CLOUD Act
(18 U.S.C. § 2713)
The Clarifying Lawful Overseas Use of Data Act compels US-incorporated cloud providers — and their controlled subsidiaries — to disclose data in their possession, custody, or control on lawful request, regardless of where that data is physically stored. It is evaluated first for every US sovereign cloud assessment, ahead of FedRAMP.
3
Compliance Tiers
Baseline · Partial · Full
§2713
Core Statute
Stored Communications Act
Extraterritorial
Reach
Data location is irrelevant
1+
Executive Agreements
e.g. US–UK (2019)
What is the CLOUD Act?
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act), enacted in March 2018, amends the Stored Communications Act by adding 18 U.S.C. § 2713. It clarifies that a US-based provider must comply with a US warrant, subpoena, or court order to produce data within its possession, custody, or control — regardless of whether that data is stored inside or outside the United States.
Unlike FedRAMP, the CLOUD Act is not a certification a cloud service can attain — it is a statutory compulsion power. A provider cannot contract its way out of it; the only available responses are (1) the § 2713(b) comity-based motion to quash or modify when disclosure would conflict with the customer's home-country law, and (2) technical mitigations — customer-held encryption, notice-and-challenge clauses, and transparency reporting — that reduce what a compelled disclosure actually yields.
The Act also authorizes executive agreements with qualifying foreign governments (the US–UK CLOUD Act Agreement, in force since October 2019, is the first) that let those governments serve legal process directly on US providers for data belonging to their own nationals, bypassing the Mutual Legal Assistance Treaty (MLAT) process and its judicial review step.
Because reach depends on the provider's incorporation and corporate control — not on data residency — this platform evaluates CLOUD Act exposure before FedRAMP for any US-region assessment: FedRAMP measures technical/operational assurance, while the CLOUD Act determines the legal jurisdiction the workload sits under in the first place.
Compliance Tiers
Minimum posture: CLOUD Act exposure is documented but largely unmitigated.
- CSP ownership and incorporation jurisdiction identified
- No contractual notice-and-challenge clause in place
- Encryption keys remain CSP-managed
Core legal and data mitigations are in place; residual exposure remains.
- Contractual notice-and-challenge clause negotiated
- Customer-managed keys (BYOK) for regulated data classes
- At most 2 mandatory gate controls failing
Strongest achievable posture given the CLOUD Act cannot be contracted out of — compelled disclosure is a statutory power, not a control the CSP can waive.
- Notice-and-challenge rights + comity motion-to-quash commitment (§2713(b))
- Customer-held encryption (HYOK) — compelled disclosure yields ciphertext only
- Government-access transparency reporting reviewed at least annually
- Executive agreement / MLAT-bypass exposure mapped and documented
- Zero mandatory gate control failures
CLOUD Act — Sovereignty Pillar Mapping
How this platform's sovereignty pillar model maps to CLOUD Act mitigations. Unlike certification frameworks, there is no Technological or Identity Sovereignty control set — reach is a legal/corporate-structure question, not a technical one.
Legal Sovereignty
18 U.S.C. § 2713; § 2713(b) comity analysis- Notice-and-challenge clause for compelled-disclosure requests
- Ownership & jurisdiction disclosure — US parent/subsidiary exposure
- Executive agreement / MLAT-bypass exposure mapped (e.g. US–UK CLOUD Act Agreement, 2019)
Data Sovereignty
Technical mitigation, not a statutory carve-out- Customer-managed encryption keys (BYOK/HYOK) outside CSP control boundary
- Compelled disclosure limited to ciphertext when keys are held independently
Operational Sovereignty
Vendor risk management practice- CSP government-access transparency report reviewed at least annually
- Legal-process handling procedure documented in vendor risk register
Relationship to FedRAMP
FedRAMP and the CLOUD Act answer different questions. FedRAMP asks "is this cloud service technically and operationally secure enough for federal use?" — encryption strength, access control, incident response, continuous monitoring. The CLOUD Act asks "which government can compel disclosure of this data, and under what process?" — a jurisdiction question that FedRAMP's control baseline does not address on its own.
A workload can be fully FedRAMP High-authorized and still carry unmitigated CLOUD Act exposure if the CSP is US-incorporated and no notice-and-challenge or customer-held-key mitigations are in place. That is why this platform surfaces CLOUD Act as the primary framework for US-region assessments, with FedRAMP, CMMC, and NIST CSF evaluated alongside it as the technical assurance layer.
Disclaimer
Assessments produced by this platform represent structured self-attested evaluations of CLOUD Act exposure and available mitigations. They do not constitute legal advice. Organizations with specific CLOUD Act concerns should consult qualified counsel regarding their corporate structure, applicable executive agreements, and contractual protections with their cloud service provider.
Ready to assess your CLOUD Act exposure?
Run a full sovereignty assessment for US-region workloads, evaluated against CLOUD Act first.