DOD’s Cloud Strategy and the JEDI Cloud Procurement

Updated November 13, 2019 DOD’s Cloud Strategy and the JEDI Cloud Procurement In September 2017, the Deputy Secretary of Defense issued a memorandum calling for the accelerated adoption of a Department of Defense (DOD) enterprise-wide cloud services solution as a fundamental component of ongoing DOD modernization efforts. As a component of this effort, DOD sought to acquire a cloud services solution accessible to the entirety of the Department that can support Unclassified, Secret, and Top Secret requirements, focusing on commercially available cloud service solutions, through the Joint Enterprise Defense Infrastructure (JEDI) Cloud acquisition program. As DOD carried out the acquisition process for the JEDI Cloud program, industry and Congress focused significant attention on DOD’s intent to award the JEDI Cloud contract to a single company. On October 25, 2019, DOD announced it had awarded the JEDI Cloud contract to Microsoft. Background Broadly speaking, cloud computing refers to the practice of remotely storing and accessing information and software programs on demand, instead of storing data on a computer's hard drive or accessing it through an organization’s intranet. This practice relies on a cloud infrastructure, a collection of hardware and software that may include components such as servers and a network. Cloud infrastructure can be deployed privately to a select user group, publicly through subscription-based commercial services available to the general public, or through hybrid deployments that combine aspects of both private and public cloud infrastructure. DOD has been critical of its cloud services implementation to date, describing it as “decentralized” and creating “additional layers of complexity” that impede shared access to common applications and data across the department. DOD has also acknowledged that its prior lack of “clear guidance on cloud computing, adoption, and migration” has led to “limited capability … and inefficient acquisitions that cannot take advantage of economies of scale.” DOD’s Cloud Strategy DOD publicly released its Cloud Strategy in February 2019. The strategy described plans to extend cloud computing services across the Department by developing a “multicloud, multi-vendor … ecosystem composed of a General Purpose and [multiple] Fit For Purpose” clouds. DOD anticipates that the JEDI Cloud acquisition program will ultimately lead to a foundational enterprise-wide General Purpose cloud suitable for the majority of DOD systems and applications. DOD envisions Fit For Purpose clouds as task-specific clouds, or on-premises cloud solutions, to be used in limited situations where the General Purpose cloud is “not capable of supporting mission needs.” The JEDI Cloud Program DOD issued its Request for Proposals (RFP) for the JEDI Cloud on July 26, 2018; the RFP closed on October 9, 2018. In early April 2019, DOD completed its initial downselect from four qualified proposals submitted by IBM, Amazon Web Services, Microsoft, and Oracle America. Amazon Web Services and Microsoft remained in contention for the contract at that time. Contract Structure DOD conducted a full and open competition for a single award Indefinite Delivery/Indefinite Quantity (ID/IQ) firmfixed price contract for commercial items. The contract period of performance is structured as a two-year base ordering period, with three additional option periods, for a potential total of 10 years (see Table 1). DOD specified that the minimum guaranteed award is $1 million; the Department has estimated that contract spending across the contract’s base ordering period will total approximately $210 million. The contract is expected to have a ceiling of $10 billion across the entire potential 10-year period of performance. Under an ID/IQ contract, the government is only required to purchase the minimum amount specified in the contract, and may ultimately choose not to reach the contract’s ceiling. Table 1. Anticipated Period of Performance Performance Period Timeframe Base ordering period (2 years, guaranteed) 2019-2021 Option #1 (3 years, if exercised) 2021-2024 Option #2 (3 years, if exercised) 2024-2027 Option #3 (2 years, if exercised) 2027-2029 Source: JEDI Cloud RFP, “Combined Synopsis/Solicitation for Commercial Items.” JEDI Cloud Source Selection Process DOD indicated that the JEDI Cloud contract would be awarded to the offeror whose proposal met specified requirements and represented the best value to the government, based on a two-step evaluation process. In the first step, offerors were evaluated against seven “subfactor” performance-based criteria. Offerors’ proposals were deemed acceptable or unacceptable for each individual sub-factor as considered sequentially. A judgement of unacceptable for any sub-factor immediately disqualified a proposal from further consideration. If a proposal received a mark of acceptable for each sub-factor, it proceeded to the second phase of the source selection process, where it was then evaluated against five additional technical factors, together with the offeror’s price proposals, to determine a competitive range of offerors. Qualifying offerors—Microsoft and Amazon Web https://crsreports.congress.gov DOD’s Cloud Strategy and the JEDI Cloud Procurement Services—were next evaluated against two additional factors: the offeror’s proposed approach for meeting small business participation goals and a demonstration of the proposed solution’s capabilities. expended to migrate to a cloud environment; and (2) a detailed