II Calendar No. 731 118th CONGRESS 2d Session S. 2871 [Report No. 118–311] IN THE SENATE OF THE UNITED STATES September 20, 2023 Mr. Daines (for himself, Ms. Rosen , and Mr. Peters ) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs December 19 (legislative day, December 16), 2024 Reported by Mr. Peters , with an amendment Strike out all after the enacting clause and insert the part printed in italic A BILL To advance Federal Government innovation through the implementation and use of multi-cloud computing software technology, and for other purposes.

1. Short title This Act may be cited as the Multi-Cloud Innovation and Advancement Act of 2023 . 2. Definitions In this Act: (1) Agency The term agency has the meaning given the term in section 3502 of title 44, United States Code. (2) Cloud computing The term cloud computing has the meaning given the term in Special Publication 800–145 of the National Institute of Standards and Technology, or any successor document. (3) Comptroller General The term Comptroller General means the Comptroller General of the United States. (4) Director The term Director means the Director of the Office of Management and Budget. (5) Information and communications technology The term information and communications technology — (A) has the meaning given the term in subpart 2.101 of the Federal Acquisition Regulation, or any successor regulation; and (B) includes associated services. (6) Multi-cloud technology The term multi-cloud technology means architecture and services that allow for data, application, and program portability, usability, and interoperability between infrastructure, platforms, and hosted applications of multiple cloud computing vendors and between public, private, and edge cloud environments in a manner that securely delivers operational and management consistency, comprehensive visibility, and resiliency. (7) Relevant committees of Congress The term relevant committees of Congress means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives. 3. Use of multi-cloud technology (a) In general Not later than 1 year after the date of enactment of this Act, the Director, in consultation with the Administrator of General Services, the Director of the National Institute of Standards and Technology, the Secretary of Homeland Security, the Administrator of the United States Digital Service, and the Administrator of the Office of Electronic Government, shall— (1) identify and evaluate any impediments to the adoption of multi-cloud technology by agencies; (2) identify best practices for how agencies can implement multi-cloud technology to allow for data portability and interoperability across multiple cloud computing vendors; (3) evaluate the adoption by agencies of cybersecurity frameworks to support multi-cloud technology; and (4) develop written guidance for agencies based on the results of the identification described in paragraph (2) that— (A) describes how agencies should use multi-cloud technology to allow for applications, data, and programs to be portable and interoperable between public, private, and edge cloud environments; and (B) outlines a roadmap for the implementation of multi-cloud technology across agencies not later than January 1, 2025. (b) Briefing Not later than 1 year after the date of enactment of this Act, the Director shall submit to the relevant committees of Congress— (1) a copy of the written guidance developed under subsection (a)(4); (2) a briefing on the implementation of multi-cloud technology by agencies; and (3) any recommendations relating to the expansion or extension of the implementation described in paragraph (2). 4. Workforce development study and technical capabilities assessment (a) In general Not later than 1 year after the date of enactment of this Act, the Comptroller General shall submit to Congress and make publicly available a report that— (1) assesses the state of the digital skills and expertise gap within the Federal workforce relating to information and communications technology, with particular attention to the skills and expertise gap relating to cloud computing and multi-cloud technology; (2) assesses the capability of the Federal acquisition workforce to effectively research, solicit, evaluate, acquire, and manage multi-cloud technology from vendors, with particular attention to flexible or modular contracting practices that facilitate the inherently complex and dynamic nature of multi-cloud technology procurement; (3) estimates any costs associated with additional Federal workforce training as a result of the increased adoption of multi-cloud technologies; and (4) includes any recommendations to address any gap identified as a result of the assessment described in paragraph (1) relating to— (A) Federal workforce development activities, including training, certifications, staffing levels, and partnerships; and (B) policies and hiring practices for agencies. (b) Technical assessment Not later than 1 year after the date of enactment of this Act, the Comptroller General shall submit to Congress and make publicly available a report that— (1) assesses the technical capabilities of existing agency networks to support multi-cloud technology; (2) evaluates any technical capability impediments of agencies that delay the adoption of multi-cloud technology; and (3) includes any recommendations relating to policies and best practices for agencies to address any impediments identified as a result of the assessment described in paragraph (1) and the evaluation described in paragraph (2). 5. Report to Congress Not later than 2 years after the date of enactment of this Act, the Comptroller General shall submit to Congress and make publicly available a report assessing how agencies have implemented the guidance developed under section 3(a)(4) to deploy and secure multi-cloud technology architecture that includes multiple cloud computing software vendors.

