As governments increasingly focus on cloud security and sovereignty, the European Commission (“EC”) is, through its proposal for a Cloud and AI Development Act (“CADA Proposal”), attempting to create a regime establishing “sovereignty” requirements on cloud computing service providers that can be procured by the public sector. In our prior blog post, we discussed the proposed regime in greater detail. This proposed regime shares some characteristics with U.S. regimes for government contractors. However, while similarities exist, there are also meaningful differences. Existing and potential government contractors providing cloud services and operating in both the United States and European Union (“EU”) may be interested in understanding how existing U.S. requirements compare to the CADA Proposal — which requirements carry across regimes and which requirements are net new.
In this blog post, we provide a brief overview of (1) the CADA Proposal and certain existing U.S. frameworks, namely (2) the U.S. foreign ownership, control, or influence (“FOCI”) regime and (3) the U.S. Federal Risk and Authorization Management Program (“FedRAMP”). The overview is followed by a high-level comparison of these frameworks.
The comparison below focuses on the scope of the respective frameworks and their treatment of provider location, data residency, foreign-government access, and the potential for foreign control to affect service continuity. This discussion focuses principally on the FedRAMP Rev. 5 framework.
CADA Proposal
The CADA Proposal sits at the heart of the EC’s broader Tech Sovereignty Package and aims to address what the EC perceives as two critical vulnerabilities in the EU’s digital landscape: a structural deficit in data center capacity and a dependence on a limited number of non-EU cloud computing service providers. If enacted, among other things, contractors would be required to meet the requirements of the CADA Proposal in order to provide cloud services to public-sector bodies operating in certain sectors (at the national, regional, local, and municipal government level). The cloud sovereignty framework established by the CADA Proposal creates four “Union Assurance Levels” (“UALs”), where UAL 1 presents the least restrictive requirements and UAL 4 presents the most restrictive requirements.
FOCI Regime
The existing U.S. FOCI regime, which is governed by the National Industrial Security Program Operating Manual (“NISPOM”), 32 C.F.R. Part 117, applies principally in connection with U.S. government contracts or agreements that require a contractor to access classified information and therefore require the contractor to obtain a facility security clearance (“FCL”). The FOCI regime applies when there is access to classified information by a contractor regardless of the nature of the product or service. The FOCI regime is intended to mitigate the risk of unauthorized access by foreign persons to classified information through companies performing on U.S. government contracts as well as prevent foreign persons from adversely affecting those companies’ performance on classified contracts. To obtain an FCL, or to maintain an FCL following certain material changes to the business (e.g., a change in ownership), a contractor must submit information about foreign ownership and other relationships and undergo an assessment for FOCI. If the U.S. government identifies FOCI, the U.S. government will require the contractor to implement mitigation measures, assuming mitigation is feasible, prior to granting the contractor an FCL to perform on the contract or to continue performing on existing classified contracts. (Note that a FOCI mitigation determination is based on a risk assessment reflecting multiple factors. There may be circumstances where mitigation is not feasible, including due to the sensitivity of the assets or risk profile of the source of FOCI.)
Of note, Section 847 of the Fiscal Year 2020 National Defense Authorization Act (“NDAA”) would extend the concept of FOCI mitigation to certain unclassified Department of War (“DoW”) contracts and subcontracts valued above $5 million. More information on the forthcoming regulations implementing Section 847 is available in our client alert here.
FedRAMP
FedRAMP provides a standardized security assessment and authorization framework for cloud services that process or store unclassified U.S. government information on behalf of a U.S. federal agency, subject to specified exclusions. In order to provide cloud services to most U.S. federal agencies, a contractor must comply with the FedRAMP requirements and obtain a FedRAMP authorization.
Comparison of Frameworks
Scope of Application
The three frameworks differ in terms of the government entities they apply to, the flexibility that they afford to address risks, and the nature of how the requirements apply. Specifically, all three frameworks apply at the federal or national level, but the CADA Proposal would apply more broadly to cloud services procured by public-sector bodies across the EU, including not only national but also regional, local, and municipal government authorities that are responsible for various types of critical infrastructure (e.g., various types of transport infrastructure, healthcare, drinking / waste water operations, postal services, waste management, and research). Additionally, the CADA Proposal would impose a wide range of obligations on cloud computing service providers in order for them to be certified to a particular UAL, whereas the FOCI regime and FedRAMP expressly govern contractor eligibility and foreign ownership, control, or influence risks, or assess the security of a particular cloud service offering, respectively.
