LegiStorm

Summary:

In September 2017, Deputy Secretary of Defense (DSD) Patrick Shanahan issued a memorandum calling for the accelerated adoption of a Department of Defense (DOD)-wide cloud computing system. Under the Joint Enterprise Defense Infrastructure (JEDI) Cloud program, DOD seeks to "acquire a...cloud services solution that can support Unclassified, Secret, and Top Secret requirements," with a focus on commercially available services. Significant industry and congressional attention has been focused on the JEDI Cloud contract. What is Cloud Computing? Broadly speaking, cloud computing refers to the practice of remotely storing and accessing information and software programs through the internet, instead of storing data on a computer's hard drive or accessing it through an organization's intranet. It relies on cloud infrastructure, a collection of hardware and software that may include components such as servers and a network. This infrastructure can be deployed privately to a select user group, or publicly through commercial services available to the general public. What is the Current Status of DOD's Adoption of Cloud Services? DOD maintains more than 500 public and private cloud infrastructures that support Unclassified and Secret requirements. DOD has described its current cloud services use as "decentralized," creating "additional layers of complexity for managing data and services at an enterprise level." In a statement accompanying the release of the JEDI Cloud Request for Proposal (RFP) on July 26, 2018, DOD Chief Information Officer (CIO) Dana Deasy noted that the department requires an enterprise-wide cloud "that allows for data-driven decision making [and] enables DOD to take advantage of our applications and data resources" to provide worldwide support for DOD operations. What Policies Apply to DOD Cloud Acquisitions? While the Federal Acquisition Regulation (FAR) does not specifically provide acquisition guidance for cloud computing services, select sections (such as FAR Part 39, Acquisition of Information Technology) may apply. Other government-wide policies for cloud products and services, such as the Federal Risk and Authorization Management Program (FedRAMP), may also apply. DOD policies for acquiring cloud services are prescribed by Defense Federal Acquisition Regulation Supplement Subpart 239.76, which states that DOD must generally acquire cloud services using commercial terms and conditions consistent with federal law and DOD's needs. A contract to acquire cloud services may generally only be awarded to a provider (e.g., a prime contractor or subcontractor) with provisional Defense Information Security Agency (DISA) authorization to provide such services, consistent with the current version of the DOD Cloud Computing Security Requirements Guide. DOD Instruction 5000.74, Defense Acquisition of Services, specifies that all cloud services must have an Authority to Operate (see also DOD Instruction 8510.01, Risk Management Framework for DOD Information Technology). DOD Memorandum Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services, issued on December 15, 2014, provides additional guidance for the acquisition of commercial cloud services. How is the JEDI Cloud Contract Structured? Through the JEDI Cloud contract, DOD is conducting a full and open competition, which will result in a single award Indefinite Delivery/Indefinite Quantity (ID/IQ) firm-fixed price contract for commercial items (i.e., cloud infrastructure and computing services). What is an ID/IQ Contract? An ID/IQ contract allows the U.S. government to obtain an unspecified quantity of supplies or services over an unspecified period of time. An indefinite-quantity contract can also be referred to as a task-order contract. A task-order contract does not procure a firm quantity of services (other than a minimum or maximum quantity) and allows the issuance of orders for the performance of tasks (i.e., task orders) under the contract. The period of performance is structured as a 2-year base ordering period, with three additional option periods (two 3-year options and one 2-year option), for a potential total of 10 years. Anticipated JEDI Cloud Contract Period of Performance Period of Performance Timeframe Base ordering period (2 years, guaranteed) April 17, 2019 – April 16, 2021 Option #1 (3 years, if exercised) April 17, 2021 – April 16, 2024 Option #2 (3 years, if exercised) April 17, 2024 – April 16, 2027 Option #3 (2 years, if exercised) April 17, 2027 – April 16, 2029 Source: JEDI Cloud RFP, "Combined Synopsis/Solicitation for Commercial Items," updated August 31, 2018. DOD wants the JEDI Cloud to provide services comparable to those made available through commercial cloud services and is requiring any successful offeror to provide rapid deployment of new commercially available cloud-related services to JEDI Cloud users. DOD also expects ongoing parity with public commercial prices. DOD indicated that the minimum guaranteed award is $1 million. The contract has a maximum ceiling of $10 billion across the potential 10-year period of performance. Under an ID/IQ contract, the government is only required to purchase the minimum amount specified in the contract, and may ultimately choose not to reach the contract ceiling. The RFP closed on October 9, 2018; DOD is currently reviewing received bids. How Has Industry Reacted? DOD received more than 1,500 comments in response to multiple draft RFPs; companies including Amazon, Google, IBM, and Microsoft expressed interest in competing. However, DOD's proposed acquisition strategy also sparked resistance from those who opposed DOD's intent to award the contract to a single company. This concern led some industry associations to publicly contest a single award, arguing that it would be inconsistent with broader federal cloud computing strategy, and could unfairly restrict future competition for DOD cloud services. For example, the trade group ITAPS (IT Alliance for Public Sector) sent a letter to the House and Senate Armed Services committees stating in part that the: ...deployment of a single cloud conflicts with established best practices and industry trends in the commercial marketplace, as well as current law and regulation, which calls for the award of multiple task or delivery order contracts...Further, the speed of adoption of innovative commercial solutions, like cloud, is facilitated by the use of these best practices. On October 8, 2018, Google announced that it would not be submitting a bid for the contract, citing possible conflict with its corporate principles, along with DOD's plans to award the contract to a single vendor, among its reasons for withdrawing. Oracle America and IBM both filed pre-award bid protests against the JEDI Cloud solicitation; GAO denied Oracle America's protests on November 14, 2018 and denied IBM's protests on December 11, 2018. Subsequent to GAO's dismissal of its protests, Oracle America filed a bid protest lawsuit with the U.S. Court of Federal Claims (Oracle America Inc. v. U.S., case number 1:18-cv-01880). How Has DOD Responded to Industry Concerns? DSD Shanahan and other DOD officials have reportedly described JEDI Cloud as a "pathfinder" intended to provide a model for DOD's future transition of legacy IT systems to the cloud. In its May 2018 report to Congress DOD indicated that the JEDI Cloud contract would include: ...multiple mechanisms to...maximize DOD's flexibilities going forward...Option periods...will only be exercised if doing so is the most advantageous method for fulfilling the DOD's requirements when considering the market conditions at the time of option exercise. DOD noted that a multiple-award contract would require competition for each task order issued under the JEDI Cloud ID/IQ, and would therefore be subject to standard timeframes associated with the DOD acquisition process, which could "prevent DOD from rapidly delivering new capabilities and improved effectiveness...that enterprise-level cloud computing can enable." DOD has also said that it "expects to maintain contracts with numerous cloud providers to access specialized capabilities not available under the JEDI Cloud contract." What Actions Has Congress Taken? Section 8137 of P.L. 115-245, which provided FY2019 DOD appropriations, prevents the obligation or expenditure of FY2019 funds to "migrate data and applications to the proposed [JEDI]...cloud computing services" until 90 days after the Secretary of Defense submits to the congressional defense committees: 1) a plan to establish a DOD-wide budget accounting system for funds requested and expended for cloud services, as well as funds requested and expended to migrate to a cloud environment; and 2) a detailed description of DOD's strategy to implement enterprise-wide cloud computing. On October 22, 2018, two members of the House Appropriations Committee asked the DOD Inspector General (IG) to investigate the development of requirements and the RFP process for the JEDI Cloud program; the DOD IG is reviewing the request.