Cloud Certification and Auditing

• Improve communications channels between government and industry to provide feedback on and refine existing certifications processes by identifying areas in need of adjustment. These include a clear delineation of roles and responsibilities among auditing entities, irregularities in risk assessment, and validation across authorizers. (Shared with cloud providers.)
• Work with cloud providers and enterprise customers to define high-level performance-based requirements and metrics for confidentiality, integrity, and availability of cloud services. These can differ based on the types of cloud service offered (such as storage and virtualization) and sectoral criticality. (Shared with cloud providers and enterprise customers.)
• Distinguish between requirements for less and more sensitive government workloads and align certification criteria with those requirements.
• Make audits of performance and compliance public or mandate provider’s transparency on performance.

Incident Handling Procedures

• Establish mandatory standards for reporting cloud vulnerabilities and incidents that may affect systems critical to the cloud provider and/or society more broadly. These should enable close-to-real-time situational awareness for all concerned entities.
• Use governmental cloud procurement as leverage to promote cloud services security and robustness and incentivize incident reporting.
• Clarify expectations and set guardrails for incident response by government, providers, and customers (for example, hack-back, paying ransoms, degree of government access) to help establish a whole-of-system cyber risk management plan.
• Work with cloud providers, customers, insurers, and other key stakeholders to determine appropriate constituencies, documentation, and timelines¹ for disclosures. (Shared with cloud providers, enterprise customers, insurers, and credit rating agencies.)
• Consider creating a centralized incident response and reporting office for cloud sector (in consultation with providers and customers).²
• Facilitate cross-agency and cross-industry incident response exercises. (Shared with cloud providers and customers.)

Localization and Routing Requirements

• Narrowly target localization requirements (for example, by type of data and level of sensitivity).
• When drafting cross-border transfer arrangements, include measures to preserve confidentiality of data, both in terms of legal prohibitions against unlawful access and in terms of security provisions.
• Work with providers to understand the distributed processes of data routing and work with other stakeholders to increase confidence in the security of data in transit. (Shared with cloud providers and customers.)
• Work with foreign governments to establish international agreements and mechanisms to resolve conflicts of laws, that secure sensitive data without impinging on the privacy of citizens, national security, and defense.

Security and Privacy in Lawful Government Access

• Wherever possible, direct access requests to customers rather than to cloud providers.
• Allow cloud providers to notify enterprise customers in advance of government access to their data, other than in exceptional circumstances, for example by limiting the use of secrecy orders.³
• Mandate scoping, oversight, and transparency on government access requests (including requests received from foreign governments).
• Work with foreign governments to establish international agreements and mechanisms to resolve conflicts of laws and to ensure that foreign government access to data does not impinge on privacy of citizens, national security, and defense.⁴

Data Retrievability and Back-up Arrangements

• Encourage diversity in routing⁵ through additional geographies and geo-redundant deployments (for example, through stringent re-routing requirements and residency requirements).
• Leverage existing encryption protocols and standards for data in transit as baselines.

Government Intervention in Extremis

• Establish working groups between governments, providers, and enterprise customers to delineate clear “disaster level” thresholds necessary to trigger government intervention as well as the process by which such intervention takes place and the circumstances under which it would conclude. (Shared with cloud providers and enterprise customers.)
• Create accountability mechanisms whereby providers and customers may ensure that governments do not overstep or abuse their intervention mandate.
• Create intervention requirements and established agreements among governments, providers, insurers, and other stakeholders to allocate liabilities and responsibilities in the event of intervention.
• Coordinate agency roles in the event of intervention.
• Increase cooperation with providers and enterprise customers by mandating joint preparedness exercises. (Shared with cloud providers and enterprise customers.)
• Coordinate with foreign governments and the appropriate cloud providers or enterprise customers to ensure that citizen privacy, national security, and defense are not at risk of compromise in the event of takeover.

Insurance for Cloud Services ​

• Facilitate dialogue between government, providers, customers, insurers, and other stakeholders in order to determine and clearly assign liability for cloud service disruptions (including those arising from a sophisticated attack by a nation-state). (Shared with cloud providers, enterprise customers, and insurers.)
• Develop backstopping mechanisms for cloud insurance and cyber insurance markets by drawing on backstopping in other contexts.⁶
• Define conditions for backstopping support to become available (such as the nature and/or scale of the cloud incident). (Shared with cloud providers, enterprise customers, and insurers.)
• Explore other public-private partnerships for mitigating cloud risks.
• Set requirements for cloud providers to ensure data retrievability and bolster the possibility of service continuity in the event of cloud provider or insurer insolvency.

