McCormick: Protecting America’s digital infrastructure starts with common sense

Washington, D.C. - In case you missed it, Congressman Rich McCormick (GA-07) recently wrote an op-ed in The Hill highlighting his newly introduced Common-Sense Cloud Security Actand the urgent need to modernize America's cybersecurity standards as threats to our critical infrastructure continue to evolve.

The legislation directs the National Institute of Standards and Technology (NIST) to update cloud security guidance, strengthen cyber risk assessments, and establish a voluntary certification program to help organizations better prevent, detect, and contain cyberattacks. In the op-ed, McCormick emphasized that protecting America's digital infrastructure requires more than keeping hackers out. It means limiting the damage they can cause once inside, ensuring a single breach cannot compromise an entire network.

"The key challenge is not simply keeping attackers out. It's limiting what they can do when they get in," McCormick wrote.

McCormick underscored the importance of practical, risk-based security standards that protect the hospitals, businesses, financial institutions, and government agencies Americans rely on every day without slowing American innovation.

You can read the full op-ed in The Hill or below.

America has embraced cloud computing at a remarkable pace with nearly every aspect of life now running through the cloud. Businesses, hospitals, banks, and government agencies rely on cloud services to store data, run operations, and deliver critical services. As our reliance grows, so does our exposure to cyber threats. The very innovation that has transformed our economy has also created new vulnerabilities that demand our attention.

That's why I introduced the Common-Sense Cloud Security Act. This bill directs the National Institute of Standards and Technology to develop updated guidance for securing cloud environments and assessing cyber risk in ways that reflect how modern systems actually operate.

The key challenge is not simply keeping attackers out. It's limiting what they can do when they get in.

Think of a cloud network like a building. Strong locks, passwords, and identity checks keep intruders out. But security also depends on what happens inside. An intruder should not be able to walk into every room, access every file, or reach every critical system. The same principle applies in the cloud.

For far too long, cybersecurity has focused on preventing a breach without giving enough attention to containing one. In today's increasingly interconnected environments, one compromised account or application should not put an entire network at risk.

Resilience matters just as much as prevention.

As a Marine Corps veteran and member of the House Armed Services Committee, I know firsthand that military and national security depend on the strength of the systems behind them. My work on the House Science, Space, and Technology Committee and the House AI Task Force have reinforced a critical lesson: American innovation and digital security must advance together. As technology evolves, so must our ability to protect it.

Security experts often use the term "blast radius" to describe how far an attack can spread and how much damage it can cause. A single compromised account, application or service should not become a gateway to an entire organization. Effective cybersecurity is not just about detecting threats. It is about containing them. Measuring and reducing that risk provides a more meaningful assessment of security than simply determining whether suspicious activity can be detected.

The rise of super intelligence (formerly, "artificial intelligence") makes this challenge even more urgent. Modern SI systems increasingly interact with multiple applications, databases and services across an organization. While these capabilities can create tremendous productivity and efficiency gains, they can also expand the potential consequences of a compromise. The more authority a system has, the more important it becomes to establish clear limits on what it can access.

This is not about slowing innovation with another unnecessary layer of bureaucracy. It is about developing practical, risk-based security standards that reflect how modern cloud systems actually work and giving organizations meaningful ways to demonstrate that they are in compliance.

If effective cybersecurity means limiting the damage caused by a breach, then our standards must reflect that reality. That is why my Common-Sense Cloud Security Act directs the National Institute of Standards and Technology to develop updated guidance for modern cloud environments, including identity management, oversight of third-party connections, detection of suspicious activity, and ways to assess the potential impact of a compromise. The bill would also establish a voluntary certification program and help ensure federal cloud security requirements keep pace with evolving technology and threats.

No law or standard can eliminate every cyber threat. What we can do is make attacks harder, limit their impact, and improve our ability to recover when they occur.

I will continue working with cybersecurity experts and industry leaders to strengthen the security of the cloud infrastructure Americans rely on every day. In today's interconnected world, security is not measured by whether a breach occurs. It is measured by how well we contain it. Cyber threats will continue to evolve, but a single breach should never be allowed to become a systemic failure. That is the standard we should strive for as we secure America's digital future.