The Department of Defense’s JEDI Cloud Program

Summary: In September 2017, the Deputy Secretary of Defense issued a memorandum calling for the accelerated adoption of a Department of Defense (DOD) enterprise-wide cloud services solution as a fundamental component of ongoing DOD modernization efforts. As a component of this effort, DOD is seeking to acquire a cloud services solution accessible to the entirety of the Department that can support Unclassified, Secret, and Top Secret requirements, focusing on commercially available cloud service solutions, through the Joint Enterprise Defense Infrastructure (JEDI) Cloud acquisition program.

Summary: DOD intends to conduct a full and open competition that is expected to result in a single award Indefinite Delivery/Indefinite Quantity firm-fixed price contract for commercial items. DOD has indicated that the minimum guaranteed award is $1 million, and that the initial period of performance is two years. The contract is expected to have a maximum ceiling of $10 billion across a potential 10-year period of performance. DOD is in the final stages of evaluating proposals, with Amazon Web Services and Microsoft remaining in contention for the contract. The Department originally expected to award the contract in August 2019. However, Secretary of Defense Dr. Mark T. Esper is reportedly currently reviewing the JEDI Cloud program, which may delay the award.

Summary: Significant industry and congressional attention has been focused on DOD's intent to award the JEDI Cloud contract to a single company. Oracle America filed multiple pre-award bid protests with the Government Accountability Office, which were denied. Oracle America then filed a bid protest lawsuit with the U.S. Court of Federal Claims; the court ruled against Oracle in a July 12, 2019, decision. In filings associated with its bid protests, Oracle America alleged in part that the JEDI Cloud acquisition process was unfairly skewed in favor of Amazon Web Services through potential organizational conflicts of interest associated with three former DOD employees, each of whom was involved to greater or lesser degrees in the early development of the program. DOD investigations determined that Amazon Web Services had no conflicts of interest and established that the actions of the individuals identified by Oracle America did not negatively impact the procurement or grant Amazon Web Services an unfair competitive advantage. However, the investigations did identify individual violations of ethical standards established by the Federal Acquisition Regulation.

Summary: Some industry observers contend that an initial single award appears to contradict broader federal cloud computing implementation guidance and industry best practices that stress the importance of multi-cloud solutions. Others point to the implementation approaches identified by DOD's 2019 Cloud Strategy as evidence that the Department expects the JEDI Cloud to serve certain enterprise-wide functions, performing as one component of a broader multi-cloud, multi-vendor system. Opponents of DOD's use of a single-award contract for the JEDI Cloud program have suggested that this tactic could restrict future competition for enterprise-wide DOD cloud services. Supporters of DOD's approach argue that the JEDI Cloud program's requirement for offerors to develop applications and data schema easily transferable to different platforms suggests that the Department may be equipped to migrate from any service environment developed under the JEDI Cloud contract to another such environment.

Summary: Several Members of Congress have engaged the Administration to express their views regarding the JEDI Cloud acquisition program and pending contract award. The 116 th Congress is considering related authorization and appropriations legislation that could shape future implementation of the program ( H.R. 2740 , H.R. 2500 , and S. 1790 ).

This report provides analysis of relevant background information and considerations for Congress associated with ongoing Department of Defense (DOD) efforts to obtain enterprise-wide cloud computing services through the Joint Enterprise Defense Infrastructure (JEDI) Cloud acquisition program.

In September 2017, then-Deputy Secretary of Defense (DSD) Patrick Shanahan issued a memorandum calling for the accelerated adoption of a DOD enterprise-wide cloud services solution as a key component of ongoing DOD modernization efforts. DOD views this adoption process as a two part effort: in the first phase, DOD is seeking to acquire a cloud services solution accessible to the entirety of the Department that can support Unclassified, Secret, and Top Secret requirements, focusing on commercially available cloud service solutions, through the JEDI Cloud acquisition program. In the second phase, DOD seeks to transition selected existing data and applications maintained by the military departments and agencies to the cloud.

