```

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[S. 2871 Reported in Senate (RS)]

<DOC>

                                                       Calendar No. 731
118th CONGRESS
  2d Session
                                S. 2871

                          [Report No. 118-311]

To advance Federal Government innovation through the implementation and 
    use of multi-cloud computing software technology, and for other 
                               purposes.

_______________________________________________________________________

                   IN THE SENATE OF THE UNITED STATES

                           September 20, 2023

  Mr. Daines (for himself, Ms. Rosen, and Mr. Peters) introduced the 
 following bill; which was read twice and referred to the Committee on 
               Homeland Security and Governmental Affairs

            December 19 (legislative day, December 16), 2024

               Reported by Mr. Peters, with an amendment
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]

_______________________________________________________________________

                                 A BILL

 
To advance Federal Government innovation through the implementation and 
    use of multi-cloud computing software technology, and for other 
                               purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

<DELETED>SECTION 1. SHORT TITLE.</DELETED>

<DELETED>    This Act may be cited as the ``Multi-Cloud Innovation and 
Advancement Act of 2023''.</DELETED>

<DELETED>SEC. 2. DEFINITIONS.</DELETED>

<DELETED>    In this Act:</DELETED>
        <DELETED>    (1) Agency.--The term ``agency'' has the meaning 
        given the term in section 3502 of title 44, United States 
        Code.</DELETED>
        <DELETED>    (2) Cloud computing.--The term ``cloud computing'' 
        has the meaning given the term in Special Publication 800-145 
        of the National Institute of Standards and Technology, or any 
        successor document.</DELETED>
        <DELETED>    (3) Comptroller general.--The term ``Comptroller 
        General'' means the Comptroller General of the United 
        States.</DELETED>
        <DELETED>    (4) Director.--The term ``Director'' means the 
        Director of the Office of Management and Budget.</DELETED>
        <DELETED>    (5) Information and communications technology.--
        The term ``information and communications technology''--
        </DELETED>
                <DELETED>    (A) has the meaning given the term in 
                subpart 2.101 of the Federal Acquisition Regulation, or 
                any successor regulation; and</DELETED>
                <DELETED>    (B) includes associated 
                services.</DELETED>
        <DELETED>    (6) Multi-cloud technology.--The term ``multi-
        cloud technology'' means architecture and services that allow 
        for data, application, and program portability, usability, and 
        interoperability between infrastructure, platforms, and hosted 
        applications of multiple cloud computing vendors and between 
        public, private, and edge cloud environments in a manner that 
        securely delivers operational and management consistency, 
        comprehensive visibility, and resiliency.</DELETED>
        <DELETED>    (7) Relevant committees of congress.--The term 
        ``relevant committees of Congress'' means the Committee on 
        Homeland Security and Governmental Affairs of the Senate and 
        the Committee on Oversight and Accountability of the House of 
        Representatives.</DELETED>

<DELETED>SEC. 3. USE OF MULTI-CLOUD TECHNOLOGY.</DELETED>

<DELETED>    (a) In General.--Not later than 1 year after the date of 
enactment of this Act, the Director, in consultation with the 
Administrator of General Services, the Director of the National 
Institute of Standards and Technology, the Secretary of Homeland 
Security, the Administrator of the United States Digital Service, and 
the Administrator of the Office of Electronic Government, shall--
</DELETED>
        <DELETED>    (1) identify and evaluate any impediments to the 
        adoption of multi-cloud technology by agencies;</DELETED>
        <DELETED>    (2) identify best practices for how agencies can 
        implement multi-cloud technology to allow for data portability 
        and interoperability across multiple cloud computing 
        vendors;</DELETED>
        <DELETED>    (3) evaluate the adoption by agencies of 
        cybersecurity frameworks to support multi-cloud technology; 
        and</DELETED>
        <DELETED>    (4) develop written guidance for agencies based on 
        the results of the identification described in paragraph (2) 
        that--</DELETED>
                <DELETED>    (A) describes how agencies should use 
                multi-cloud technology to allow for applications, data, 
                and programs to be portable and interoperable between 
                public, private, and edge cloud environments; 
                and</DELETED>
                <DELETED>    (B) outlines a roadmap for the 
                implementation of multi-cloud technology across 
                agencies not later than January 1, 2025.</DELETED>
<DELETED>    (b) Briefing.--Not later than 1 year after the date of 
enactment of this Act, the Director shall submit to the relevant 
committees of Congress--</DELETED>
        <DELETED>    (1) a copy of the written guidance developed under 
        subsection (a)(4);</DELETED>
        <DELETED>    (2) a briefing on the implementation of multi-
        cloud technology by agencies; and</DELETED>
        <DELETED>    (3) any recommendations relating to the expansion 
        or extension of the implementation described in paragraph 
        (2).</DELETED>

<DELETED>SEC. 4. WORKFORCE DEVELOPMENT STUDY AND TECHNICAL CAPABILITIES 
              ASSESSMENT.</DELETED>

