Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

Recommendation 43: Revise acquisition regulations to enable more flexible and 

effective procurement of consumption-based solutions.

Problem

The FAR unrealistically categorizes all purchases as either supplies or services. This distinction, 

established decades ago, is too rigid to effectively procure modern technology solutions with evolving 

delivery models. Solutions include hardware, software, and labor/services that together provide a 

seamless capability. Acquisition professionals struggle to determine whether certain solutions should 

be procured as a supply or a service, often leading to contracts that are neither optimized nor 

appropriate for the solution being acquired.

The problem is more pronounced for solutions sold on a consumption basis, such as cloud services. 

Consumption pricing is common in the commercial IT market and for consumer technology such as 

mobile phones, for which customers are billed strictly for usage or billed a fixed amount plus overage

charges. This payment model is difficult to execute with existing FAR contract types and government 

fiscal rules. DoD needs laws, regulations, and policies that enable effective IT solution procurement 

today and remain flexible enough to adapt to dynamically evolving future solutions.

Cloud computing and IT solutions are the current acquisition challenges discussed in detail herein, but 

the specific recommendations to address these challenges are broadly applicable to other consumptionbased solutions in the marketplace.

Background

For decades, DoD and the federal government have acknowledged the need to reform and modernize 

the IT acquisition process, but large-scale reform has proven challenging. The FY 2010 NDAA required 

the Secretary of Defense to “develop and implement a new acquisition process for information 

technology systems...and Report to Congress...on the new acquisition process developed.”1 DoD

submitted the required report to Congress in November 2010, titled A New Approach for Delivering 

Information Technology Capabilities in the Department of Defense; however, many of the reforms described 

in the report were not fully implemented or not implemented at all. The failure to reform IT acquisition 

processes creates a compounding effect as technology continues to evolve rapidly and DoD struggles to 

acquire the technologies that power modern solutions. 

Cloud services have become the basic underpinning of most new IT systems, but the transition to cloud 

computing has been more of an evolution than a revolution. Beginning around 2006, back-end IT 

infrastructure became commoditized as a shared resource, and over time that model gravitated to the 

applications employed by end users.2 Cloud-based end-user applications are known as software as a 

service (SaaS), wherein the end user pays a fee to use the system and has no responsibility—or even 

knowledge of—the underlying IT that makes the system work. Other cloud offerings provide readymade IT infrastructure, essentially building blocks on which developers can quickly install or build 

 

1 Section 804(b) of FY 2010 NDAA, Pub. L. No. 111–84, 123 Stat. 2402 (2009). 2 “Business Report: Who Coined ‘Cloud Computing’,” Antonio Regalado, MIT Technology Review, October 31, 2011, accessed October 25, 

2018, https://www.technologyreview.com/s/425970/who-coined-cloud-computing/.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

their own applications. According to cloud procurement expert Michael Garland, “The advent of cloud 

computing has done for software developers what the medieval inn did for early European travelers—

it has relieved them of the obligation to pack and drag along all their own stuff.”3

The National Institute for Standards and Technology has published several foundational papers on 

cloud computing, including one that provides the following authoritative definition:4

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared 

pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that 

can be rapidly provisioned and released with minimal management effort or service provider interaction. 

This cloud model is composed of five essential characteristics, three service models, and four deployment 

models.

The government was slower to adopt cloud computing than commercial industry, but eventually 

produced a substantial body of policy and guidance, starting in February 2011 when then-U.S. Federal 

Chief Information Officer Vivek Kundra published the Federal Cloud Computing Strategy, commonly 

known as the Cloud First policy:5

This policy is intended to accelerate the pace at which the government will realize the value of cloud 

computing by requiring agencies to evaluate safe, secure cloud computing options before making any new 

investments.

In December 2011, Office of Management and Budget (OMB) expanded its Cloud First policy by 

releasing a memo addressing the security authorization process for cloud computing services. The

policy requires all federal agencies to use the Federal Risk and Authorization Management Program 

(FedRAMP) for cloud services procurement. According to its homepage, “FedRAMP facilitates the shift 

from insecure, tethered, tedious IT to secure, mobile, nimble, and quick IT.”6 FedRAMP identifies 

security requirements as a baseline for vetting cloud services and requires cloud service providers 

(CSPs) to comply with those requirements, including routing network traffic through a trusted internet 

connection. FedRAMP also provides a series of documents, templates, and training to be leveraged by 

agencies and CSPs. Key documents include the Security Assessment Framework (SAF), Security 

Controls (low, moderate, and high), and CSP Authorization Playbook.7

FedRAMP has made two major revisions to its Control Specific Contract Clauses, one in June 2014 and 

one in December 2017.8 FedRAMP provides a thorough security vetting process, but it does not include 

