A New House Bill Would Make Blast Radius Part of Federal Cloud Security Standards

Summarize with:

ChatGPTClaudePerplexityGoogle AIGrok

On October 26, Rep. Rich McCormick introduced the Common-Sense Cloud Security Act. The bill would direct the National Institute of Standards and Technology to write new cloud security standards that account for what happens after an attacker gets in. That includes how far a compromise can spread, what it can reach, and how to stop it from moving between workloads. Our standards have mostly left those questions unasked, and I think this bill asks the right ones. I appreciate Rep. McCormick’s leadership, and Aviatrix is proud to support the bill.

Most of our security standards were written for the data center, where one perimeter surrounded everything worth protecting. In the cloud, that perimeter has broken into thousands of smaller ones around every VM, Kubernetes pod and serverless function. AI is multiplying them faster than security teams can review. Agents and AI workloads are short-lived, often highly privileged and shipped fast, and each one inherits every path available to the infrastructure it runs on.

Last week showed what that means in practice. The php2shell vulnerabilities let an outsider take control of a PHP server with a crafted request. The eMudhra certificate failure went undetected for months. LiteLLM was compromised for the second time this year. Many companies took entire websites offline while they worked out where PHP was running. Patching and detection still matter, but on their own they can’t move fast enough. CrowdStrike puts average eCrime breakout time at 29 minutes. IBM and Ponemon put the average time to identify and contain a breach at 247 days.

The bill takes that gap seriously. It defines blast radius in law as “the maximum potential scope of unauthorized data access or system compromise from a compromised workload, data asset, or credential in a cloud environment,” and asks NIST for a way to determine it. It asks for recommendations on preventing and detecting attacks that move inside the cloud, including unauthorized east-west traffic between workloads. It calls for identity standards that tie credentials to a device, and it explicitly covers agentic accounts. It would also create a voluntary, tiered certification program, with testing by accredited independent labs, covering blast radius, intracloud attacks, third-party integrations and workload identity. Cloud providers serving the federal government would disclose their aggregate blast radius through FedRAMP.

I’ve been arguing for some time that we’re in the Containment Era. Prevention and detection remain essential, but attackers will get in, and the questions that decide the damage come next. How far can they move, and what can they reach? Containment answers those questions before an attack. You set what every workload is allowed to reach and enforce it on every path, whether or not anyone has detected the intrusion. A standard that measures blast radius gives boards, regulators and buyers a way to ask for that, and a way to check whether they got it.

Aviatrix builds containment, so we have an interest here. On October 26 we also launched Aviatrix Clearance. It gives every cloud workload Outbound Containment and Lateral Containment, with intrusion prevention. Every policy runs in monitor mode first, so teams can enforce it without breaking production. Through the Clearance Incident Response Program, Clearance is free to every enterprise across its entire estate from November 1, 2026, through May 1, 2027. The bill doesn’t depend on any product, though, and it shouldn’t.

It’s also worth being clear about what the bill does and doesn’t do. It has been introduced, not passed. Certification would be voluntary, and most of its obligations fall on cloud providers and the federal programs that buy from them. Containment doesn’t prevent the first break-in either. It limits how far one compromise spreads.

If the bill becomes law, NIST would open the standards for public comment within 180 days. I’d encourage every CISO and cloud provider to take part. The definition of blast radius that comes out of that process will shape how all of us are measured.

Read the full text of the Common-Sense Cloud Security Act here.