffic; continuously monitored third-party integrations; AI-assisted detection of unusual activity; and assessment of the potential reach of a compromise.[2]
NIST would publish a prototype and solicit comments within 50 days after that initial solicitation, then publish a final version within 135 days after the prototype. Required consultation includes defense and cybersecurity officials, providers, critical-infrastructure operators and associations, and qualifying academic or nonprofit cloud-security/AI-governance experts.[2]
Voluntary certification and federal procurement
Within one year after the final standards are published, NIST, coordinating with CISA, would establish a voluntary Cloud Security Certification Program. Accredited independent private laboratories would evaluate conformance, with tiered certifications and a public database. A laboratory would decide an application within 90 days after submission.[2]
Within the same one-year period after final publication, OMB, coordinating with CISA and GSA, would align FedRAMP with the standards. The proposed alignment would require federal cloud-service providers to disclose their aggregate potential compromise scope, lateral-traffic monitoring and inspection/filtering, and third-party integration access. The voluntary certification provision does not erase this separate proposed federal-procurement direction.[2]
NIST would also report to the specified congressional committees within one year after final publication on federal implementation, private-sector adoption gaps and recommendations. These are staged conditional deadlines, not presently running calendar dates.[2]
Definitions and limits
Cloud infrastructure includes computing, storage and networking supplied through public, private or hybrid clouds, including infrastructure-, platform- and software-as-a-service. “Workload identity” means credentials and tokens used by nonhuman entities to authenticate or access a cloud resource; “blast radius” concerns the maximum potential scope of unauthorized access or compromise. The proposal’s AI definition refers to the National Artificial Intelligence Initiative Act of 2020.[2]
Related coverage
References
- ↑ Official H.R. 10915 bill-status record, updated October 28 and reviewed October 29, 2026; October 26 introduction and committee referral remain the latest recorded actions.
- ↑ 2.0 2.1 2.2 2.3 2.4 2.5 H.R. 10915, complete Introduced in House text, October 26, 2026, §§1–2 including all definitions, reviewed October 29.