 

3 “It’s time to fix our cloud procurement problems,” Michael Garland, FCW, accessed October 25, 2018, 

https://fcw.com/articles/2018/06/04/comment-garland-clould-procurement.aspx. 4 National Institute of Standards and Technology, The NIST Definition of Cloud Computing, NIST SP 800-145, September 2011, accessed 

October 25, 2018, https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-145.pdf. Note: Definition truncated for brevity. 5 Vivek Kundra, Federal Cloud Computing Strategy, February 2011, accessed October 25, 2018, 

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/assets/egov_docs/vivek-kundra-federal-cloud-computing-strategy02142011.pdf. 6 FedRamp,” GSA, accessed October 25, 2018, https://www.fedramp.gov/. 7 FedRamp: Documents,” GSA, accessed October 25, 2018, https://www.fedramp.gov/documents/. 8 National Institute of Standards and Technology, Security and Privacy Controls for Federal Information Systems Organizations, NIST 

SP 800-53, Rev. 4, April 2013, accessed October 25, 2018, https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-53r4.pdf. 
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

a full set of contract terms and conditions. The program provides only provisional approval—agencies 

must make the final authorization determination and may have additional requirements beyond the 

FedRAMP baseline.

Currently, OMB is making the first major update to its Cloud First policy in more than 7 years.9 The 

new strategy, preliminarily coined Cloud Smart, is intended to address lessons learned from the past 

few years of government experience attempting to migrate to the cloud. Principally, Cloud Smart

means using a more deliberate and analytical process to determine what IT should migrate to cloud

services, rather than blindly assuming cost savings or other benefits will be realized by migrating 

everything.

Other guidance and resources have been published in support of the Cloud First policy, including the 

following:

§ Best Practices for Acquiring IT as a Service, Chief Information Officer (CIO) Council and Chief 

Acquisition Officers Council, 2012.

§ Best Business Practices for USG Cloud Adoption, General Services Administration (GSA)

Federal Acquisition Service, 2016.

§ Cloud Computing Security Requirements Guide, Defense Information Systems Agency, 2017.

10

§ Cloud Acquisition Professional’s Cloud Adoption Survival Tips, Lessons, and Experiences 

(CASTLE) Guide, Interagency Cloud Center of Excellence (CCoE), 2017.

11

DoD addressed cloud services acquisition in Enclosure 7 of DoDI 5000.74, Defense Acquisition of 

Services, although little information is provided other than compliance directives:

12

PMs [program managers} or FSMs [functional services managers] must implement any cloud computing 

services in accordance with DISA-provided Cloud Computing Security Requirements Guide (SRG). 

Prior to contract award, all commercially provided cloud services must have a DoD Provisional 

Authorization granted by DISA. Prior to operational use, all cloud services must have an Authority to 

Operate granted by the PM/FSM’s Authorizing Official.

Commercial cloud services hosting controlled unclassified information or non-publicly releasable 

information outside of the Department’s security boundary must be connected to the Department of 

Defense Information Network (DODIN) through a Cloud Access Point that has been approved by the 

Information Security Risk Management Committee and the DoD CIO, in accordance with connection 

approvals in the Chairman of the Joint Chiefs of Staff Instruction 6211.02D (Reference (ah)).

 

9 “OMB Drafts ‘Cloud Smart’ Strategy,” Sara Friedman, CGN, June 13, 2018, accessed October 25, 2018, 

https://gcn.com/articles/2018/06/13/cloud-smart-strategy.aspx. 10 “Cloud Computer Security Requirements Guide (CC SRG),” Information Assurance Support Environment (IASE), accessed October 25, 

2018, https://iase.disa.mil/cloud_security/Pages/index.aspx. 11 “Here’s a Cloud Guide Written by Feds for Feds. Will the White House Listen,” Frank Konkel, Nextgov, August 24, 2017, accessed 

October 25, 2018, https://www.nextgov.com/it-modernization/2017/08/heres-cloud-guide-written-feds-feds-will-white-houselisten/140478/. 12 Defense Acquisition of Services, DoDI 5000.74 (2017).
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

Despite all the cloud policy and guidance, acquisition professionals are still constrained by laws and 

regulations conceived before cloud services existed. These laws and regulations are out of step with 

current delivery models offered by commercial industry—DoD is not buying what companies are 

selling. An early and prominent example of the government buying cloud services demonstrates that 

although the technology innovation is present, the associated contracting processes can reduce the 

velocity of access to these services, and as a result reduce the value derived.13

Case Study:

Commercial Cloud Services Contract

In 2013, the Central Intelligence Agency awarded a contract to Amazon Web Services (AWS) known as 

Commercial Cloud Services (C2S). With a 10-year period of performance and a potential value of $600 million, 

this purchase was the largest cloud services contract awarded by the federal government at the time. C2S was 

considered a groundbreaking initiative to serve all 17 agencies that make up the intelligence community (IC) 

with a private cloud at the Top Secret level built on government property. The contractor, AWS, owns and 

maintains the computer hardware and manages cloud services operations.

