and House of Representatives for any discrep-
ancy between security requirements for dif-
ferent provider types; 
(2) conduct a threat-based assessment of 
whether security controls resident in commercial 
cloud services and the cloud services of other Fed-
eral departments and agencies meet the security re-
quirements determined under paragraph (2), includ-
ing— 
(A) by determining what services can and 
cannot be provided by commercial cloud ven-
dors, based on such security requirements; 
(B) by providing justification for why such 
determinations were made by citing, as appro-
priate, industry responses to requests for infor-
mation and capability statement that confirm 
the conclusions of the Department of Defense; 
and 
(C) by requesting that commercial vendors 
submit their plans for how they can adapt their 
systems to the unique and dynamic cyber de-
fense requirements of the Department of De-
fense; 
(3) require any government-owned, operated, or 
unique system that is or will be designed to provide 
VerDate Mar 15 2010 
04:01 Apr 29, 2014
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4505.IH
H4505
rfrederick on DSK7TPTVN1PROD with BILLS
cloud capabilities for the Department of Defense to 
be certified and accredited through the same proc-
ess, and to the same standards, that is used to cer-
tify and accredit commercial service providers; and 
(4) ensure that, as part of any Department of 
Defense pilot demonstrations with commercial cloud 
vendors— 
(A) an analysis is conducted of— 
(i) requiring the Defense Information 
Systems Agency to work with commercial 
service providers to extend the Department 
of Defense Information Network to com-
mercial service providers that are issued 
provisional authority to operate for De-
partment of Defense impact levels 1 and 2 
in order to leverage the commercial service 
providers for secure connections to the De-
partment of Defense Information Network; 
(ii) the benefits and challenges relat-
ing to how the secure connections would be 
enabled and delivered as a service by the 
DISA cloud broker to the commercial serv-
ice providers who have achieved provisional 
authority to operate for Department of De-
fense impact levels 1 and 2; 
VerDate Mar 15 2010 
04:01 Apr 29, 2014
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4505.IH
H4505
rfrederick on DSK7TPTVN1PROD with BILLS
(iii) requiring the Defense Informa-
tion Systems Agency to address the ability 
of commercial service providers to provide 
service for Department of Defense impact 
levels 3 through 5 using logical separation; 
(iv) the ability of commercial service 
providers to provide innovative solutions to 
the separation of customer data and sup-
porting resources that do not rely on phys-
ical separation; 
(v) the benefits and challenges regard-
ing the consideration of such solutions for 
equivalence to physical separation; and 
(vi) the benefits and challenges of hy-
brid solutions for providing cloud services; 
and 
(B) the Chief Information Officer provides 
to the Committees on Armed Services of the 
Senate and House of Representatives a briefing 
on the matters referred to in subparagraph (A) 
by not later than 30 days after the conclusion 
of such pilot demonstration. 
Æ 
VerDate Mar 15 2010 
04:01 Apr 29, 2014
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H4505.IH
H4505
rfrederick on DSK7TPTVN1PROD with BILLS