Updated November 13 2019 DOD’s Cloud Strategy and the JEDI Cloud Procurement In September 2017 the Deputy Secretary of Defense issued a memorandum calling for the accelerated adoption of a Department of Defense DOD enterprise-wide cloud services solution as a fundamental component of ongoing DOD modernization efforts As a component of this effort DOD sought to acquire a cloud services solution accessible to the entirety of the Department that can support Unclassified Secret and Top Secret requirements focusing on commercially available cloud service solutions through the Joint Enterprise Defense Infrastructure JEDI Cloud acquisition program As DOD carried out the acquisition process for the JEDI Cloud program industry and Congress focused significant attention on DOD’s intent to award the JEDI Cloud contract to a single company On October 25 2019 DOD announced it had awarded the JEDI Cloud contract to Microsoft Background Broadly speaking cloud computing refers to the practice of remotely storing and accessing information and software programs on demand instead of storing data on a computer's hard drive or accessing it through an organization’s intranet This practice relies on a cloud infrastructure a collection of hardware and software that may include components such as servers and a network Cloud infrastructure can be deployed privately to a select user group publicly through subscription-based commercial services available to the general public or through hybrid deployments that combine aspects of both private and public cloud infrastructure DOD has been critical of its cloud services implementation to date describing it as “decentralized” and creating “additional layers of complexity” that impede shared access to common applications and data across the department DOD has also acknowledged that its prior lack of “clear guidance on cloud computing adoption and migration” has led to “limited capability … and inefficient acquisitions that cannot take advantage of economies of scale ” DOD’s Cloud Strategy DOD publicly released its Cloud Strategy in February 2019 The strategy described plans to extend cloud computing services across the Department by developing a “multicloud multi-vendor … ecosystem composed of a General Purpose and multiple Fit For Purpose” clouds DOD anticipates that the JEDI Cloud acquisition program will ultimately lead to a foundational enterprise-wide General Purpose cloud suitable for the majority of DOD systems and applications DOD envisions Fit For Purpose clouds as task-specific clouds or on-premises cloud solutions to be used in limited situations where the General Purpose cloud is “not capable of supporting mission needs ” The JEDI Cloud Program DOD issued its Request for Proposals RFP for the JEDI Cloud on July 26 2018 the RFP closed on October 9 2018 In early April 2019 DOD completed its initial downselect from four qualified proposals submitted by IBM Amazon Web Services Microsoft and Oracle America Amazon Web Services and Microsoft remained in contention for the contract at that time Contract Structure DOD conducted a full and open competition for a single award Indefinite Delivery Indefinite Quantity ID IQ firmfixed price contract for commercial items The contract period of performance is structured as a two-year base ordering period with three additional option periods for a potential total of 10 years see Table 1 DOD specified that the minimum guaranteed award is $1 million the Department has estimated that contract spending across the contract’s base ordering period will total approximately $210 million The contract is expected to have a ceiling of $10 billion across the entire potential 10-year period of performance Under an ID IQ contract the government is only required to purchase the minimum amount specified in the contract and may ultimately choose not to reach the contract’s ceiling Table 1 Anticipated Period of Performance Performance Period Timeframe Base ordering period 2 years guaranteed 2019-2021 Option #1 3 years if exercised 2021-2024 Option #2 3 years if exercised 2024-2027 Option #3 2 years if exercised 2027-2029 Source JEDI Cloud RFP “Combined Synopsis Solicitation for Commercial Items ” JEDI Cloud Source Selection Process DOD indicated that the JEDI Cloud contract would be awarded to the offeror whose proposal met specified requirements and represented the best value to the government based on a two-step evaluation process In the first step offerors were evaluated against seven “subfactor” performance-based criteria Offerors’ proposals were deemed acceptable or unacceptable for each individual sub-factor as considered sequentially A judgement of unacceptable for any sub-factor immediately disqualified a proposal from further consideration If a proposal received a mark of acceptable for each sub-factor it proceeded to the second phase of the source selection process where it was then evaluated against five additional technical factors together with the offeror’s price proposals to determine a competitive range of offerors Qualifying offerors—Microsoft and Amazon Web https crsreports congress gov DOD’s Cloud Strategy and the JEDI Cloud Procurement Services—were next evaluated against two additional factors the offeror’s proposed approach for meeting small business participation goals and a demonstration of the proposed solution’s capabilities expended to migrate to a cloud environment and 2 a detailed description of DOD’s strategy to implement enterprise-wide cloud computing The Department submitted the required report in January 2019 Industry Reactions Proposed Legislation Section 1035 of S 1790 the Senate-passed version of the FY2020 NDAA would specify that the DOD CIO and the DOD Chief Data Officer in consultation with the