<DELETED>    (a) In General.--Not later than 1 year after the date of 
enactment of this Act, the Comptroller General shall submit to Congress 
and make publicly available a report that--</DELETED>
        <DELETED>    (1) assesses the state of the digital skills and 
        expertise gap within the Federal workforce relating to 
        information and communications technology, with particular 
        attention to the skills and expertise gap relating to cloud 
        computing and multi-cloud technology;</DELETED>
        <DELETED>    (2) assesses the capability of the Federal 
        acquisition workforce to effectively research, solicit, 
        evaluate, acquire, and manage multi-cloud technology from 
        vendors, with particular attention to flexible or modular 
        contracting practices that facilitate the inherently complex 
        and dynamic nature of multi-cloud technology 
        procurement;</DELETED>
        <DELETED>    (3) estimates any costs associated with additional 
        Federal workforce training as a result of the increased 
        adoption of multi-cloud technologies; and</DELETED>
        <DELETED>    (4) includes any recommendations to address any 
        gap identified as a result of the assessment described in 
        paragraph (1) relating to--</DELETED>
                <DELETED>    (A) Federal workforce development 
                activities, including training, certifications, 
                staffing levels, and partnerships; and</DELETED>
                <DELETED>    (B) policies and hiring practices for 
                agencies.</DELETED>
<DELETED>    (b) Technical Assessment.--Not later than 1 year after the 
date of enactment of this Act, the Comptroller General shall submit to 
Congress and make publicly available a report that--</DELETED>
        <DELETED>    (1) assesses the technical capabilities of 
        existing agency networks to support multi-cloud 
        technology;</DELETED>
        <DELETED>    (2) evaluates any technical capability impediments 
        of agencies that delay the adoption of multi-cloud technology; 
        and</DELETED>
        <DELETED>    (3) includes any recommendations relating to 
        policies and best practices for agencies to address any 
        impediments identified as a result of the assessment described 
        in paragraph (1) and the evaluation described in paragraph 
        (2).</DELETED>

<DELETED>SEC. 5. REPORT TO CONGRESS.</DELETED>

<DELETED>    Not later than 2 years after the date of enactment of this 
Act, the Comptroller General shall submit to Congress and make publicly 
available a report assessing how agencies have implemented the guidance 
developed under section 3(a)(4) to deploy and secure multi-cloud 
technology architecture that includes multiple cloud computing software 
vendors.</DELETED>

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Multi-Cloud Innovation and 
Advancement Act of 2023''.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Agency.--The term ``agency'' has the meaning given the 
        term in section 3502 of title 44, United States Code.
            (2) Cloud computing.--The term ``cloud computing'' has the 
        meaning given the term in Special Publication 800-145 of the 
        National Institute of Standards and Technology, or any 
        successor document.
            (3) Comptroller general.--The term ``Comptroller General'' 
        means the Comptroller General of the United States.
            (4) Director.--The term ``Director'' means the Director of 
        the Office of Management and Budget.
            (5) Information and communications technology.--The term 
        ``information and communications technology''--
                    (A) has the meaning given the term in subpart 2.101 
                of the Federal Acquisition Regulation, or any successor 
                regulation; and
                    (B) includes associated services.
            (6) Multi-cloud technology.--The term ``multi-cloud 
        technology'' has the meaning given the term by the Director of 
        the National Institute of Standards and Technology pursuant to 
        section 6(a).
            (7) Relevant committees of congress.--The term ``relevant 
        committees of Congress'' means the Committee on Homeland 
        Security and Governmental Affairs of the Senate and the 
        Committee on Oversight and Accountability of the House of 
        Representatives.

SEC. 3. STUDY AND GUIDELINES FOR VOLUNTARY AGENCY USE OF MULTI-CLOUD 
              TECHNOLOGY.

    (a) In General.--Not later than 1 year after the date of enactment 
of this Act, the Director shall--
            (1) study the use of multi-cloud technology by agencies;
            (2) identify the extent to which agencies use multi-cloud 
        computing technology;
            (3) identify, among agencies that use multi-cloud 
        technology--
                    (A) best practices, including for security, 
                portability, and interoperability across multiple cloud 
                computing vendors;
                    (B) best cybersecurity practices and frameworks, 
                including cloud native security solutions, to support 
                multi-cloud technology;
                    (C) lessons learned from adoption of multi-cloud 
                technologies by agencies; and
                    (D) use cases of multi-cloud technology by 
                agencies;
            (4) develop a cost-benefit analysis of agencies 
        transitioning to multi-cloud technology compared to the 
        existing cloud computing systems of those agencies; and
            (5) provide to the relevant committees of Congress a 
        briefing on the plans and methodologies of the Director for 
        carrying out this subsection and subsection (b).