Broadly speaking, cloud computing refers to the practice of remotely storing and accessing information and software programs on demand through the internet, instead of storing data on a computer's hard drive or accessing it through an organization's intranet. It relies on a cloud infrastructure , a collection of hardware and software that may include components such as servers and a network. This infrastructure can be deployed privately to a select user group, publicly through subscription-based commercial services available to the general public, or through hybrid deployments that combine aspects of both private and public cloud infrastructure.

Cloud computing capabilities are delivered to end users through three main service models:

Software as a Service (SaaS) , which provides end users with access to software applications hosted and managed by the cloud computing provider (such as Dropbox, Slack, or Google web-based applications); Platform as a Service (PaaS) , which provides end users with the ability to construct and distribute web-based software applications through a common interface hosted and managed by the cloud computing provider (such as Google App Engine, Amazon Web Services Elastic Beanstalk, Microsoft Azure, and Oracle Cloud); and Infrastructure as a Service (IaaS) , which provides end users with remote access to infrastructure componentsâsuch as servers, virtual machines, and storageâmaintained by the cloud computing provider (such as Amazon Elastic Compute Cloud, Google Compute Engine, and Microsoft Azure).

Many major cloud vendors, such as Microsoft and Amazon, are increasingly offering products and services that combine aspects of these service models.

Cost, efficiency, accessibility, agility of improvements, security, and reliability are all considerations in public and private sector decisions about cloud service adoption. For a more in-depth discussion of these factors and cloud computing characteristics, deployment models, and service models, see CRS Report R42887, Overview and Issues for Implementation of the Federal Cloud Computing Initiative: Implications for Federal Information Technology Reform Management , by Patricia Moloney Figliola and Eric A. Fischer.

What Is the Current Status of DOD's Adoption of Cloud Services?

Since the establishment of the Federal Cloud Computing Initiative (FCCI) in 2009, the federal governmentâincluding DODâhas actively worked to shift portions of its information technology (IT) needs to cloud-based services through strategies such as "Cloud First," which required federal agencies to prioritize the use of cloud-based solutions whenever a secure, reliable, and cost-effective option existed. This move was intended in part to reduce the total investment by the federal government in physical information technology (IT) infrastructureâthrough actions such as reducing or eliminating data storage at agency-owned and operated data centersâas well as capitalizing on other advantages of cloud adoption.

DOD efforts to acquire cloud services have been ongoing; however, DOD has described its current cloud services use as "decentralized" and "disparate," creating "additional layers of complexity" that impede shared access to common applications and data across the Department. As of mid-2018, DOD reported maintaining more than 500 public and private cloud infrastructures that support Unclassified and Secret requirements. DOD has also acknowledged that its prior lack of "clear guidance on cloud computing, adoption, and migration," as well as acquisition guidance that allowed DOD components to independently pursue the procurement of cloud-based services, has led to "disjointed implementations with limited capability, siloed data, and inefficient acquisitions that cannot take advantage of economies of scale."

DOD publicly released its current "Cloud Strategy" in February 2019. As part of its cloud strategy, DOD identifies the need to adopt cloud computing services across the Department as a priority, and articulates its intent to develop a "multi-cloud, multi-vendor â¦ ecosystem composed of a General Purpose and [multiple] Fit For Purpose" (see Figure 1 ) clouds.

DOD anticipates that the JEDI Cloud acquisition program will ultimately lead to a foundational enterprise-wide "General Purpose" cloud suitable for the majority of DOD systems and applications, enabling DOD to offer IaaS and PaaS at all classification levels. "Fit For Purpose" clouds, on the other hand, are envisioned as task-specific "commercial solution[s]"âsuch as the ongoing Defense Enterprise Office Solutions (DEOS) SaaS acquisition program that will create a cloud-based replacement for certain DOD software-based applications such as email and instant messaging servicesâor "on-premises cloud solution[s]," such as DISA's milCloud 2.0, which provides IaaS, to be used in limited situations where the "General Purpose" cloud cannot adequately support mission needs."

What Acquisition Policies Apply to DOD Procurement of CloudÂ Services?

