As governments increasingly focus on cloud security and sovereignty, the European Commission (“EC”) is, through its proposal for a Cloud and AI Development Act (“CADA Proposal”), attempting to create a regime establishing “sovereignty” requirements on cloud computing service providers that can be procured by the public sector.  In our prior blog post, we discussed the proposed regime in greater detail.  This proposed regime shares some characteristics with U.S. regimes for government contractors.  However, while similarities exist, there are also meaningful differences.  Existing and potential government contractors providing cloud services and operating in both the United States and European Union (“EU”) may be interested in understanding how existing U.S. requirements compare to the CADA Proposal — which requirements carry across regimes and which requirements are net new.

In this blog post, we provide a brief overview of (1) the CADA Proposal and certain existing U.S. frameworks, namely (2) the U.S. foreign ownership, control, or influence (“FOCI”) regime and (3) the U.S. Federal Risk and Authorization Management Program (“FedRAMP”).  The overview is followed by a high-level comparison of these frameworks. The comparison below focuses on the scope of the respective frameworks and their treatment of provider location, data residency, foreign-government access, and the potential for foreign control to affect service continuity.  This discussion focuses principally on the FedRAMP Rev. 5 framework.

CADA Proposal

The CADA Proposal sits at the heart of the EC’s broader Tech Sovereignty Package and aims to address what the EC perceives as two critical vulnerabilities in the EU’s digital landscape: a structural deficit in data center capacity and a dependence on a limited number of non-EU cloud computing service providers.  If enacted, among other things, contractors would be required to meet the requirements of the CADA Proposal in order to provide cloud services to public-sector bodies operating in certain sectors (at the national, regional, local, and municipal government level).  The cloud sovereignty framework established by the CADA Proposal creates four “Union Assurance Levels” (“UALs”), where UAL 1 presents the least restrictive requirements and UAL 4 presents the most restrictive requirements.

FOCI Regime

The existing U.S. FOCI regime, which is governed by the National Industrial Security Program Operating Manual (“NISPOM”), 32 C.F.R. Part 117, applies principally in connection with U.S. government contracts or agreements that require a contractor to access classified information and therefore require the contractor to obtain a facility security clearance (“FCL”).  The FOCI regime applies when there is access to classified information by a contractor regardless of the nature of the product or service. The FOCI regime is intended to mitigate the risk of unauthorized access by foreign persons to classified information through companies performing on U.S. government contracts as well as prevent foreign persons from adversely affecting those companies’ performance on classified contracts.  To obtain an FCL, or to maintain an FCL following certain material changes to the business (e.g., a change in ownership), a contractor must submit information about foreign ownership and other relationships and undergo an assessment for FOCI.  If the U.S. government identifies FOCI, the U.S. government will require the contractor to implement mitigation measures, assuming mitigation is feasible, prior to granting the contractor an FCL to perform on the contract or to continue performing on existing classified contracts.   (Note that a FOCI mitigation determination is based on a risk assessment reflecting multiple factors.  There may be circumstances where mitigation is not feasible, including due to the sensitivity of the assets or risk profile of the source of FOCI.)

Of note, Section 847 of the Fiscal Year 2020 National Defense Authorization Act (“NDAA”) would extend the concept of FOCI mitigation to certain unclassified Department of War (“DoW”) contracts and subcontracts valued above $5 million.  More information on the forthcoming regulations implementing Section 847 is available in our client alert here.

FedRAMP

FedRAMP provides a standardized security assessment and authorization framework for cloud services that process or store unclassified U.S. government information on behalf of a U.S. federal agency, subject to specified exclusions.  In order to provide cloud services to most U.S. federal agencies, a contractor must comply with the FedRAMP requirements and obtain a FedRAMP authorization.

Comparison of Frameworks

Scope of Application

The three frameworks differ in terms of the government entities they apply to, the flexibility that they afford to address risks, and the nature of how the requirements apply.  Specifically, all three frameworks apply at the federal or national level, but the CADA Proposal would apply more broadly to cloud services procured by public-sector bodies across the EU, including not only national but also regional, local, and municipal government authorities that are responsible for various types of critical infrastructure (e.g., various types of transport infrastructure, healthcare, drinking / waste water operations, postal services, waste management, and research).  Additionally, the CADA Proposal would impose a wide range of obligations on cloud computing service providers in order for them to be certified to a particular UAL, whereas the FOCI regime and FedRAMP expressly govern contractor eligibility and foreign ownership, control, or influence risks, or assess the security of a particular cloud service offering, respectively.

Substantive Obligations

In addition to the differences in the scope of application, the frameworks also differ in terms of substantive obligations, notably including differences in their treatment of foreign ownership and control, as discussed further below.  Below we provide a non-exhaustive list of some of the key differences between those substantive obligations, focusing on issues related to the location of the provider, data residency, and the ability of foreign governments to access data / disrupt services.

• Location/Ownership of Provider: The CADA Proposal generally requires the provider, relevant subcontractors, and supporting infrastructure to be located in the EU.  With respect to the FOCI regime, only a U.S. entity may hold an FCL, but foreign ownership or control of a cleared U.S. entity is generally permitted, subject to the feasibility of mitigating identified FOCI.  By contrast, FedRAMP does not currently have any standard restrictions on the location/ownership of the corporate entity providing services.  A few exemplary requirements are shown below.

• Data Residency: The CADA Proposal imposes broad EU data residency requirements across all UALs.  FedRAMP generally does not impose comparable requirements, although forthcoming requirements for the highest certification class impose certain U.S. jurisdiction-based location requirements and federal agencies can impose more specific residency requirements.  Individual DoW contracts may impose additional U.S. data location requirements.  While the FOCI regime does not categorically impose a data residency requirement, required mitigation may effectively localize data within the United States.  A few exemplary requirements are shown below.

• Foreign Government Access to Data:The CADA Proposal restricts qualification for UAL 2 unless a provider can demonstrate that it has implemented the necessary measures to ensure that access to data from a non-EU government is prevented.  A provider that is subject to foreign control is disqualified based on non-EU control at UALs 3 and 4, although a provider controlled outside the EU may qualify for UAL 3 if the applicable third-country laws meet specified standards, including that the third country does not impose measures that conflict with EU requirements governing lawful access to non-personal data.  The FOCI regime assesses the particular FOCI risk and may permit that risk to be addressed through entity-specific mitigation that may limit foreign government access to data maintained by the U.S. company.  FedRAMP does not restrict provider access or control.  A few exemplary requirements are shown below.

• Foreign Government Ability to Disrupt Service: The CADA Proposal contains specific requirements addressing the risk that a non-EU government or company could disrupt cloud services.  For certification to UALs 1 and 2, the CADA Proposal requires cloud service providers to take steps to minimize the potential impact of that foreign control in certain domains.  For certification to UAL 3, specific laws in a foreign country (e.g., a requirement that the EU provider comply with restrictive measures from the non-EU country such as sanctions or export controls) prevent a company from even being considered as a potential service provider; although, a provider controlled outside the EU may qualify for UAL 3 if the applicable third-country laws meet specified standards, including that the third country’s legal framework cannot compel a provider to disrupt services or withhold state-of-the-art technologies from EU customers.  Foreign control is an absolute barrier to certification to UAL 4.  By contrast, the FOCI regime addresses identified risks through entity-specific mitigation.  FedRAMP addresses service disruption through cybersecurity controls, not specific restrictions on foreign ownership or control.  A few exemplary requirements are shown below.