C2S includes essential technical cloud characteristics like instantaneous scalability that were once thought 

impossible in government. This approach enables capabilities like provisioning a server in minutes instead of 

months, providing obvious operational benefits. The C2S private cloud also includes a marketplace that allows 

the IC to access commercial innovation through new applications and services added by AWS.

Although the technology capabilities of C2S are state-of-the-art, the contracting and business processes that 

govern these capabilities are an inhibitor to speed and agility. C2S has the ability to provision a server in 

minutes; however, the process for getting authorization to turn on that server can take months. This process 

may include developing and awarding a technical task order, securing funding, and navigating layers of 

approvals. To take full advantage of consumption-based solutions like C2S, the government needs to update 

its contracting and business processes to be as agile and flexible as the technology itself. Until those changes 

to the acquisition process are made, realizing the full potential of this new generation of technology solutions

will remain a challenge.

Some have expressed concern that if cloud services are used by the government in the same manner as 

the commercial sector that an overzealous user could rapidly consume a disproportionate share of 

resources or even exceed an entire contract’s available funding in a matter of hours or days. Although

this risk does exist, it is extremely unlikely to be realized given the management and monitoring tools 

inherent in modern cloud solutions. AWS, for example, includes a suite of tools for customers to 

manage services with features like service limits by user account, usage and cost reports with 

forecasting, and configurable alerts. Tools like these will allow the government to take advantage of the 

 

13 Analytic Technology Industry Roundtable, interview with Section 809 Panel, September 18, 2018.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

rapid scalability of modern cloud services while minimizing the risk of unauthorized or unexpected 

overuse. 

Recent IT acquisition legislation has not directly addressed effective IT solutions procurement. The 

Federal Information Technology Acquisition Reform Act (FITARA) strengthens CIO authority, adds 

more oversight and reporting requirements to IT acquisition, and mandates data center consolidation, 

but it does not provide any new authorities or tools to improve cloud procurement to support these 

goals.14

Today the government has challenges with cloud procurement, but the market is constantly evolving. 

More things will be sold as a service in the future. XaaS could really mean everything in the context of 

the Internet of things (IoT). Consumption-based solutions are appearing in many industry sectors, from 

last mile transportation (e.g., bike shares and electric scooters) to agriculture (e.g., tractor-as-a-service 

for farmers in developing countries).15 Most smart phone users are familiar with software updates that 

provide bug fixes or new features. A more extreme example of technology innovation enabled by the 

IoT is the ability to deliver physical performance improvements to vehicles through over-the-air 

software updates. In May of 2018 Tesla Motors substantially reduced the braking distance of its 

Model 3 sedan through a software update.16 In the not-so-distant future, cloud computing and the IoT 

will enable consumption-based solution offerings and delivery models that are hard to imagine today.

Discussion

The following sections discuss some of the specific challenges faced by acquisition professionals when 

attempting to effectively acquire modern IT solutions using the existing statutory and regulatory 

framework. 

Supply or Service?

The fundamental decision as to whether a solution is procured as a supply or service has significant 

implications and frequently causes consternation for contracting officers. A common example is 

software licenses. Years ago, software was delivered on physical media like a compact disc (CD) and 

was sold for a fixed price per copy. Paying for the software up front, as a supply, made sense. 

Sometimes an upgrade CD was available a year or two later at a price less than the original license—

still a supply. As physical media became less common, and software delivery moved to subscription 

models, including the more dynamic SaaS, that supply or service decision has become much more 

complicated. Some contracting professionals still prefer to buy software as a supply, if for no other 

reason than the acquisition rules are much simpler. Others argue that SaaS should be procured as a 

 

14 Sections 831–837 of FY 2015 NDAA, Pub. L. No. 113-291 (2014). 15 “Meet A Tractor That Can Plow Fields And Talk To The Cloud,” Joy Diaz, NPR, March 29, 2016, accessed September 24, 2018, 

https://www.npr.org/sections/goatsandsoda/2016/03/29/472129577/meet-a-tractor-that-can-plow-fields-and-talk-to-the-cloud. 16 In May 2018 Consumer Reports evaluated, but did not recommend, the Tesla Model 3 due to long braking distances. Less than two

weeks later Tesla pushed out an over-the-air software update that tweaked the calibration of the Model 3’s antilock braking algorithm. 