While the Federal Acquisition Regulation (FAR) does not explicitly provide acquisition guidance for cloud computing services, certain sections (e.g., FAR Part 39, Acquisition of Information Technology or FAR Part 12, Acquisition of Commercial Items ) may apply depending on the specific acquisition strategy for a particular contract. Certain other government-wide acquisition policies for cloud services, such as the Federal Risk and Authorization Management Program (FedRAMP) security assessment process, apply.

DOD-specific policies for acquiring cloud services are prescribed in part by Defense Federal Acquisition Regulation Supplement (DFARS) Subpart 239.76, which states that DOD must generally acquire cloud services using commercial terms and conditionsâsuch as license agreements, end user license agreements, terms of service, or other similar legal instrumentsâconsistent with federal law and DOD's needs. A contract to acquire cloud services may generally only be awarded to a provider with provisional Defense Information Security Agency (DISA) authorization to provide such services, consistent with the current version of the DOD Cloud Computing Security Requirements Guide (SRG).

To maintain legal jurisdiction over information and data accessed via a cloud services solution, all data stored and processed by or for DOD must reside in a facility under the exclusive legal jurisdiction of the United Statesâmeaning that cloud computing service providers are generally required to store government data that is not physically located on DOD premises at locations within the United States or outlying areas of the United States.

All cloud services must have an Authorization to Operate (ATO), an official decision made by a senior official that explicitly accepts any associated operational risks (i.e., risks to organizational operations or assets; individuals; other organizations; or the United States). An ATO is based on the implementation of an agreed-upon set of security controls. The 2014 DOD Memorandum Updated Guidance on the Acquisition and Use of Commercial Cloud Computing Services authorized the direct acquisition of cloud services by DOD components, and provided additional guidance for the acquisition of commercial cloud services.

In the unclassified summary of the 2018 National Defense Strategy (NDS), the Department articulates the need for significant DOD investment in key technology capabilities such as "cyber defense, resilience, and the continued integration of cyber capabilities into the full spectrum of military operations," as well as "military application of autonomy, artificial intelligence, and machine learning" in order to maintain military superiority against near-peer adversaries such as China and Russia. The Department views the cloud computing and data storage capabilities to be acquired through the JEDI Cloud procurement as providing "foundational technologies" for these investments. The Joint Chiefs of Staff has also stated that "efforts for accelerating [cloud adoption] are critical in creating a global, resilient, and secure information environment that enables warfighting and mission command." DOD Chief Information Officer (CIO) Dana Deasy has further contended that the Department requires an enterprise-wide cloud "that allows for data-driven decision making [and] enables DOD to take advantage of our applications and data resources," in part to provide worldwide support for DOD operations.

In recent public statements DOD CIO Deasy, as well as Lt. Gen. Bradford J. Shwedo, Director for Command, Control, Communications and Computers/Cyber of the J6 Command, Control, Communications, and Computers (C4) and Cyber Directorate of the Joint Staff, have also emphasized that delays in pursuing the capabilities included in the JEDI Cloud procurement may adversely affect ongoing Department activities, such as the recently established Joint Artificial Intelligence Center, which seeks to accelerate the delivery of artificial intelligence-enabled capabilities to DOD.

Who Has Responsibility for the JEDI Cloud Program Within DOD?

Initially, the Cloud Executive Steering Group (CESG) oversaw DOD's cloud adoption initiative. The CESG, established in September 2017, reported directly to the Deputy Secretary of Defense (DSD). The CESG was originally chaired by Ellen Lord, then the Under Secretary of Defense for Acquisition, Technology, and Logistics (USD (AT&L)). At first, the CESG included the Director of the Strategic Capabilities Office (SCO), the Managing Partner of the Defense Innovation Unit Experimental (DIUx, now known as the Defense Innovation Unit, or DIU), the Director of the Defense Digital Service (DDS), and the Executive Director of the Defense Innovation Board (DIB) as voting members (see Table 1 ). The DDS Director was tasked with leading phase one of DOD's cloud adoption initiative: the JEDI Cloud program.

In January 2018, the DSD announced changes to the membership and leadership of the CESG; the Deputy Chief Management Officer (DCMO; Jay Gibson, who was serving as DCMO at the time, would later become DOD's first CMO) would chair the group, with the Director of Cost Assessment and Program Evaluation (CAPE) and the DOD CIO added to the group's members.