description of DOD’s strategy to implement enterprise-wide cloud computing. The Department submitted the required report in January 2019. Industry Reactions Proposed Legislation Section 1035 of S. 1790, the Senate-passed version of the FY2020 NDAA, would specify that the DOD CIO and the DOD Chief Data Officer, in consultation with the J6 C4 & Cyber Directorate of the Joint Staff and the DOD Chief Management Officer, must develop and issue DOD-wide policy and implementing instructions regarding the transition of data and applications to the cloud. DOD’s acquisition strategy sparked resistance from many commercial cloud vendors and industry observers who opposed DOD’s intent to award the contract to a single company. Oracle America and IBM both filed pre-award bid protests with the Government Accountability Office (GAO) against the JEDI Cloud solicitation. GAO denied Oracle America’s protests and dismissed IBM’s protests. Oracle America then filed a pre-award bid protest lawsuit with the U.S. Court of Federal Claims; the court ruled against Oracle America in a July 12, 2019, decision. In filings associated with its bid protest lawsuit, Oracle America in part alleged that the JEDI Cloud acquisition process was unfairly skewed in favor of Amazon Web Services through potential organizational conflicts of interest associated with three former DOD employees, each of whom was involved to some degree in the early development of the program. Two of these individuals were subsequently employed by Amazon. DOD investigations determined that Amazon Web Services had no conflicts of interest and established that the actions of the individuals identified by Oracle America did not negatively impact the procurement or grant Amazon Web Services an unfair competitive advantage. However, the investigations did identify individual violations of ethical standards established by the Federal Acquisition Regulation (FAR), which directs government procurement activities to be “conducted in a manner above reproach,” and for government employees to strictly avoid “even the appearance of a conflict of interest in Governmentcontractor relationships.” These findings were reportedly referred to the DOD Inspector General for further review. Congressional Activity Enacted Legislation Section 1064 of P.L. 115-232, the FY2019 National Defense Authorization Act (NDAA), requires the DOD Chief Information Officer (CIO) to conduct specified enabling activities to support DOD’s cloud adoption initiative and to submit a report detailing the current status and anticipated implementation of DOD’s cloud adoption initiative. The section also established a limitation on the obligation or expenditure of 15% of authorized FY2019 funds for the initiative until the required report’s submission. Section 1064 also requires the Deputy Secretary of Defense to “ensure that the acquisition approach of the Department continues to follow the [FAR] with respect to competition.” Section 8137 of P.L. 115-245, which provided FY2019 DOD appropriations, prevented the obligation or expenditure of FY2019 funds to “migrate data and applications to the proposed [JEDI] ... cloud computing services” until 90 days after the Secretary of Defense submitted to Congress (1) a plan to establish a DOD-wide budget accounting system for funds requested and expended for cloud services, as well as funds requested and H.Rept. 116-84, which accompanies H.R. 2968, the House Appropriations Committee-reported version of the FY2020 DOD appropriations act, highlights the committee’s concern regarding DOD’s pursuit of a “single vendor contract strategy” for the JEDI Cloud procurement. Accordingly, the House Appropriations Committee would direct that no funds may be obligated or expended to migrate data and applications to the JEDI Cloud until the DOD CIO provides a report to Congress expanding on the Department’s plans to transition to a “multi-cloud, multivendor” cloud environment. The DOD CIO would also be directed to submit quarterly reports on the Department’s cloud adoption and implementation strategy. Considerations for Congress Some industry observers contended that a single award contract appears to contradict broader federal cloud computing implementation guidance and industry best practices that stress the importance of multi-cloud solutions. Others pointed to the implementation approaches identified by DOD’s Cloud Strategy that indicate the Department expects the JEDI Cloud to serve certain enterprise-wide functions, performing as one component of a broader multicloud, multi-vendor DOD cloud system. Opponents of DOD’s use of a single-award contract for the JEDI Cloud program suggested that this tactic could restrict future competition for enterprise-wide DOD and cloud services. Supporters of DOD’s approach argued that the JEDI Cloud program’s requirement for offerors to develop platformagnostic applications and data schema suggests that the Department may be well equipped to migrate from any service environment developed under the JEDI Cloud contract to another such environment. Other Resources DOD Cloud Strategy, available at https://go.usa.gov/xy2Wm CRS Products CRS Report R45847, The Department of Defense’s JEDI Cloud Program, by Heidi M. Peters Heidi M. Peters, Analyst in U.S. Defense Acquisition Policy https://crsreports.congress.gov IF11264 DOD’s Cloud Strategy and the JEDI Cloud Procurement Disclaimer This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you wish to copy or otherwise use copyrighted material. https://crsreports.congress.gov | IF11264 · VERSION 9 · UPDATED