The software update cut the vehicle’s 60 mph stopping distance by 19 feet, which ultimately earned it Consumer Report’s 

recommendation. “TESLA’S Quick Fix for Its Braking System Came from the Ether,” WIRED, May 30, 2018, accessed October 25, 2018, 

https://www.wired.com/story/tesla-model3-braking-software-update-consumer-reports/
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

service. After all, it is called software as a service, and the government is not getting a tangible product, 

but rather use of a system developed and maintained by a vendor. 

Contracts for services are governed by more complicated rules and procedures in FAR Part 37 and 

DoDI 5000.74. In addition to the extra rules associated with service contracting, these contracts 

frequently enter contentious territory on issues such as personal services, evaluation and selection 

methods, contract-type decisions, and payment arrangements. In some cases, SaaS vendors require

upfront payment for license subscriptions.

17 The popular SaaS vendor Salesforce runs a true cloud 

multitenant solution but uses a traditional pay-up-front annual user-based licensing model. Other 

vendors offer true consumption-based services with payment in arrears. Contracting officers need 

guidance on which analysis to impose, regardless of how vendors label their offerings.

In today’s environment, consumption-based services are often purchased as other direct costs (ODCs) 

incidental to a services contract. This is the approach used by the Air Force’s Common Computing 

Environment (CCE) program that is migrating thousands of applications to the cloud.18 Using ODCs is 

a symptom of current procurement constraints rather than a desirable or innovative strategy. 

Current Guidance

FedRAMP established and maintains a sophisticated set of rules and resources to assist agencies with 

cloud procurement, but the program focuses almost exclusively on security.19 It does not address the 

lack of contracting guidance, rules, and tools for acquiring cloud services. Although FedRAMP has an 

important role to play, security alone does not make a good cloud contract. The government needs to 

be a smart buyer of cloud and other consumption-based services, and it simply does not have all the 

right tools.

In some cases, current cloud acquisition guidance recommends questionable applications of existing 

contract types. For example, GSA’s Best Business Practices for USG Cloud Adoption recommends use of 

the contract type fixed price with economic price adjustment. But economic price adjustment is meant to 

address changes to established prices or underlying cost structure, not variation in consumption of the 

service. This attempt to use existing approaches to solve evolving problems is a stark illustration that 

the tools currently available in the FAR do not effectively address consumption-based services. 

There are, however, examples of innovative contract types implemented for specific purposes. The 

Defense Logistics Agency uses energy savings performance contracts (ESPCs), a contract type through 

which an energy services contractor designs, finances, acquires, installs, and maintains energy-saving 

equipment and systems for a federal agency. ESPCs allow federal agencies to procure energy savings 

and facility improvements with no upfront capital costs or special appropriations from Congress. 20

 

17 While software subscriptions are commonplace in 2018, references to the word “subscription” in FAR Part 13 refers to “...newspapers, 

magazines, periodicals, or other publications...” and in FAR Part 31 “Subscriptions to trade, business, professional, or other technical 

periodicals.” 18 USAF CCE representatives, interview with Section 809 Panel, August–September 2018. 19 “Documents,” FedRAMP, accessed October 25, 2018, https://www.fedramp.gov/documents/. 20 DoD Inspector General, Defense Logistics Agency Award and Administration of Energy Savings Performance Contracts, Report No. 

DODIG-2018-135, July 6, 2018, accessed October 25, 2018, https://media.defense.gov/2018/Jul/10/2001940709/-1/-1/1/DODIG-2018-

135.PDF. 
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

DoD needs a similarly innovative contract type to address the unique aspects of cloud services and 

other consumption-based solutions, with flexibility for procuring future solutions that may have 

different characteristics. 

Another challenge with current FAR contracting rules is scope. The scope of services is established at 

the time a contract or order is competed and awarded. Any new scope not explicitly included in the 

contract must be part of a new competition. For cloud services, vendors’ service offerings can change 

daily, and these scope rules put the government in a difficult position.21 Contracts can take months or 

even years to award with defined scope. If the vendor then comes out with a desirable new service, 

current laws and regulations require the agency to start over and compete the new service. Such 

competition is undesirable because groups of services are best provided by a single vendor. Using 

multiple providers could create problems with integration, coordination, and compatibility. Exceptions

are allowed under current rules, but DoD’s acquisition of new, commercial IT solutions should not be 

defined by exceptions that involve multiple approvals.

Fiscal Issues

Funding is one of the key challenges to implementing consumption-based services, as GAO identified 

within a year of OMB’s Cloud First strategy:

22

Procuring services on a consumption (on-demand) basis: Because of the on-demand, scalable nature of 

cloud services, it can be difficult to define specific quantities and costs. These uncertainties make 

contracting and budgeting difficult due to the fluctuating costs associated with scalable and incremental 

cloud service procurements. For example, HHS officials explained that it is difficult to budget for a service 

that could consume several months of budget in a few days of heavy use.