In June 2018, the DSD announced that the DOD CIO, as the principal staff assistant and senior advisor to the Secretary of Defense for information technology, would oversee all aspects of DOD's cloud adoption initiative, to include the JEDI Cloud acquisition program. The Cloud Computing Program Office (CCPO), which was established by DDS to serve as the program office for the JEDI Cloud program, was also transitioned to the Office of the CIO at that time.

What Is the Current Status of the JEDI Cloud Contract?

A Request for Information (RFI) for the JEDI Cloud program was issued in October 2017; the Department held an industry day event and issued a draft Request for Proposal (RFP) in early March 2018, with a second draft RFP issued in April 2018. The final JEDI RFP was issued on July 26, 2018, and closed on October 9, 2018. In early April 2019, DOD announced that the Department had completed an initial downselect from four qualified proposals submitted by IBM, Amazon Web Services, Microsoft, and Oracle America. Amazon Web Services and Microsoft remain in contention for the contract. The Department is in the final stages of evaluating proposals, and originally anticipated announcing a contract award decision in August 2019. However, Secretary of Defense Dr. Mark T. Esper is reportedly currently reviewing the JEDI Cloud program, which may delay the award.

DOD requested $61.9 million in funding for the JEDI Cloud acquisition program for Fiscal Year (FY) 2020.

How Is the JEDI Cloud Contract Structured?

Through the JEDI Cloud contract, DOD intends to conduct a full and open competition that will result in a single award Indefinite Delivery/Indefinite Quantity (ID/IQ) firm-fixed price contract for commercial items (i.e., IaaS and PaaS).

DOD wants the JEDI Cloud to provide worldwide cloud computing servicesâincluding in austere environmentsâcomparable to those made available through commercial cloud services. Accordingly, the Department has specified that an offeror does not need to maintain dedicated or exclusive infrastructure for unclassified services. However, offerors must comply with the JEDI Cloud Cyber Security Plan, and must provide dedicated, exclusive infrastructure for classified services.

DOD is further requiring any successful offeror to provide rapid deployment of new commercially available cloud-related services to JEDI Cloud users, and expects ongoing parity with public commercial prices. DOD indicated that the minimum guaranteed award is $1 million. The contract is expected to have a maximum ceiling of $10 billion across a potential 10-year period of performance. Under an ID/IQ contract, the government is only required to purchase the minimum amount specified in the contract, and may ultimately choose not to reach the contract ceiling. The contract period of performance is structured as a two-year base ordering period, with three additional option periods (two three-year options and one two-year option), for a potential total of 10 years (see Table 1 ).

What Is the Source Selection Process for the JEDI Cloud Contract?

DOD indicated that it will award the JEDI Cloud contract to the offeror whose proposal meets specified requirements and represents the best value to the government, based on a two-step evaluation process. In the first step, offerors were evaluated against seven performance-based criteria (see Figure 2 for a full listing).3 Proposals were deemed acceptable or unacceptable for each individual sub-factor as considered sequentially: a judgement of unacceptable immediately disqualified a proposal from further consideration. For example, performance sub-factor 1.1, "Elastic Usage," requires offerors to provide summary data for the months of January and February 2018 in order to demonstrate that additional traffic generated by unclassified usage of the JEDI Cloud would not represent a majority of a proposed solution's commercially available network, computational, and storage capacity. Performance sub-factor 1.2, "High Availability and Failover," in part requires offerors to have no fewer than three existing physical data centers at least 150 miles apart within the United States or outlying areas of the United States.

If a proposal received a mark of "acceptable" for each sub-factor, it proceeded to the second phase of the source selection process, where it was then evaluated against five additional technical factors, together with submitted price proposals, to determine a "competitive range" of offerors. Qualifying offerors within the competitive range were next evaluated against two additional factors: the offeror's approach to meeting small business participation goals and a demonstration of the proposed solution's capabilities.