Substantive Obligations
In addition to the differences in the scope of application, the frameworks also differ in terms of substantive obligations, notably including differences in their treatment of foreign ownership and control, as discussed further below. Below we provide a non-exhaustive list of some of the key differences between those substantive obligations, focusing on issues related to the location of the provider, data residency, and the ability of foreign governments to access data / disrupt services.
Location/Ownership of Provider
The CADA Proposal generally requires the provider, relevant subcontractors, and supporting infrastructure to be located in the EU. With respect to the FOCI regime, only a U.S. entity may hold an FCL, but foreign ownership or control of a cleared U.S. entity is generally permitted, subject to the feasibility of mitigating identified FOCI. By contrast, FedRAMP does not currently have any standard restrictions on the location/ownership of the corporate entity providing services. A few exemplary requirements are shown below.
| CADA Proposal Requirement | FOCI Regime Requirement | FedRAMP Requirement |
|---|---|---|
| UAL 1: The direct provider of cloud computing services must be established in the EU. UAL 2: The direct provider of cloud computing services, and all subcontractors involved in the provision of the services, must be established in the EU. UAL 3: In addition to the requirements discussed above, the provider and any subcontractor involved in the provision of the services may not be subject to the control of a non-EU government or company (i.e., the parent company cannot be established outside the EU), unless the EC has determined that a specific third country meets specific criteria set out in Article 18. UAL 4: The provider and any subcontractor involved in the provision of the services also may not be subject to the control of a non-EU government or company (i.e., the parent company cannot be established outside the EU). |
The entity holding the FCL must be a U.S. entity. The entity’s ultimate parent and affiliates are not required to be established in the United States. | There is no standard requirement in FedRAMP concerning where a cloud service provider must be established, though agencies can impose additional requirements. |
Data Residency
The CADA Proposal imposes broad EU data residency requirements across all UALs. FedRAMP generally does not impose comparable requirements, although forthcoming requirements for the highest certification class impose certain U.S. jurisdiction-based location requirements and federal agencies can impose more specific residency requirements. Individual DoW contracts may impose additional U.S. data location requirements. While the FOCI regime does not categorically impose a data residency requirement, required mitigation may effectively localize data within the United States. A few exemplary requirements are shown below.
| CADA Proposal Requirement | FOCI Regime Requirement | FedRAMP Requirement |
|---|---|---|
| UAL 1: All “customer data” must remain exclusively in the EU, unless the public sector body explicitly requires otherwise.
UALs 2–3: Establishes certain requirements related to training AI and technical and operational support. UAL 4: Any data that—following a risk assessment—is classified as sensitive, must remain exclusively in the EU. |
The existing FOCI requirements do not impose a general data residency requirement, though as part of FOCI mitigation controls, classified, export-controlled, and otherwise sensitive U.S. government information must be maintained by the FOCI-mitigated company and protected from unauthorized disclosure to unmitigated parent companies, which effectively localizes such data in the United States. (Note that separate from the FOCI regime, the NISPOM includes other requirements relating to the safeguarding of classified information.) | FedRAMP does not impose a general requirement that federal information remain exclusively within the United States, though individual agencies can choose to apply these requirements as supplements to FedRAMP. New requirements for the highest FedRAMP certification class, which become mandatory in 2027, also impose U.S. jurisdiction-based location requirements for federal customer data and related processing and system services. |
Foreign Government Access to Data
The CADA Proposal restricts qualification for UAL 2 unless a provider can demonstrate that it has implemented the necessary measures to ensure that access to data from a non-EU government is prevented. A provider that is subject to foreign control is disqualified based on non-EU control at UALs 3 and 4, although a provider controlled outside the EU may qualify for UAL 3 if the applicable third-country laws meet specified standards, including that the third country does not impose measures that conflict with EU requirements governing lawful access to non-personal data. The FOCI regime assesses the particular FOCI risk and may permit that risk to be addressed through entity-specific mitigation that may limit foreign government access to data maintained by the U.S. company. FedRAMP does not restrict provider access or control. A few exemplary requirements are shown below.
| CADA Proposal Requirement | FOCI Regime Requirement | FedRAMP Requirement |
|---|---|---|
| UAL 1: None.