Budgeting rules and appropriation law have created IT acquisition challenges in DoD for almost as 

long as the term IT has existed. Numerous studies and reports argue that DoD needs more fiscal 

flexibility to effectively acquire high quality IT.23 Colorless money (a theoretical general purpose 

appropriation without periodicity constraints) and working capital funds (an alternative to annual 

appropriations) are usually the preferred remedy, although only the latter has received any traction.24

When it comes to consumption-based solutions, the fiscal limitations are especially challenging. Not 

knowing in advance how much of a service will be used means the amount obligated on a contract is at 

best an estimate based on a set of assumptions, and at worst simply a guess. The ramifications can be 

 

21 The constantly evolving service offerings of cloud providers are part of their value proposition. In 2017 alone, AWS added several 

hundred new services that became instantly available to their customers. 

22 GAO, Information Technology Reform: Progress Made but Future Cloud Computing Efforts Should be Better Planned, GAO-12-756, July 

2012, accessed October 25, 2018, https://www.gao.gov/assets/600/592249.pdf. 23 See Section 809 Panel, Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations, Volume 1 of 3 (2018). Also 

see Su Chang and Pete Modigliani, “Addressing the Barriers to Agile Development in DoD,” MITRE Corporation, May 2015 (page 18 

includes discussion of the need for software programs to sometimes respond “rapidly to changes in ops, technology, and budgets”), 

accessed September 24, 2018, http://www.dtic.mil/dtic/tr/fulltext/u2/a625456.pdf. 24 DoD working capital funds (WCFs) are defined under 10 U.S.C. § 2208(a) as budget tools intended to “control and account more 

effectively for the cost of programs and work performed in the Department of Defense.” Rather than annual appropriations, WCFs rely on 

a model akin to a commercial company, effectively selling their goods and services to customers (other parts of DoD). Unlike a 

commercial company, a WCF is not intended to make a profit, but rather achieve zero net income in the long term. “Hurd dishes on 

MGT’s future,” Chase Gunter, FCW, December 20, 2017, accessed October 25, 2018, https://fcw.com/articles/2017/12/20/hurd-mgtfuture-gunter.aspx.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

substantial. If the estimate is high, funding must be de-obligated, putting the next year’s budgets at risk 

in the government’s use it or lose it culture. If the estimate is too low, the contracting officer risks an 

Anti-deficiency Act violation, punishable by suspension without pay, removal from office, fines, and 

even imprisonment.

25 The department should not ask its acquisition workforce to gamble on these 

kinds of stakes. The CASTLE Guide summarized this conundrum: “The current mechanisms of Federal 

funds systems works directly against the intended business advantages of cloud computing.”26

DoD and other agencies need a funding system that works for consumption-based solutions without 

the stress and contortions present in the current system. In consumer technology and commercial 

industry, these solutions are billed and paid for in arrears based on actual usage. That exact model may 

not be feasible, but the government needs to find something closer than it has today. The carryover 

authority provided by Congress to the Defense Health Agency (DHA) for drug and medical services 

indefinite-quantity contracts is a model worth considering. DHA has this authority because precise 

obligations for these services cannot be predicted due to varying patient and facility needs.27

Not All Government IT is Suitable for the Cloud

With all the policy, leadership attention, and press around getting to the cloud, a one-size-fits-all attitude

that everything should be moved to the cloud has taken shape. Unfortunately, this is much like what 

happens during household moves. Only about a quarter of the contents of the boxes in the basement 

should be moved. Half of the remaining items are probably trash, and the other quarter could be 

donated for use by someone else. But that is not what happens. In the absence of time to purge

thoughtfully, everything is moved. The government is doing this with cloud migration—moving the 

junk into the shiny new house. There will be no cost savings, and there may even be cost increases. 

Because the cloud services provider does not use the outdated servers those applications run on, that 

will cost extra. This situation is an example of the technical debt so often discussed at conferences and in 

press articles.28

The lift and shift attitude is reinforced by FITARA, which not only measures data center consolidation 

progress but gives agencies a report card complete with a letter grade. Very few agencies receive an A. 

Though well intended, this mandate could actually be causing agencies to migrate decades-old legacy 

systems that have no business being used today, much less being migrated to the cloud. OMB’s new 

Cloud Smart policy aims to address this issue. There is no one-size-fits-all approach to cloud migration. 

In some cases, it may make more sense to shut down an application or subsume it than to migrate. 

