Richard McCormick (R-GA)
Common-Sense Cloud Security Act
A Republican bill with 1 Republican cosponsor · See the cosponsor
Last activity — Referred to the Committee on Science, Space, and Technology, and in addition to the Committee on Oversight and Government Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
In committee
Introduced and handed to a committee in the chamber it started in.
The committee holds it, and most bills are never heard from again. A hearing or a committee vote would be news; silence is the usual outcome, and it kills the bill without anyone voting against it.
Its path through Congress
- Introduced
- In Committee
What this bill would do
This bill requires the Director of the National Institute of Standards and Technology to develop new cybersecurity standards, methodologies, and recommendations for cloud-based infrastructure. The Director must seek public comments, publish a prototype, and release a final version of these new guidelines. Furthermore, the legislation establishes a voluntary Cloud Security Certification Program for entities to demonstrate conformity through independent testing laboratories. It also updates the Federal Risk and Authorization Management Program so that private sector entities providing cloud services to the federal government must disclose specific security information. Finally, the Director must submit a report to specific congressional committees regarding implementation, gaps, and recommendations.
Yes· 3 of 4
- Scored +7
Does this better protect the country from computer attacks?
The bill directs NIST to establish comprehensive cybersecurity standards, methodologies, and a certification program for cloud-based infrastructure to protect critical systems.
- Scored +6
Does this make what the government does easier for the public to see?
The bill requires public comment periods on proposed cybersecurity standards and establishes a public database for the Cloud Security Certification Program.
- Scored +5
Does this put more rules on large technology companies?
The bill institutes mandatory cybersecurity disclosures, new standards, and voluntary certifications for cloud service providers operating within federal programs.
The opposite
- Scored -2
Would business owners be better off under this?
Cloud service providers and private contractors face increased administrative and compliance costs due to new security standards and disclosure mandates.
- Scored -2
Does this make it easier to run a small business?
The compliance and disclosure burdens associated with new cloud security standards could create resource challenges for smaller cloud service providers.
Who it would affect, and how
Potential Positive Impacts for People
-
Public Participation in Security Guidelines: Under Section 2(a) and Section 2(b), the Director is required to solicit public comments on existing standards, proposed new standards, and a prototype of the new cloud cybersecurity recommendations. This allows individuals and groups to provide input and hold officials accountable during the development process.
-
Voluntary Certification Program: Section 2(e) establishes a voluntary Cloud Security Certification Program with tiered levels and a public database of certified entities. This gives cloud service providers and organizations a clear way to prove their security conformance, which can help individuals identify more secure cloud providers.
-
Enhanced Federal Cloud Oversight: Under Section 2(f), the Federal Risk and Authorization Management Program is updated to require private sector entities providing cloud services to the federal government to disclose information related to their aggregate blast radius, east-west traffic monitoring, and third-party application integrations. This ensures better transparency and security for cloud services utilized by the government on behalf of the public.
Potential Negative Impacts for People
-
Compliance Burdens for Providers: Under Section 2(f), private sector entities providing cloud services to the federal government must disclose detailed security information regarding their blast radius, network traffic inspection, and third-party application scopes. Smaller entities or organizations might find these disclosure and conformance requirements burdensome or costly to implement.
-
Potential Delays and Testing Bottlenecks: Under Section 2(e), third-party independent testing laboratories must make certification determinations within 90 days of an entity submitting an application. Entities relying on these certifications may face administrative burdens or delays if testing laboratories experience high volumes of applications.
Groups and Interests Ranking
Every group the model scored this bill for, from -10 to +10. Tap or hover a score for the reason it gave.
- Governance And Ideology
- Does this make what the government does easier for the public to see? — The bill requires public comment periods on proposed cybersecurity standards and establishes a public database for the Cloud Security Certification Program. Does this give the federal government more power? — The legislation expands federal oversight by tasking NIST, CISA, and OMB with developing, implementing, and enforcing new cloud security standards and FedRAMP updates.
- National Security And Foreign Policy
- Does this better protect the country from computer attacks? — The bill directs NIST to establish comprehensive cybersecurity standards, methodologies, and a certification program for cloud-based infrastructure to protect critical systems.
- Education And Technology
- Does this put more rules on large technology companies? — The bill institutes mandatory cybersecurity disclosures, new standards, and voluntary certifications for cloud service providers operating within federal programs.
- Demographic And Interest Groups
- Would business owners be better off under this? — Cloud service providers and private contractors face increased administrative and compliance costs due to new security standards and disclosure mandates.
- Economy And Finance
- Does this make it easier to run a small business? — The compliance and disclosure burdens associated with new cloud security standards could create resource challenges for smaller cloud service providers.
- 11/9/2026
- 1 Cosponsor added.
- 10/26/2026
- Referred to the Committee on Science, Space, and Technology, and in addition to the Committee on Oversight and Government Reform, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
- Introduced in House
Pat HarriganRepublican · North Carolina