UAL 2: Where a provider and/or any subcontractor involved in the provision of the services is subject to the control of a non-EU government or company, it must demonstrate that, in relation to non-EU government ability to access data, it has implemented the necessary measures to ensure that access to data from outside the EU is prevented. UAL 3: The provider and any subcontractor involved in the provision of the services may not be subject to the control of a non-EU government or company, unless the EC has determined that a specific third country meets specific criteria set out in Article 18, including that the third country does not impose measures that conflict with EU requirements governing lawful access to non-personal data. UAL 4: The provider and any subcontractor involved in the provision of the services may not be subject to the control of a non-EU government or company. |
A FOCI determination (e.g., potential foreign government access) does not categorically disqualify a U.S. entity from obtaining or maintaining an FCL. The U.S. entity may be permitted to obtain an FCL (and thus access to classified information) if the U.S. government determines that mitigation is feasible and the entity implements mitigation efforts acceptable to the U.S. government. If a foreign government is the source of FOCI, the mitigation will effectively restrict foreign government access to certain data maintained by the U.S. entity with the FCL. | FedRAMP requires providers to restrict access to federal information to authorized users, but does not impose requirements specifically addressing access compelled by a foreign government or foreign ownership or control of the provider. |
Foreign Government Ability to Disrupt Service
The CADA Proposal contains specific requirements addressing the risk that a non-EU government or company could disrupt cloud services. For certification to UALs 1 and 2, the CADA Proposal requires cloud service providers to take steps to minimize the potential impact of that foreign control in certain domains. For certification to UAL 3, specific laws in a foreign country (e.g., a requirement that the EU provider comply with restrictive measures from the non-EU country such as sanctions or export controls) prevent a company from even being considered as a potential service provider; although, a provider controlled outside the EU may qualify for UAL 3 if the applicable third-country laws meet specified standards, including that the third country’s legal framework cannot compel a provider to disrupt services or withhold state-of-the-art technologies from EU customers. Foreign control is an absolute barrier to certification to UAL 4. By contrast, the FOCI regime addresses identified risks through entity-specific mitigation. FedRAMP addresses service disruption through cybersecurity controls, not specific restrictions on foreign ownership or control. A few exemplary requirements are shown below.
| CADA Proposal Requirement | FOCI Regime Requirement | FedRAMP Requirement |
|---|---|---|
| UAL 1: Where a provider is subject to the control of a non-EU government or company, it must guarantee that there are no existing laws in that third country that would require it to report software vulnerabilities to the authorities of that third country before those vulnerabilities have been exploited. UAL 2: Where a provider is subject to the control of a non-EU government or company, it must demonstrate, in relation to non-EU government ability to disrupt service, that it has implemented certain mitigation measures. UAL 3: The provider and any subcontractor involved in the provision of the services may not be subject to the control of a non-EU government or company, unless the EC has determined that a specific third country meets specific criteria, including that the third country’s legal framework cannot compel a provider to disrupt services or withhold state-of-the-art technologies from EU customers. UAL 4: The provider and any subcontractor involved in the provision of the services may not be subject to the control of a non-EU government or company. |
FOCI does not categorically disqualify a U.S. entity from obtaining or maintaining an FCL. The entity may obtain or maintain an FCL (and thus access to classified information) if the U.S. government determines that mitigation is feasible and the entity implements mitigation efforts acceptable to the U.S. government. However, FOCI mitigation is intended to prevent the source of FOCI from adversely affecting a cleared company’s performance on classified contracts, and may therefore limit a foreign government’s ability to influence the services the U.S. company provides. | FedRAMP does not specifically address the risk that a foreign government could exercise ownership, control, or legal authority to compel or cause a service disruption. Further, while FedRAMP requires providers to report certain vulnerability information to FedRAMP and federal customers, it does not impose an analogous restriction on advance reporting to foreign governments. |
Recent Comments