Agencies need to establish a process and a model to analyze their applications and determine the most 

appropriate disposition, a process commonly known as application rationalization. Much like the 

 

25 “Antideficiency Act Resources,” GAO: Bid Protests, Appropriations Law & Other Legal Work, accessed October 25, 2018, 

https://www.gao.gov/legal/appropriations-law-decisions/resources. 26 Cloud Center of Excellence (CCOE), Acquisition Professional’s C.A.S.T.L.E. Guide: Cloud Adoption Survival, Tips, Lessons Learned, and 

Experiences Guide, 3, accessed October 25, 2018, https://www.nextgov.com/media/gbc/docs/pdfs_edit/castle_guide.docx. 27 In recent years’ defense appropriations, Congress has approved a small, 1-year, carryover authority for O&M spending by the Defense 

Health Program (DHP).

28 “Huge bill coming due for out-of-date technology,” Jason Miller, Federal News Network, May 25, 2015, accessed October 25, 2018, 

https://federalnewsradio.com/omb/2016/05/huge-bill-coming-due-date-technology/. “Deutsche Bank digging out of technical debt, 

while moving to the cloud,” Clint Boulton, CIO, November 11, 2015, accessed October 25, 2018, 

https://www.cio.com/article/3004538/cio-role/deutsche-bank-digging-out-of-technical-debt-while-moving-to-cloud.html.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

important business process reengineering (BPR) step in systems modernization projects, application 

rationalization is often abbreviated or skipped altogether in cloud migration efforts.

A true consumption model allows customers to know what IT they have acquired and what they are 

actually using. The government lacks accurate accounting of its IT, partly due to an acquisition process 

incentivized more to estimate future usage than measure actual consumption by end users.

29 In the 

current model, unused software licenses sit on the shelf, either physically or virtually, wasting millions 

of dollars. The consumption model, by contrast, provides the capability to quickly turn off resources 

that are not being used. Events like usage spikes can be identified and corrected quickly as opposed to 

the traditional software licensing model for which these issues are not discovered until months or years 

later when a multimillion dollar bill comes due after a license audit.

Innovation and Skills Shift: Tomorrow’s IT Will Not Look Like Today’s IT

DoD tends to over-specify requirements, often basing them on capabilities from the past instead of 

imagining the future. This approach hinders DoD’s ability to exploit commercial innovation and results

in customized solutions that sacrifice one of the key value propositions of cloud services—economies of 

scale leveraging a common solution across multiple customers. The fact that there is a separate 

Government Cloud makes clear the government is not fully leveraging commercial solutions, albeit 

security requirements are a large driver of this segregated cloud.

30 Further complicating matters, DoD 

often prioritizes low price over value delivered. This practice is understandable, because price is purely 

quantitative, therefore easy to compare. But tapping into commercial innovation requires a deep 

understanding of what services are available and how they can be applied to solve a mission or 

business problem. This type of analysis relies on a specific skill set that is in short supply within the 

DoD acquisition workforce. 

IT, as it was understood in the past, has quickly become an invisible commodity. As cloud services and 

modern IT solutions become the rule instead of the exception, the skills needed to leverage these 

solutions will change dramatically. There will no longer be a need for droves of contractors at data 

centers monitoring server and storage status or installing patches. Those duties will be fulfilled in the 

background by the cloud services provider. Instead, the needed skills will be in designing, refining, 

and optimizing business processes to better support the mission. For example, future IT professionals 

will need the ability to quickly understand a new, instantly available machine learning capability and 

how it can be used to increase lethality or fine tune inventory levels. Those are not the skills of a 

traditional IT workforce.

Organizations like the Defense Digital Service are helping programs better understand how to acquire 

and leverage modern digital services, but this effort happens in pockets of excellence and needs to be 

institutionalized.31

 

29 OMB Memorandum M-16-12, Category Management Policy 16-1: Improving the Acquisition and Management of Common Information 

Technology: Software Licensing, June 2, 2016, accessed October 25, 2018, 

https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2016/m-16-12_1.pdf. 30 “You don’t have to build your tech from the ground up,” CLOUD.GOV, accessed October 25, 2018, https://cloud.gov/. 31 “News & Events: DOD CIO, DISA assist ‘fourth estate’ with cloud migrations,” Defense Information Systems Agency, accessed 

September 24, 2018, https://www.disa.mil/NewsandEvents/2018/fourth-estate-cloud-migrations.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

If DoD addresses change using an ideal approach, a knowledge-based workforce will rapidly innovate 

using an ever-changing set of solution offerings from numerous innovative vendors. One of the ways 

this goal can be accomplished is by establishing a center of excellence (CoE) to transform the way the 

organization develops applications and exploit the constant innovation in the cloud. GSA established 

one such Cloud Adoption COE to assist the Department of Agriculture (USDA) with developing the 

foundation of a Commercial Cloud Platform Services organization to be the “pathway to cloud 

services” for the agency. GSA cites early successes of the effort as planning for migration to the cloud

by “balancing tactical ‘lift and shift’ imperatives with more strategic ‘fix and shift’ possibilities.”32

Acquiring Modern Solutions

Although the government has many challenges in procuring and properly employing cloud services to 

realize value, these consumption-based services are merely the proverbial canary in the coal mine. With 

enablers like quantum computing and machine learning, technology innovation will inevitably 

continue at an increasing rate, and DoD must be ready to effectively acquire the resultant solutions or 

risk being outmatched by near-peer adversaries that do not struggle with archaic acquisition 

constraints.