DOD received more than 1,500 comments in response to its draft RFPs. Companies including Amazon Web Services, Google, IBM, and Microsoft initially expressed interest in competing for the JEDI Cloud contract. However, DOD's acquisition strategy also sparked resistance from those who opposed DOD's intent to award the contract to a single company. This concern led some industry associations to publicly contest a single award, arguing that it would be inconsistent with broader federal cloud computing implementation guidance, and could unfairly restrict future competition for DOD cloud services.

For example, the trade group ITAPS (IT Alliance for Public Sector) sent a letter to the House and Senate Armed Services committees stating in part that the

deployment of a single cloud conflicts with established best practices and industry trends in the commercial marketplace, as well as current law and regulation, which calls for the award of multiple task or delivery order contracts.... Further, the speed of adoption of innovative commercial solutions, like cloud, is facilitated by the use of these best practices.

In October 2018, Google announced that it would not be submitting a bid for the contract, citing possible conflict with its corporate principles, along with DOD's plans to award the contract to a single vendor, among its reasons for withdrawing.

GAO Bid Protests and U.S. Court of Federal Claims Case

Oracle America and IBM both filed pre-award bid protests with the Government Accountability Office (GAO) against the JEDI Cloud solicitation; GAO denied Oracle America's protests on November 14, 2018, and dismissed IBM's protests on December 11, 2018. Subsequently, Oracle America filed a bid protest lawsuit with the U.S. Court of Federal Claims.

In filings associated with its bid protest lawsuit, Oracle America in part alleged that (1) the performance-based criteria include in the first step of the contract source selection process were "unduly restrictive and arbitrary" and (2) the JEDI Cloud acquisition process was unfairly skewed in favor of Amazon Web Services through potential organizational conflicts of interest associated with three former DOD employees, each of whom was involved to greater or lesser degrees in the early development of the program. Two of these former DOD employees were subsequently employed by Amazon Web Services. These claims attracted significant media and congressional attention.

DOD investigations determined that Amazon Web Services had no unmitigated organizational conflicts of interest, and established that the actions of the individuals identified by Oracle America did not negatively impact the procurement or grant Amazon Web Services an unfair competitive advantage. However, the investigations did identify individual violations of ethical standards established by FAR Part 3.101-1, which directs government procurement activities to be "conducted in a manner above reproach," and for government employees to strictly "avoid â¦ any conflict of interest or even the appearance of a conflict of interest in Government-contractor relationships." These findings were reportedly referred to the DOD Inspector General for further review.

The U.S. Court of Federal Claims ruled against Oracle America in a July 12, 2019, decision, finding in part that sub-factor 1.2 of the sequentially considered performance-based criteria included in the Department's source selection process was "enforceable," and noting that as Oracle America admitted that its services did not "meet that criteria at the time of proposal submission, [the Court] conclude[s] that it cannot demonstrate prejudice as a result of other possible errors in the procurement process ."

How Has DOD Responded to Industry Concerns?

Potential for Restriction of Future Competition

DOD officials have repeatedly described JEDI Cloud as a test model for DOD's future transition of legacy information technology systems to the cloud and have stressed that it is not intended to be a final solution. DOD CIO Dana Deasy has also highlighted the Department's lack of experience in deploying an enterprise-wide cloud solution, arguing that "starting with a number of firms while at the same time trying to build out an enterprise capability" would "double or triple" the technical complexity of the program. In the Department's May 2018 report to Congress, DOD indicated that the JEDI Cloud contract would include

multiple mechanisms to â¦ maximize DOD's flexibilities going forward â¦ the initial base ordering period is limited to 2 years, which will allow for sufficient time to validate the operational capabilities of JEDI Cloud and the DOD enterprise-wide approach. Option periods ... will only be exercised if doing so is the most advantageous method for fulfilling the DOD's requirements when considering the market conditions at the time of option exercise.

As detailed in the JEDI Cloud RFP, offerors submitting a proposal to DOD were required to provide detailed transition and data portability plans, to include the complete set of processes and procedures necessary to extract all relevant data (such as system and network configurations, activity logs, source code, etc.) from the JEDI Cloud environment and systematically migrate to another cloud environment.

