S.Amdt. 3218

SA 3218. Mr. COTTON submitted an amendment intended to be proposed by
him to the bill S. 2296, to authorize appropriations for fiscal year
2026 for military activities of the Department of Defense, for military
construction, and for defense activities of the Department of Energy,
to prescribe military personnel strengths for such fiscal year, and for
other purposes; which was ordered to lie on the table; as follows:

At the appropriate place in title XVI, insert the
following:

SEC. 16__. PROHIBITION ON ACCESS TO DEPARTMENT OF DEFENSE
DATA BY PERSONS WHO ARE NOT UNITED STATES
CITIZENS.

(a) Maintenance, Administration, Operation, and Access.--
(1) In general.--An individual who is not a citizen of the
United States shall not maintain, administer, operate,
access, use, or receive information about, including through
physical or remote means or by proxy, irrespective of whether
the individual is supervised by a citizen of the United
States, any Department of Defense cloud computing system,
Department data, or Department-related data.
(2) Safeguards.--The Secretary of Defense shall establish
regulations to carry out paragraph (1), including safeguards
to ensure that no individual described in paragraph (1)
maintains, administers, operates, accesses, or uses any
system or data in violation of that paragraph.
(b) Department of Defense Guidance, Directives, Procedures,
Requirements, and Regulations.--The Secretary shall--
(1) review all relevant guidance, directives, procedures,
requirements, and regulations of the Department of Defense,
including the Cloud Computing Security Requirements Guide,
the Security Technical Implementation Guides, and related
Department instructions; and
(2) make such revisions as may be necessary to ensure
conformity and compliance with subsection (a).
(c) Review and Report.--The Secretary shall--
(1) conduct a review of all cloud computing contracts in
effect for the Department--
(A) for any violations of section 252.225-7058 of the
Defense Federal Acquisition Regulation Supplement and
recommended penalties; and
(B) to determine--
(i) which contracts have allowed persons who are not United
States citizens to maintain, administer, operate, or access,
through physical, remote, or by proxy, whether supervised or
unsupervised by a United States citizen, any Government cloud
system, Government data, or Government-related data; and
(ii) how many of the persons described in clause (i) are
citizens of foreign countries of concern; and
(2) submit to the Committee on Armed Services of the Senate
and the Committee on Armed Services of the House of
Representatives a report on the findings of the Secretary
with respect to the review conducted pursuant to paragraph
(1).
(d) Definitions.--ln this section:
(1) The term``cloud computing'' has the meaning given such
term in section 239.7601 of the Defense Federal Acquisition
Regulation Supplement, or successor regulation.
(2) The terms ``Department data'' and ``Department-related
data'' have the meanings given the terms ``Government data''
and ``Government-related data'', respectively, in section
239.7601 of the Defense Federal Acquisition Regulation
Supplement, or successor regulation, except in this section,
such terms apply only to the Department of Defense.
(3) The term ``foreign country of concern'' has the meaning
given that term in section 9901 of the William M. (Mac)
Thornberry National Defense Authorization Act for Fiscal Year
2021 (15 U.S.C. 4651).
______