33

DoD must improve cloud acquisition, yet these types of technology infrastructure are rarely bought on 

a stand-alone basis. Most modern solutions are hybrids that combine cloud or other hardware and 

software components with high-skill professional services. These skills may be required to refactor and

migrate a legacy application, or to solve a warfighting or business problem using technology 

innovations and design services. The implications of these hybrid solutions are two-fold: acquisition 

rules must effectively accommodate a novel and evolving type of procurement, and acquisition 

professionals must deeply understand the solutions market and capabilities to be a smart buyer.

As shown in Figure 3-1 below, DoD already spends nearly $10 billion annually on services that could 

potentially be purchased on a consumption basis, so the need to improve the buying process is long 

overdue.34 Additionally, increased year-over-year spending on cloud and related services is a given. 

According to a recent survey, 82 percent of public-sector cloud adopters were anticipated to increase 

spending on cloud computing.

35

 

32 “Cloud Adoption,” GSA, IT Modernization Centers of Excellence, accessed October 25, 2018, https://coe.gsa.gov/coe/cloudadoption.html. 33 “What is quantum computing? A machine learning supercharger businesses can’t ignore,” Clint Boulton, CIO, February 7, 2018, 

accessed September 24, 2018, https://www.cio.com/article/3253886/emerging-technology/what-is-quantum-computing-a-machinelearning-supercharger-businesses-cant-ignore.html. 34 Data from Federal Procurement Data System, extracted September 25, 2018. Calculations are based on Product Service Codes (PSC)s. 

Some of the transactions included in the totals may be inappropriate for consumption-based pricing models; this list represents a rough 

estimate of transactions that might be suitable. In addition to these categories, the PSC structure contains many other types of IT services 

that would likely be unsuitable for consumption-based pricing (such as data entry, programming, and help desk support). 35 “Is on-premises being killed by the cloud? Not necessarily,” Eric Houvenaghel, GCN, May 17, 2017, accessed October 25, 2018, 

https://gcn.com/articles/2017/05/17/on-premises-vs-cloud.aspx.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

Figure 3-1. FY 2017 DoD Contract Obligations that Could Potentially Be Priced 

Using Consumption-Based Models

Conclusions

The government will be unable to effectively acquire modern consumption-based solutions until it 

implements a new set of procurement rules that address the unique attributes of these solutions and 

provide flexibility to effectively buy future solutions that do not fit into existing categories.

Additionally, acquisition professionals must receive appropriate training and conduct ongoing market 

research to be effective buyers of these solutions. The challenges with the current system and some of 

the ways these challenges can be addressed are summarized as follows:

§ The current supplies and services model should be updated to provide more flexible purchasing 

categories that address current and anticipated delivery models, including consumption-based 

solutions. Traditional services acquisition rules should not apply to consumption-based 

solutions or to any hybrid contract whose primary purpose is to implement solutions 

(i.e., a contract that includes a combination of consumption-based services, SaaS, infrastructure 

as a service, platform as a service, and/or professional services). 

§ The government needs a new contract type to accommodate the uniqueness of consumptionbased solutions. Conventional acquisition policy assumes locking in a firm fixed price is low 

risk for the government, when in fact for consumption-based solutions it can result in paying 
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

for services not delivered or paying more than the current market rate due to declining prices. 

Additionally, the requirement to fully fund (obligate funds) upfront for firm-fixed-price

contracts is not well suited for services whose ultimate price will be determined by usage and 

therefore not be known in advance. The optimal contract type for consumption-based solutions 

will function more like a time-and-material than a firm-fixed-price contract, and will 

automatically capture price reductions in contractors’ commercial pricing. It is also essential 

that this new contract type be permitted for use on contracts for commercial items (i.e., FAR 

Part 12) as most consumption-based solutions are commercial offerings. 

§ Explicit authority should allow for consumption of newly released services not available at the 

time of initial contract award. Recent work-arounds to address this challenge include a contractspecific clause in the JEDI RFP and GSA’s order-level materials rule that permits up to 

33.33 percent of the value of an order to be used for supplies or services not known at the time 

of award.

