Cloud Services Acquisition Strategies
Cloud acquisition requires a different approach from traditional hardware and datacenter procurement. Cloud services are dynamic, consumption-based, rapidly evolving, and often combine infrastructure, software, security, professional services, and ongoing managed operations.
A&T Systems helps government customers develop cloud acquisition strategies that preserve competition, support commercial innovation, provide financial control, address cybersecurity and compliance obligations, and allow cloud environments to evolve as mission requirements change.
Start with Mission & Performance Requirements
Cloud requirements should be based on the outcomes the agency needs rather than on a predetermined technology configuration. Acquisition planning should define workload, security, availability, performance, integration, operational, and financial requirements before selecting a provider or service model.
- Define mission and business outcomes
- Identify workload and application requirements
- Establish performance and availability objectives
- Document data, security, privacy, and compliance requirements
- Identify integration and connectivity requirements
- Define operational-support and service-management needs
- Establish lifecycle and transition requirements
Use Performance-Based Requirements Where Appropriate
Cloud technologies and commercial services evolve rapidly. Acquisition strategies should avoid unnecessarily prescribing specific technical implementations when functional or performance requirements can adequately describe the government’s need.
This approach can help preserve competition and allow contractors to propose current technologies and architectures while remaining accountable for required outcomes.
Preserve Competition & Avoid Unnecessary Vendor Lock-In
Requirements should generally remain provider-neutral unless a particular brand, product, or provider-specific capability is essential to the government’s requirement and the applicable acquisition documentation supports that restriction.
Agencies should evaluate portability, interoperability, data export, application dependencies, proprietary services, licensing, and transition requirements when selecting cloud technologies.
- Use performance and outcome requirements where practical
- Identify essential provider-specific requirements when they exist
- Evaluate data and application portability
- Address transition and exit requirements
- Consider long-term technical and financial dependencies
Structure for Consumption-Based Cloud Services
Cloud environments often use consumption-based pricing rather than fixed quantities of hardware or software. Acquisition strategies should provide agencies with flexibility to consume cloud services as needed while maintaining appropriate fiscal controls.
For eligible GSA MAS cloud acquisitions, special ordering procedures are available for consumption-based cloud services under SIN 518210C. These procedures may support requirements task orders, order ceilings, consumption monitoring, and incremental funding based on actual usage.
Financial Controls
- Task-order or contract ceilings
- Budget and usage thresholds
- Consumption reporting
- Resource tagging and cost allocation
- Forecasting and budget monitoring
- Optimization and cost reviews
Commercial Flexibility
- On-demand consumption
- Committed-use and reserved pricing
- Elastic resource scaling
- Managed and professional services
- Access to evolving cloud services
- Support for changing workload requirements
Evaluate Total Lifecycle Cost
Cloud pricing should not be evaluated solely by comparing individual compute or storage rates. Agencies should consider the total lifecycle cost of the solution, including architecture, licensing, migration, network usage, data transfer, storage, support, managed services, security, staffing, modernization, and transition.
- Cloud-service consumption
- Software and licensing costs
- Migration and modernization services
- Network and data-transfer charges
- Security and monitoring services
- Managed operations and technical support
- Backup, recovery, and resilience
- Exit and transition costs
Include Cloud Financial Management
Consumption-based cloud requires active financial governance throughout the contract period. Agencies should define how cloud usage will be monitored, allocated, forecast, approved, and optimized.
Cloud financial management, including FinOps practices where appropriate, can provide visibility into resource consumption and help technical, acquisition, and financial stakeholders make informed decisions about cost and mission value.
Address Shared Responsibility Clearly
Cloud contracts and statements of work should clearly identify responsibilities among the government customer, cloud service provider, systems integrator, managed-services provider, and other parties.
Responsibilities vary according to the cloud services selected. For example, customers operating virtual machines typically retain greater responsibility for operating systems and applications than customers using more highly managed platform or software services.
- Identity and access management
- Operating-system and application maintenance
- Data protection and encryption
- Security configuration
- Logging and monitoring
- Vulnerability management
- Incident response
- Backup and recovery
- Service-level management
Incorporate Security & Authorization Requirements Early
Security should be incorporated into acquisition planning rather than added after award. The solicitation should identify applicable security, privacy, data-handling, authorization, continuous-monitoring, and reporting requirements.
Federal requirements may include FedRAMP, NIST controls, agency authorization procedures, data-location restrictions, personnel-access requirements, incident-reporting obligations, and other mission-specific requirements.
Plan for Resilience & Continuity
Cloud acquisition should define availability, backup, recovery, continuity, and resilience objectives rather than assuming that use of cloud infrastructure automatically provides high availability.
- Availability objectives
- Recovery Time Objectives (RTOs)
- Recovery Point Objectives (RPOs)
- Backup and restoration requirements
- Geographic-resilience requirements
- Testing and recovery-validation requirements
Plan for Managed & Professional Services
Cloud acquisition frequently includes more than cloud consumption. Agencies may require assessment, architecture, migration, security, governance, modernization, FinOps, service management, monitoring, and ongoing managed operations.
These services should be clearly defined in the acquisition strategy, contract structure, Statement of Work, performance requirements, and evaluation criteria.
Support Technology Evolution
Cloud providers regularly introduce new services and retire or modify existing capabilities. Acquisition strategies should provide sufficient flexibility to take advantage of appropriate technology improvements without requiring unnecessary contract restructuring.
At the same time, new services should remain subject to applicable security, authorization, technical, financial, and governance requirements before production use.
Use Commercial Terms Carefully
Cloud services commonly include provider terms of service, license agreements, service descriptions, and other commercial terms. Government acquisition teams should review these terms to ensure they are consistent with federal law, agency requirements, security obligations, and the resulting contract.
Additional DoD Considerations
Department of Defense cloud acquisitions may be subject to additional DFARS, DoD Cloud Computing Security Requirements Guide, authorization, data-handling, and cybersecurity requirements.
DoD contracting officers should confirm that the cloud service offering meets the authorization level and other requirements applicable to the specific workload and information being processed.
A&T’s Cloud Acquisition Approach
A&T Systems supports government customers in connecting acquisition strategy with cloud architecture, cybersecurity, migration, governance, FinOps, service management, and managed operations.
Our objective is to help customers establish cloud acquisition vehicles that provide flexibility and access to innovation while maintaining accountability for security, performance, resilience, cost, and mission outcomes.
For related information, see Using GSA MAS to Procure Cloud Services, Using a GSA MAS BPA to Procure Cloud Services, and Cloud Computing & Datacenter Services.