Department of Defense cloud security authorization reciprocity pilot program

(a) Establishment Not later than 180 days after the date of the enactment of this Act, the Chief Information Officer of the Department of Defense shall, in consultation with the Director of the Defense Information Systems Agency, establish a pilot program on cloud security authorization reciprocity to assess the feasibility and advisability of creating a reciprocal compliance baseline between the Federal Risk and Authorization Management Program (FedRAMP) for civilian agency networks and the Cloud Computing Security Requirements Guide (CC SRG) of the Department of Defense for Department of Defense networks and national security systems. (b) Selection of solutions Under the pilot program required by subsection (a), the Chief Information Officer shall select a minimum of five cybersecurity solutions authorized at the FedRAMP high impact level and perform an accelerated assessment to validate them for CC SRG impact level 5. (c) Report to congressional committees (1) In general Not later than one year after the date of the establishment of the pilot program required by subsection (a), the Chief Information Officer shall submit to the congressional defense committees a report on the findings of the Chief Information Officer with respect to the pilot program. (2) Contents The report submitted under paragraph (1) shall cover the following: (A) The findings described in paragraph (1), including a detailed analysis of benefits, risks, and any specific security control gaps. (B) A strategy and implementation plan to establish a reciprocal compliance mechanism for CC SRG and FedRAMP cybersecurity requirements. (C) An assessment of the feasibility and advisability of expanding the number of authorized cybersecurity solutions to participate in the pilot program. (3) Form The report submitted under paragraph (1) shall be submitted in unclassified form, but may include a classified annex.