Section 2304a of Title 10, U.S. Code establishes a preference for making multiple awards for task or delivery order contracts, and separately prohibits DOD from awarding task or delivery order contracts exceeding $112 million (including all option periods) to a single source unless the head of the agency determines in writing that one or more of four specified circumstances apply.

DOD detailed the rationale for using a single-award ID/IQ contract for the JEDI Cloud procurement, pursuant to 10 U.S.C.2304a(d)(4) and the provision's implementing FAR requirements, noting that while the FAR establishes a general preference for multiple award ID/IQ contracts, the FAR also establishes that a contracting officer must not use a multiple award approach if one or more of six conditions apply. Accordingly, the JEDI Cloud contracting officer determined that

more favorable terms and conditions, including pricing, would be provided through a single award; the expected higher cost of administering multiple contracts "outweigh[ed] the expected benefits of making multiple awards" with a DOD-estimated additional cost of $500 million associated with administering multiple contracts; and multiple awards would not be in the best interests of DOD in this particular instance, as a multi-cloud environment could potentially "create seams between clouds that increase security risks â¦ frustrate DOD's attempts to consolidate and pool data â¦ [and could] exponentially increase the technical complexity require to realize the benefit of cloud technology."

Together with the JEDI Cloud RFP, the Department also released its determination pursuant to 10 U.S.C. 2304a(d)(3), which prohibits DOD from awarding large task or delivery order contracts to a single source unless a senior official determines if at least one of four exceptions to the prohibition is present, that the JEDI Cloud contract provides only for firm-fixed price task orders or delivery orders for services for which prices are established in the contract for the specified tasks to be performed. However, the JEDI Cloud contract will also contain pricing related clauses intended to allow the Department to benefit from future marketplace competition driving commercial sector cloud services pricing downward, and to provide DOD with access to new cloud services as they become available to the commercial market

the contract automatically lower DOD's prices when the contractor's public commercial prices are lowered. The lower unit price is fixed. â¦ [T]o achieve commercial parity over time, the contract contemplates adding new or improved cloud services to the contract. The new services clause requires â¦ approval for the addition of new services and includes mechanisms to ensure that the fixed unit price for the new service cannot be higher than the price that is publicly available in the commercial marketplace in the continental United States. This same clause requires that, if a service â¦ is eliminated from the Contractor's publicly available commercial catalog, the Contractor shall offer replacement service(s) â¦ at a price no higher than, the service being eliminated. As with any other cloud offering, once the new service is added to the catalog, the unit price is fixed and cannot be changed without contracting officer approval.

The U.S. Court of Federal Claims questioned DOD's use of the 10 U.S.C. 2304a(d)(3) exception for firm fixed-price task or delivery orders in its determination in tandem with the JEDI Cloud contract's price adjustment clauses, noting that "prices for new, additional services to be identified and priced in the future, even if they may be capped in some cases, are not, by definition, fixed or established at the time of contracting."

Legislative Action in the 115th Congress

Section 1064 of P.L. 115-232 , the John S. McCain National Defense Authorization Act (NDAA) for FY2019, required the DOD CIO to conduct activities supporting DOD's cloud adoption initiative:

developing an approach to rapidly acquire advanced network capabilities, including software-defined networking, on-demand bandwidth, and aggregated cloud access gateways, through commercial service providers; and conducting an analysis of existing systems and applications that would be migrated to the JEDI Cloud environment.

Section 1064 required the DOD CIO to submit a report on the current status and anticipated implementation of DOD's cloud adoption initiative, and limited the use of authorized FY2019 funds for DOD's cloud adoption until the required report's submission. The Department submitted the required report in January 2019.