    (b) Best Practices.--Not later than 1 year after the date of the 
completion of the study required under subsection (a)(1), the Director 
shall compile and make available to agencies the information identified 
under subsection (a)(3) to assist agencies that consider adopting or 
choose to adopt multi-cloud technology.
    (c) Briefing.--Not later than 540 days after the date of enactment 
of this Act, the Director shall submit to the relevant committees of 
Congress the findings of the study required under subsection (a)(1), 
including any legislative recommendations to ensure the safe and secure 
voluntary adoption of multi-cloud technology by agencies.

SEC. 4. WORKFORCE DEVELOPMENT STUDY AND TECHNICAL CAPABILITIES 
              ASSESSMENT.

    Not later than 1 year after the date of enactment of this Act, the 
Comptroller General shall submit to Congress and make publicly 
available a report that--
            (1) assesses the state of the digital skills and expertise 
        gap within the Federal workforce relating to information and 
        communications technology, including cloud computing and multi-
        cloud technology;
            (2) assesses--
                    (A) the capability of the Federal acquisition 
                workforce to effectively research, solicit, evaluate, 
                acquire, and securely procure and manage multi-cloud 
                technology from vendors, with particular attention to 
                flexible or modular contracting practices that 
                facilitate the inherently complex and dynamic nature of 
                multi-cloud technology procurement; and
                    (B) any gaps in the Federal acquisition workforce 
                with respect to the tasks described in subparagraph 
                (A);
            (3) assesses the capability of the Federal information 
        technology workforce to effectively architect, deploy, manage, 
        and secure multi-cloud technology from vendors, with particular 
        attention to technical practices that focus on 
        interoperability, monitoring, and optimization of the multi-
        cloud environment;
            (4) estimates any costs associated with additional Federal 
        workforce training as a result of the increased adoption of 
        multi-cloud technologies; and
            (5) includes any recommendations to address any gap 
        identified as a result of the assessment described in paragraph 
        (1) relating to--
                    (A) Federal workforce development activities, 
                including training, certifications, staffing levels, 
                and partnerships; and
                    (B) policies and hiring practices for agencies.

SEC. 5. REPORT TO CONGRESS.

    Not later than 2 years after the date of enactment of this Act, the 
Comptroller General shall submit to Congress and make publicly 
available a report assessing--
            (1) the state of cloud technology adoption within the 
        Federal Government as of the date of enactment of this Act;
            (2) whether and to what extent the use of multi-cloud 
        technology has resulted in flexibility, cost savings, and 
        reduced cybersecurity risk;
            (3) circumstances that are favorable or not favorable for 
        adoption by agencies of multi-cloud technology;
            (4) the technical and other capabilities necessary for the 
        voluntary adoption of multi-cloud technology by agencies;
            (5) cybersecurity risks and benefits specific to multi-
        cloud technology, including best practices for agencies or 
        entities looking to use multi-cloud technology to mitigate 
        identified risks; and
            (6) a cost-benefit analysis of agencies transitioning to 
        multi-cloud technology compared to the existing cloud computing 
        systems of those agencies.

SEC. 6. MULTI-CLOUD TECHNOLOGY DEFINITION.

    (a) In General.--Not later than 120 days after the date of 
enactment of this Act, the Director of the National Institute of 
Standards and Technology shall publish a definition of ``multi-cloud 
technology'' for the purpose of this Act.
    (b) Considerations.--In publishing the definition required under 
subsection (a), the Director of the National Institute of Standards and 
Technology shall consider input from stakeholders and industry leaders.
    (c) Review; Updates.--The Director of the National Institute of 
Standards and Technology shall periodically review and, if necessary, 
update and republish the definition required under subsection (a) to 
reflect advancements in technology or industry practices.

SEC. 7. NO ADDITIONAL FUNDS.

    No additional amounts are authorized to be appropriated to carry 
out this Act.
                                                       Calendar No. 731

118th CONGRESS

  2d Session

                                S. 2871

                          [Report No. 118-311]

_______________________________________________________________________

                                 A BILL

To advance Federal Government innovation through the implementation and 
    use of multi-cloud computing software technology, and for other 
                               purposes.

_______________________________________________________________________

            December 19 (legislative day, December 16), 2024

                       Reported with an amendment
```