The Pentagon says managing multiple commercial cloud providers would be too complex and slow down cloud migration in a new report justifying the Defense Department's plan to make a single award for the Joint Enterprise Defense Infrastructure program.
The Pentagon believes "under current acquisition law, if the department pursued multiple-award contracts for the JEDI cloud, each individual task order would be competed, thus being paced by DOD acquisition processes," according to the report to Congress.
"That pace could prevent DOD from rapidly delivering new capabilities and improved effectiveness to the warfighter that enterprise-level cloud computing can enable," the document continues. The report, which combines two reporting requirements in the fiscal year 2018 omnibus spending bill, was delivered to lawmakers last week. It was first reported by Bloomberg News.
DOD also argues the current commercial cloud marketplace doesn't deliver interoperability and security between different cloud offerings.
"If the commercial cloud marketplace offerings evolve to become interoperable and seamlessly integrated, DOD could have the ability to meet warfighting and business requirements by employing a range of future contract and award types," the report states. "However, based on the department's extensive internal and external research, the planned approach will support rapid adoption of the commercial cloud technology at enterprise-scale, and allow the ability to change approaches in the future if conditions allow."
The Pentagon's single-award approach has sparked backlash from industry and concern from lawmakers. Many speculate the award is tailored for Amazon Web Services, the largest commercial cloud provider.
DOD recently released a second JEDI draft request for proposals, and the department is expected to release the final RFP this month. The contract award is planned for September. The draft RFP states it will have a two-year base period, with options to extend it up to 10 years.
In the new report, DOD says the JEDI cloud solicitation will include mechanisms to avoid getting locked into one vendor. Since the contract will be indefinite delivery, indefinite quantity, the report states DOD is only obligated to satisfy the contract minimum, which involves the first task orders made alongside the contract award.
The two-year base period means the Pentagon will have time to "validate the operational capabilities" of the winning vendor, and "options periods under the JEDI cloud contract will only be exercised if doing so is the most advantageous method for fulfilling the DOD's requirements when considering the market conditions at the time of option exercise," the report states.
Additionally, DOD details "exit strategies" for moving applications from JEDI cloud to another environment. The report says DOD plans to make "extensive use of containerization" with the JEDI cloud.
"Containers improver portability and allow for streamlined distribution and deployment of applications across cloud environments," the report states. The JEDI cloud contractor will also be required to provide "a detailed portability plan" laying out how users can migrate from JEDI cloud to another environment.
But in justifying the single award, the report states "market research also indicated that initial migration to a single cloud is consistent with industry best practice," citing a 2017 report from advisory firm Gartner that found organizations should take a "crawl-before-you-walk, walk-before-you-run" approach to cloud migration.
DOD's adoption of cloud services has been mostly decentralized, the report argues, with more than 500 cloud initiatives existing across the department. It says this decentralization is "reminiscent of DOD's current legacy information technology environment, which is not optimized for the 21st century."
Throughout the report, DOD authors discuss the need for a "centralized data lake" to justify moving toward a single-cloud environment.
"Consolidating department data in a centralized data lake will significantly standardize the way DOD stores and tags data," it states. "This standardization will improve data security, accessibility, interoperability, portability and usability."
But the report states some other cloud initiatives, like milCloud 2.0 and the Defense Enterprise Office Solution, will be complementary to the JEDI commercial cloud. DEOS is expected to be a software-as-a-service system, while milCloud 2.0 is not considered a commercial solution because its computing resources are located on military installations. The report says DOD is determining what organizations will use milCloud 2.0.
First JEDI users
Once the JEDI contract is awarded later this year, DOD will use "proof-points validations" to begin migrating services and applications to the commercial cloud. Validation partners include the Navy, Marine Corps, U.S. Transportation Command and Defense Media Activity, according to the report.
"During these operational validation activities, the DOD will ensure JEDI cloud performs within the contracted standards and that we capture lessons learned and inform the activities of follow-on customers who move to the JEDI cloud," the report states. "Emphasis will be placed on understanding how to optimize the benefits of using cloud computing and storage infrastructure, particularly as it relates to data operationalization and advantaging the mission."
While the JEDI cloud is expected to be available at all classification levels and out to warfighters on the "tactical edge," the report explains establishing the more sensitive environment will take time. The JEDI solicitation allows a lead time of six months for getting validated for secret data and nine months for top-secret and above, according to the report.
Beyond the validations, DOD has begun to "reconcile, prioritize and migrate appropriate applications to the cloud," the document states. It says DOD's Reform Management Group is working on a list of applications for cloud migration, with preliminary efforts focusing on the "Fourth Estate" organizations at DOD.
Cloud spending
With JEDI expected to initiate an enterprise migration to the cloud, DOD's spending on such services is expected to ramp up over the five-year future years defense program. The report tallies DOD's FY-18 cloud request at $230 million and the FY-19 request at $393 million.
Across the FYDP, between FY-19 and FY-23, the Pentagon is expected to spend $1.6 billion on cloud services, according to the report. Just over $525 million of that total will be spent on "commercial cloud," while $1.1 billion is expected to go to "other cloud," the document lays out.
However, the report doesn't detail spending specific to the JEDI program. DOD Chief Management Officer Jay Gibson told reporters in March that it's fair to say the contract will be in the "multibillion"-dollar range.