Audit and updated guidance to reduce, mitigate, or eliminate risk from cloud computing contracts with foreign exposure

(a) Review of foreign exposure from Department of Defense cloud computing contracts (1) Audit required The Inspector General of the Department of Defense shall conduct an audit of cloud computing contracts for the Department of Defense to assess the risk of exposure of sensitive information, including data, systems architecture details, procedures, or other controlled unclassified information, as a result of policies that may have allowed computer scientists or engineers from foreign countries of concern to access proposed software updates to underlying cloud computing infrastructure or operating systems. (2) Elements The audit conducted pursuant to paragraph (1) shall cover the following: (A) Determination of how many cloud computing contracts the Department has that may be or have been supported by employees located in foreign countries of concern or are citizens of foreign countries of concern. (B) Identification of policies or clauses in such cloud computing contracts that allow for the use of so called digital escorts, computer scientists, or engineers from foreign countries of concern. (C) Assessment of agreements in place that use so called digital escorts to provide oversight to employees from foreign countries of concern, including identification of instances in which such authorities were used during the period beginning on January 1, 2022, and ending on the date of the enactment of this Act. (D) Assessment of the national security risks that stem from cloud computing contracts that use labor from foreign countries of concern. (E) Recommendations on ways to reduce, mitigate, or eliminate risk from initiatives such as so called digital escorting, or the use of computer scientists or engineers from foreign countries of concern. (3) Report to Congress Not later than July 1, 2026, the Inspector General shall submit to the Committee on Armed Services of the Senate and the Committee on Armed Services of the House of Representatives a report setting forth the findings of the Inspector General with respect to the audit conducted pursuant to paragraph (1). (b) Guidance to reduce, mitigate, or eliminate risk (1) Guidance Based on the audit conducted under subsection (a), the Secretary shall issue new guidance to reduce, mitigate, or eliminate risk to Department data or cloud computing infrastructure from foreign countries of concern. (2) Requirements The guidance issued pursuant to paragraph (1) shall— (A) restrict the use of personnel from foreign countries of concern to support Department information technology systems; and (B) require disclosure to the congressional defense committees if the Secretary finds a Department information technology system is maintained by personnel from a foreign country of concern. (3) Waiver The Secretary may waive any guidance issued under paragraph (1) in any case in which the Secretary certifies in writing that such waiver— (A) does not pose a risk to national security; and (B) is necessary in the interest of national security. (c) Definition of foreign country of concern ln this section, the term foreign country of concern has the meaning given that term in section 9901 of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021 (15 U.S.C. 4651).