To require the Inspector General of the Department of Defense to conduct an audit of foreign exposure from Department of Defense cloud computing contracts and to require the Secretary of Defense to update guidance to reduce, mitigate, or eliminate risk.

SA 3557, submitted by Ms. Slotkin, aims to add a section to bill S. 2296 focused on reducing, mitigating, or eliminating risks associated with Department of Defense cloud computing contracts that have foreign exposure.

The amendment proposes the following changes and additions:

• Audit Requirement: It requires the Inspector General of the Department of Defense to audit cloud computing contracts. This audit assesses the risk of exposing sensitive information—such as data, procedures, and systems architecture—due to policies allowing computer scientists or engineers from foreign countries of concern to access software updates for operating systems or cloud infrastructure.

• Audit Scope: The audit must determine the number of contracts supported by citizens or employees in foreign countries of concern, identify policies allowing "digital escorts" or foreign personnel, assess the oversight of these "digital escorts" from January 1, 2022, to the date the Act is enacted, evaluate national security risks, and provide recommendations to reduce risk.

• Reporting and Guidance: The Inspector General must report findings to the House and Senate Committees on Armed Services by July 1, 2026. Following the audit, the Secretary must issue guidance to restrict the use of personnel from foreign countries of concern for Department IT systems and disclose to congressional defense committees if such personnel maintain a system.

• Waivers: The Secretary can waive the guidance if they certify in writing that the waiver is necessary for national security and does not pose a risk to national security.