Prohibition on access to Department of Defense cloud-based resources by individuals who are not citizens of the United States or allied countries

(a) Maintenance, administration, operation, and access (1) Prohibition No individual who is a citizen of a foreign country of concern may maintain, administer, operate, use, receive information about, or directly access or indirectly access, regardless of whether the individual is supervised by a citizen of the United States, any Department of Defense cloud computing system. (2) Safeguards The Secretary of Defense shall establish regulations to carry out this subsection, including safeguards to ensure that only individuals the Secretary determines appropriate may maintain, administer, operate, access, and use the systems, software, and data described in paragraph (1). (b) Department of Defense guidance, directives, procedures, requirements, and regulations The Secretary shall— (1) review all relevant guidance, directives, procedures, requirements, and regulations of the Department of Defense, including the Cloud Computing Security Requirements Guide, the Security Technical Implementation Guides, and related Department instructions; and (2) make such revisions as may be necessary to ensure conformity and compliance with subsection (a). (c) Review and report The Secretary shall— (1) conduct a review of all cloud computing contracts in effect for the Department— (A) for any violations of section 252.225–7058 of the Defense Federal Acquisition Regulation Supplement and recommended penalties; and (B) to determine— (i) which contracts have allowed unauthorized individuals to maintain, administer, operate, or directly access or indirectly access, whether supervised or unsupervised by a United States citizen, any Government cloud computing system; and (ii) how many of the individuals described in clause (i) are citizens of foreign countries of concern; and (2) submit to the Committee on Armed Services of the Senate and the Committee on Armed Services of the House of Representatives a report on the findings of the Secretary with respect to the review conducted pursuant to paragraph (1). (d) Definitions ln this section: (1) The term cloud computing has the meaning given such term in section 239.7601 of the Defense Federal Acquisition Regulation Supplement, or successor regulation. (2) The term directly access, with respect to a system, software, or data, means— (A) to physically access the system, software, or data; or (B) to logically access the system, software, or data, through proxy, virtual, administrative, or programmatic means such that an individual can modify, alter, control, administer, configure, or deploy the system, software, or data. (3) The term foreign country of concern has the meaning given that term in section 9901 of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (15 U.S.C. 4651). (4) The term indirectly access, with respect to a system, software, or data, means to obtain, receive, collect, or derive information from the system, software, or data regarding technical details, operational characteristics, or security-related attributes, including— (A) system configurations; (B) network architecture; (C) security controls; (D) data schemas; (E) performance metrics; and (F) access logs or other information that could compromise the confidentiality, integrity, or availability of the system, software, or data.