Section 1064 further required DOD to complete an assessment to determine whether an information system or application is already, or can and would be cloud-hosted, prior to approving any new system or application for development or modernization. Finally, and pointedly, Section 1064 requires the Deputy Secretary of Defense to "ensure that the acquisition approach of the Department [for the JEDI Cloud procurement] continues to follow the [FAR] with respect to competition." In the conference report accompanying the FY2019 NDAA ( H.Rept. 115-874 ), the conferees

emphasize the importance of modernizing networks by adopting advancing [sic] commercial capabilities to achieve DOD's cloud transition and enterprise efficiency goals. â¦ The conferees encourage the Department to continue to ensure that cloud technologies are technically suitable, appropriately tested for security and reliability, and integrated with other DOD information technology efforts so as to optimize effective and efficient procurement of such technologies and services and their performance in support of DOD missions. Finally, the conferees note that although transparency and information sharing by the Department on the Cloud Initiative has slightly improved, it continues to be insufficient for conducting congressional oversight. The conferees expect the Department to improve communication with Congress on this issue and will consider additional legislation if an improvement is not seen.

Section 8137 of P.L. 115-245 , which provided FY2019 DOD appropriations, prevented the obligation or expenditure of FY2019 funds to "migrate data and applications to the proposed [JEDI] ... cloud computing services" until 90 days after the Secretary of Defense submitted (1) a plan to establish a DOD-wide budget accounting system for funds requested and expended for cloud services, as well as funds requested and expended to migrate to a cloud environment; and (2) a detailed description of DOD's strategy to implement enterprise-wide cloud computing to the congressional defense committees.

The Department submitted the required report in January 2019.

Proposed Legislative Action in the 116th Congress

The House Armed Services Committee report ( H.Rept. 116-120 ) accompanying the House-passed FY2020 NDAA ( H.R. 2500 ), includes the committee's commendation for DOD's cloud strategy

Cloud infrastructure, such as [JEDI], allows users to access information from anywhere at any time, effectively removing the need for the user to be in the same physical location as the hardware that stores the data. â¦ The ability of cloud infrastructure to scale ensures that the Department efficiently manages and modernizes its information technology needs and demands. The committee endorses the Department's strategy and concept for a flexible enterprise cloud architecture that enshrines the need and value for both general purpose and fit-for-purpose cloud solutions through a multi-cloud, multi-vendor approach.

Section 1035 of S. 1790 , the Senate-passed FY2020 NDAA, would specify that the DOD CIO and the DOD Chief Data Officer, in consultation with the J6 Command, Control, Communications, and Computers (C4) and Cyber Directorate of the Joint Staff and the DOD CMO, must develop and issue DOD-wide policy and implementing instructions regarding the transition of data and applications to the cloud. Such a policy would be required to "dramatically improve support to operational missions and management processes, including by the use of artificial intelligence and machine learning technologies."

In its "Items of Special Interest" for Title XVI ("Strategic Programs, Cyber, and Intelligence Matters"), the Senate Armed Services Committee report ( S.Rept. 116-48 ) for the FY2020 NDAA notes the committee's understanding for the "potential of commercial clouds to provide cost-effective, state-of-the-art capabilities," but highlights the committee's view that tDOD must be able to "conduct cybersecurity testing" for commercial cloud products and services, "including threat-realistic cyberattacks, to assess the cybersecurity of the Department's data and the cyber defense response to the attacks." The report directs the Secretary of Defense to provide a related briefing to the House and Senate Armed Services Committees, and recommends the inclusion of information regarding independent cyber assessments for commercially provided infrastructure in Director of Operational Test and Evaluation annual reports.

The House Appropriations Committee report ( H.Rept. 116-84 ) accompanying H.R. 2968 , the House-passed FY2020 Department of Defense appropriations act, highlights the committee's skepticism of DOD's pursuit of a "single vendor contract strategy" for the JEDI Cloud procurement

The Committee continues to be concerned with this approach given the rapid pace of innovation in the industry and that this approach may lock the [DOD] into a single provider for potentially as long as ten years. Since the [DOD] adopted its single vendor strategy in 2017, other federal agencies â¦ have decided to pursue a multiple vendor cloud strategy as recommended by the [OMB] "Cloud Smart" strategy â¦ the Committee believes the [DOD] is deviating from established OMB policy and industry best practices, and may be failing to implement a strategy that lowers costs and fully supports data innovation for the warfighter.

