The U.S. Department of Commerce (Commerce)’s Bureau of Industry and Security has issued a proposed rule requiring providers and foreign resellers of…

← Back to Blog

The U.S. Department of Commerce (Commerce)’s Bureau of Industry and Security has issued a proposed rule requiring providers and foreign resellers of U.S. Infrastructure as a Service (IaaS) to identify customers and to prevent cyberattacks by foreign adversaries. Recognizing the risk and threats to national security posed by IaaS.

Department of Commerce is concerned that Cloud services are being used by domestic and foreign hacking groups. Moving to require IaaS providers to address the risks of foreign adversaries using their IaaS to launch cyber attacks on the U.S.

The scope of the proposal covers Direct providers and any U.S. resellers are considered “U.S. IaaS providers” subject to the proposed regulations. This is

“any product or service offered to a consumer, including complimentary or ‘trial’ offerings, that provides processing, storage, networks, or other fundamental computing resources and with which the consumer is able to deploy and run software that is not predefined, including operating systems and applications.”

The proposal ‘obligates’ U.S. IaaS providers and their foreign resellers to develop and maintain a risk-based Customer Identification Program (CIP). Identifying account information about foreign account holders, identity verification and record retention and reporting.

This proposal in ones opinion is s significant undertaking. It sets out a framework for the U.S. Department of Commerce to hold IaaS providers accountable for the use of their infrastructure to host foreign adversaries that enable them to launch cyber attacks on the U.S. Another example of cyber regulation that is being adopted by U.S agencies.

@Thaddeus Dziekanowski Brian D. McCarthy

Veritas GRC

#cybersecurity #cyberriskmanagement #iaas #cyberregulation

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7173605367510097920