J6 C4 Cyber Directorate of the Joint Staff and the DOD Chief Management Officer must develop and issue DOD-wide policy and implementing instructions regarding the transition of data and applications to the cloud DOD’s acquisition strategy sparked resistance from many commercial cloud vendors and industry observers who opposed DOD’s intent to award the contract to a single company Oracle America and IBM both filed pre-award bid protests with the Government Accountability Office GAO against the JEDI Cloud solicitation GAO denied Oracle America’s protests and dismissed IBM’s protests Oracle America then filed a pre-award bid protest lawsuit with the U S Court of Federal Claims the court ruled against Oracle America in a July 12 2019 decision In filings associated with its bid protest lawsuit Oracle America in part alleged that the JEDI Cloud acquisition process was unfairly skewed in favor of Amazon Web Services through potential organizational conflicts of interest associated with three former DOD employees each of whom was involved to some degree in the early development of the program Two of these individuals were subsequently employed by Amazon DOD investigations determined that Amazon Web Services had no conflicts of interest and established that the actions of the individuals identified by Oracle America did not negatively impact the procurement or grant Amazon Web Services an unfair competitive advantage However the investigations did identify individual violations of ethical standards established by the Federal Acquisition Regulation FAR which directs government procurement activities to be “conducted in a manner above reproach ” and for government employees to strictly avoid “even the appearance of a conflict of interest in Governmentcontractor relationships ” These findings were reportedly referred to the DOD Inspector General for further review Congressional Activity Enacted Legislation Section 1064 of P L 115-232 the FY2019 National Defense Authorization Act NDAA requires the DOD Chief Information Officer CIO to conduct specified enabling activities to support DOD’s cloud adoption initiative and to submit a report detailing the current status and anticipated implementation of DOD’s cloud adoption initiative The section also established a limitation on the obligation or expenditure of 15% of authorized FY2019 funds for the initiative until the required report’s submission Section 1064 also requires the Deputy Secretary of Defense to “ensure that the acquisition approach of the Department continues to follow the FAR with respect to competition ” Section 8137 of P L 115-245 which provided FY2019 DOD appropriations prevented the obligation or expenditure of FY2019 funds to “migrate data and applications to the proposed JEDI cloud computing services” until 90 days after the Secretary of Defense submitted to Congress 1 a plan to establish a DOD-wide budget accounting system for funds requested and expended for cloud services as well as funds requested and H Rept 116-84 which accompanies H R 2968 the House Appropriations Committee-reported version of the FY2020 DOD appropriations act highlights the committee’s concern regarding DOD’s pursuit of a “single vendor contract strategy” for the JEDI Cloud procurement Accordingly the House Appropriations Committee would direct that no funds may be obligated or expended to migrate data and applications to the JEDI Cloud until the DOD CIO provides a report to Congress expanding on the Department’s plans to transition to a “multi-cloud multivendor” cloud environment The DOD CIO would also be directed to submit quarterly reports on the Department’s cloud adoption and implementation strategy Considerations for Congress Some industry observers contended that a single award contract appears to contradict broader federal cloud computing implementation guidance and industry best practices that stress the importance of multi-cloud solutions Others pointed to the implementation approaches identified by DOD’s Cloud Strategy that indicate the Department expects the JEDI Cloud to serve certain enterprise-wide functions performing as one component of a broader multicloud multi-vendor DOD cloud system Opponents of DOD’s use of a single-award contract for the JEDI Cloud program suggested that this tactic could restrict future competition for enterprise-wide DOD and cloud services Supporters of DOD’s approach argued that the JEDI Cloud program’s requirement for offerors to develop platformagnostic applications and data schema suggests that the Department may be well equipped to migrate from any service environment developed under the JEDI Cloud contract to another such environment Other Resources DOD Cloud Strategy available at https go usa gov xy2Wm CRS Products CRS Report R45847 The Department of Defense’s JEDI Cloud Program by Heidi M Peters Heidi M Peters Analyst in U S Defense Acquisition Policy https crsreports congress gov IF11264 DOD’s Cloud Strategy and the JEDI Cloud Procurement Disclaimer This document was prepared by the Congressional Research Service CRS CRS serves as nonpartisan shared staff to congressional committees and Members of Congress It operates solely at the behest of and under the direction of Congress Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role CRS Reports as a work of the United States Government are not subject to copyright protection in the United States Any CRS Report may be reproduced and distributed in its entirety without permission from CRS However as a CRS Report may include copyrighted images or material from a third party you may need to obtain the permission of the copyright holder if you wish to copy or otherwise use copyrighted material https crsreports congress gov IF11264 · VERSION 9 · UPDATED