Accordingly, the House Appropriations Committee report would direct that no funds may be obligated or expended to migrate data and applications to the JEDI Cloud until the DOD CIO provides a report to the congressional defense committees expanding on the Department's plans to transition to a "multi-cloud, multi-vendor" environment. The DOD CIO would be directed to provide a listing of anticipated contracting opportunities for the acquisition of commercial cloud services by the Department over the next two years, to include specified elements such as planned contract type and structure; whether the procurement is anticipated to be conducted as a full and open competition or as a sole source award; the estimated timeframe for the release of related solicitations; and the estimated maximum contract value and period of performance, including option periods. The DOD CIO would also be directed to submit quarterly reports on the implementation of its cloud adoption and implementation strategy to the House and Senate Appropriations Committees, beginning 30 days after the enactment of a FY2020 defense appropriations act.

Various Members of Congress have also individually and collectively advocated for the Department to take certain actions relating to the JEDI Cloud procurement. For example, some Members have urged DOD to delay or postpone awarding the JEDI Cloud contract to accommodate an alternate acquisition strategy, or the conclusion of the DOD Inspector General's investigation into the potential violations of ethical standards by former DOD employees. Other Members have supported DOD's acquisition strategy, advocating for the Department to award the JEDI Cloud contract as soon as possible.

Significant attention has focused on DOD's intent to award the JEDI Cloud contract to a single company. Some observers contend that an initial single award appears to contradict broader federal cloud computing implementation guidance and industry best practices that stress the importance of multi-cloud solutions. Other experts point to the implementation approaches identified by DOD's Cloud Strategy as an indication that the Department expects the JEDI Cloud to serve certain enterprise-wide functions, performing as one component of a broader multi-cloud, multi-vendor system. Some observers, however, have concluded that the JEDI Cloud requirements are misaligned with DOD's Cloud Strategy, and have urged the Department to rescind and revise the JEDI Cloud RFP.

Those opposed to DOD's use of a single-award contract for the JEDI Cloud program have suggested that a single-award contract could potentially restrict future competition for enterprise-wide DOD IaaS and PaaS cloud services. Supporters of DOD's approach argue that the JEDI Cloud program's requirement for offerors to develop platform-agnostic applications and data schema suggests that the Department will be well equipped to migrate from any service environment developed under the JEDI Cloud contract to another such environment. Potential considerations for Congress concerning the ongoing JEDI Cloud acquisition process, as well as any follow-on efforts, include the following issues.

Oversight of Option Exercise for the JEDI Cloud Contract

As DOD has indicated that it believes the initial two-year base ordering period is sufficient time to validate the JEDI Cloud test model, Congress may consider directing DOD to provide detailed rationale and justification for any extension of the JEDI Cloud contract prior to the exercise of contract options. At the time of option exercise, Congress may also consider directing the Department to report on any notable lessons learned or challenges experienced in the execution of the JEDI Cloud contract. As emphasized in the conference report accompanying the FY2019 NDAA ( H.Rept. 115-874 ), Congress may also wish to monitor the extent to which the Department has "improved communication with Congress" to enable sufficient congressional oversight of the JEDI Cloud program and DOD's cloud adoption initiative.

The U.S. Court of Federal Claims decision agreed with the Department's finding that the actions of the individuals identified by Oracle America in its bid protest lawsuit did not negatively impact the procurement or grant Amazon Web Services an unfair competitive advantage. However, the individual violations of ethical standards for federal employees involved in the acquisition of goods and services for the U.S. governmentâwhich generated the appearance of unresolved conflicts of interestâidentified by DOD in the course of its investigations delayed the JEDI Cloud procurement process.

The FAR directs government procurement activities to be "conducted in a manner above reproach," and for government employees to strictly "avoid â¦ even the appearance of a conflict of interest." Congress may accordingly consider directing DOD to examine the current emphasis on ethical conduct and the Procurement Integrity Act in education, training, and qualification requirements for designated acquisition positionsâas well as considering the need to include equivalent training for DOD servicemembers and civilian employees outside of the defense acquisition workforce who may provide technical expertise or other support for procurement programsâand determine what, if any, changes should be made to associated curriculum and certification requirements.