As governments increasingly focus on cloud security and sovereignty, the European Commission (“EC”) is, through its proposal for a Cloud and AI Development Act (“CADA Proposal”), attempting to create a regime establishing “sovereignty” requirements on cloud computing service providers that can be procured by the public sector.  In our prior blog post, we discussed the proposed regime in greater detail.  This proposed regime shares some characteristics with U.S. regimes for government contractors.  However, while similarities exist, there are also meaningful differences.  Existing and potential government contractors providing cloud services and operating in both the United States and European Union (“EU”) may be interested in understanding how existing U.S. requirements compare to the CADA Proposal — which requirements carry across regimes and which requirements are net new.

In this blog post, we provide a brief overview of (1) the CADA Proposal and certain existing U.S. frameworks, namely (2) the U.S. foreign ownership, control, or influence (“FOCI”) regime and (3) the U.S. Federal Risk and Authorization Management Program (“FedRAMP”).  The overview is followed by a high-level comparison of these frameworks.

The comparison below focuses on the scope of the respective frameworks and their treatment of provider location, data residency, foreign-government access, and the potential for foreign control to affect service continuity.  This discussion focuses principally on the FedRAMP Rev. 5 framework.