1. Short title This Act may be cited as the Multi-Cloud Innovation and Advancement Act of 2023 . 2. Definitions In this Act: (1) Agency The term agency has the meaning given the term in section 3502 of title 44, United States Code. (2) Cloud computing The term cloud computing has the meaning given the term in Special Publication 800–145 of the National Institute of Standards and Technology, or any successor document. (3) Comptroller General The term Comptroller General means the Comptroller General of the United States. (4) Director The term Director means the Director of the Office of Management and Budget. (5) Information and communications technology The term information and communications technology — (A) has the meaning given the term in subpart 2.101 of the Federal Acquisition Regulation, or any successor regulation; and (B) includes associated services. (6) Multi-cloud technology The term multi-cloud technology has the meaning given the term by the Director of the National Institute of Standards and Technology pursuant to section 6(a). (7) Relevant committees of Congress The term relevant committees of Congress means the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives. 3. Study and guidelines for voluntary agency use of multi-cloud technology (a) In general Not later than 1 year after the date of enactment of this Act, the Director shall— (1) study the use of multi-cloud technology by agencies; (2) identify the extent to which agencies use multi-cloud computing technology; (3) identify, among agencies that use multi-cloud technology— (A) best practices, including for security, portability, and interoperability across multiple cloud computing vendors; (B) best cybersecurity practices and frameworks, including cloud native security solutions, to support multi-cloud technology; (C) lessons learned from adoption of multi-cloud technologies by agencies; and (D) use cases of multi-cloud technology by agencies; (4) develop a cost-benefit analysis of agencies transitioning to multi-cloud technology compared to the existing cloud computing systems of those agencies; and (5) provide to the relevant committees of Congress a briefing on the plans and methodologies of the Director for carrying out this subsection and subsection (b). (b) Best practices Not later than 1 year after the date of the completion of the study required under subsection (a)(1), the Director shall compile and make available to agencies the information identified under subsection (a)(3) to assist agencies that consider adopting or choose to adopt multi-cloud technology. (c) Briefing Not later than 540 days after the date of enactment of this Act, the Director shall submit to the relevant committees of Congress the findings of the study required under subsection (a)(1), including any legislative recommendations to ensure the safe and secure voluntary adoption of multi-cloud technology by agencies. 4. Workforce development study and technical capabilities assessment Not later than 1 year after the date of enactment of this Act, the Comptroller General shall submit to Congress and make publicly available a report that— (1) assesses the state of the digital skills and expertise gap within the Federal workforce relating to information and communications technology, including cloud computing and multi-cloud technology; (2) assesses— (A) the capability of the Federal acquisition workforce to effectively research, solicit, evaluate, acquire, and securely procure and manage multi-cloud technology from vendors, with particular attention to flexible or modular contracting practices that facilitate the inherently complex and dynamic nature of multi-cloud technology procurement; and (B) any gaps in the Federal acquisition workforce with respect to the tasks described in subparagraph (A); (3) assesses the capability of the Federal information technology workforce to effectively architect, deploy, manage, and secure multi-cloud technology from vendors, with particular attention to technical practices that focus on interoperability, monitoring, and optimization of the multi-cloud environment; (4) estimates any costs associated with additional Federal workforce training as a result of the increased adoption of multi-cloud technologies; and (5) includes any recommendations to address any gap identified as a result of the assessment described in paragraph (1) relating to— (A) Federal workforce development activities, including training, certifications, staffing levels, and partnerships; and (B) policies and hiring practices for agencies. 5. Report to Congress Not later than 2 years after the date of enactment of this Act, the Comptroller General shall submit to Congress and make publicly available a report assessing— (1) the state of cloud technology adoption within the Federal Government as of the date of enactment of this Act; (2) whether and to what extent the use of multi-cloud technology has resulted in flexibility, cost savings, and reduced cybersecurity risk; (3) circumstances that are favorable or not favorable for adoption by agencies of multi-cloud technology; (4) the technical and other capabilities necessary for the voluntary adoption of multi-cloud technology by agencies; (5) cybersecurity risks and benefits specific to multi-cloud technology, including best practices for agencies or entities looking to use multi-cloud technology to mitigate identified risks; and (6) a cost-benefit analysis of agencies transitioning to multi-cloud technology compared to the existing cloud computing systems of those agencies. 6. Multi-cloud technology definition (a) In general Not later than 120 days after the date of enactment of this Act, the Director of the National Institute of Standards and Technology shall publish a definition of multi-cloud technology for the purpose of this Act. (b) Considerations In publishing the definition required under subsection (a), the Director of the National Institute of Standards and Technology shall consider input from stakeholders and industry leaders. (c) Review; updates The Director of the National Institute of Standards and Technology shall periodically review and, if necessary, update and republish the definition required under subsection (a) to reflect advancements in technology or industry practices. 7. No additional funds No additional amounts are authorized to be appropriated to carry out this Act.

December 19 (legislative day, December 16), 2024 Reported with an amendment