Portability and Interoperability

• Encourage the use of hybrid and multi-cloud strategies to decrease disruption risks.⁷
• Encourage agreement on common terminology and principles for portability and interoperability in consultation with providers and customers. Definitions for these terms have been formalized in standards, including SWIPO’s Codes of Conduct,⁸ IEEE’s P2301/P2302,⁹ and ISO/IEC’s 19941.¹⁰

Commercialization of Customer Data

• Establish rules requiring cloud providers and enterprise customers to publish their standard policies and practices for commercializing metadata and other anonymized usage data.
• May condition commercialization of customer data on the data subjects’ consent or other bases consistent with prevailing law.¹¹
• Commission studies on best practices for assessing the value of consumer and enterprise-derived data to guide policies on commercial usage and financial compensation (in consultation with providers and customers).

Effects of Cloud Market Concentration

• Promote interoperability and portability standards and multi-cloud arrangements.
• Use existing antitrust investigative and enforcement powers, including merger review and enforcement​.
• Monitor and analyze evolving cloud services markets to understand when and how they might trigger competition policy concerns.
• Work with industry to develop and publish nonbinding standards for liability allocation, fairness in contracting, pricing, and so on.

Environmental, Community, and Energy Market Impact

• Support providers’ efforts to substantially reduce carbon emissions or achieve “net zero” including by easing barriers to development of their own utility-scale renewable energy generation. For example, by offering financial support and/or providing liability waivers for constructing dedicated utility-scale electricity generation projects on “brownfield” sites.¹² (Shared with cloud providers and utility companies.)
• Migrate government operations to more energy efficient and sustainably powered IT infrastructure.
• Incentivize cloud providers to implement energy efficient measures, such as more sustainable server cooling methods.¹³
• Develop guidance material on best practices for reducing water usage in data centers.¹⁴
• Facilitate international sharing of best practices for opening local energy markets to “energy choice” programs.¹⁵
• Understand and mitigate the adverse impact of cloud infrastructure creation and operation on local communities. (Shared with cloud providers.)
• Creation of mechanisms to incentivize emissions reduction by, for example, incorporating new requirements into licenses and offering financial incentives.
• Integrate carbon reduction into procurement policies.
• Create consultation requirements with local communities and evaluate existing adjudication mechanisms. (Shared with cloud providers.)

Cloud Access Restrictions and Content Moderation

• Clearly define criteria, standards, and procedures for requiring cloud providers to take down content or deny/suspend service(s).
• Establish mechanisms to audit for bias the content moderation technologies being deployed or offered by cloud providers.
• Establish clear and easy to use pathways for customers seeking redress following suspected instances of bias.
• Encourage periodic publication of algorithmic impact statements and content moderation.
• Incentivize major cloud providers to solicit public feedback on the development and implementation of content moderation policies, practices, and technologies.
• Develop standards for oversight, accountability, and transparency of providers’ polices and content moderation requests.
• Model domestic rules regarding service availability after principles such as Article 19 of the Universal Declaration of Human Rights.¹⁶

Ensuring a Beneficial and Safe Digital Environment for Groups with Special Requirements

• Promote standards and potentially offer incentives to ensure digital services are accessible and inclusive.¹⁷
• Prioritize enforcement of existing laws designed to protect vulnerable groups online.
• Differentiate and clearly define standards regarding how content harmful to children, seniors, and others is moderated, and by whom.

Privacy Protections

• Require greater transparency in cloud computing contracts between customers and providers, particularly around responsibility for data privacy, liability for breaches, obligations for reporting and remedial action.
• Require increased transparency by providers and their customers on the collection, usage, storage, deletion, and other actions of specific types of data on a sector-by-sector basis.
• Provide model language on how to clearly allocate responsibilities and rights of parties with respect to data privacy.
• Define the ways in which impacted individuals may seek compensation for damages.
• Work with foreign governments to establish international agreements and mechanisms to resolve conflicts of laws, in order to ensure the privacy of citizens’ data as it moves across jurisdictions.
• Set guardrails for the degree of access governments may exercise in the event of government intervention.