36

§ Congress should provide funding flexibility, so acquisition professionals can confidently 

procure consumption-based solutions without fear of running afoul of the Anti-deficiency Act 

or Impoundment Act. This type of funding flexibility would improve acquisition beyond just 

IT.

§ DoD should develop and provide ongoing training, including a specialized certification, to 

acquisition professionals purchasing IT solutions. This training should be refreshed at least 

annually to keep pace with new technologies, solution offerings, and delivery models. Training 

could be modeled after the Digital IT Acquisition Program (DITAP), which is part of the Federal 

Acquisition Certification in Contracting Core-Plus Specialization in Digital Services 

(FAC-C-DS).

37

Implementation

Legislative Branch

§ Revise appropriation law and budgeting rules to address the unique aspects of buying 

consumption-based solutions. Recommendation 49 provides the flexibility necessary for these 

changes. 

Executive Branch

§ Create a new subcategory of services called consumption-based solutions in FAR Part 37, Service 

Contracting, and add a reference (pointer) in FAR Part 39, Acquisition of Information 

 

36 Special Ordering Procedures for the Acquisition of Order-Level Materials, 48 CFR 552.238-82(d)(4). See also, “General Services 

Administration Acquisition Regulation (GSAR); Federal Supply Schedule, Order-Level Materials; Technical Amendment,” NARA Federal 

Register, accessed October 30, 2018, https://www.federalregister.gov/documents/2018/08/16/2018-17639/general-servicesadministration-acquisition-regulation-gsar-federal-supply-schedule-order-level. 37 OMB OFPP Memorandum, Establishment of Federal Acquisition Certification in Contracting Core-Plus Specialization in Digital Services 

(FAC-C-DS), May 18, 2018, accessed October 25, 2018, https://www.whitehouse.gov/wpcontent/uploads/2018/05/fac_c_digital_services_05_12_18.pdf.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

Technology.

38 Agency-specific regulations, policies, and guidance regarding service contracting 

are not applicable to contracts for consumption-based solutions or hybrid contracts when the 

primary purpose is to procure consumption-based solutions.

- The following is the definition of consumption-based solutions: Any combination of 

hardware/equipment, software, and labor/services that together provide a seamless 

capability that is metered and billed based on actual usage and predetermined pricing per 

resource unit, and includes the ability to rapidly scale capacity up or down.

- Consumption-based solutions must be measurable/meterable on a frequent interval 

customary for the type of solution (e.g., hourly, daily, weekly). The contractor is required to 

notify the government when consumption reaches 75 percent and 90 percent of the contract 

funded amount. 

- New services or features can be added to contracts for consumption-based solutions at the 

discretion of the contracting officer without conducting a new competition, provided the 

amount of these new services or features does not exceed 25 percent of the total contract 

value.

§ Update the Product Service Code (PSC) data architecture to accommodate consumption-based 

solutions as a new data type.

§ Add a new contract type called fixed-price resource units to FAR Subpart 16.2. The fixed-price 

resource units contract type: 

- Establishes a fixed price per unit of measure (e.g., one hour of computing resource as shown 

in Table 3-1 below). 

- Sets a ceiling for the overall contract value against which consumption of individual 

resource line items will be charged. 

- Is the preferred contract type for consumption-based solutions, and when used for those 

procurements should not require special approvals. 

- Can be incrementally funded.

- Sets a maximum unit price for each resource unit and captures price reductions when 

commercial catalog prices are reduced.

- Is permitted for use under commercial item/service acquisition in FAR Part 12: Acquisition 

of Commercial Items. 

Table 3-1. Resource Unit Examples

Resource Unit Unit of Measure Quantity Unit 

Price

Extended 

Amount

Compute (virtualized server) Hours EXAMPLE

Aerial Drone Surveillance Minutes EXAMPLE

 

38 The term consumption-based solutions was chosen in favor of consumption-based services because lessons learned from utility services 

contracting indicated that including the word “services” would cause confusion and result in attempts to improperly apply all Service 

Contracting (i.e., FAR Part 37) rules to the new purchasing category. 
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 3 of 3 | January 2019

IT Procurement Volume 3

Resource Unit Unit of Measure Quantity Unit 

Price

Extended 

Amount

Travel Booking Trips EXAMPLE

§ Develop IT solutions training and a corresponding certification/designation for DoD acquisition 

professionals based on the existing DITAP, which is part of the FAC-C Core-Plus specialization 

in digital services. 

- Refresh training content and individual certifications at least annually. 

- Include instruction on how to conduct cost/price analysis for consumption-based solutions.

- This training curriculum is for commercial IT solutions and does not apply to weapon 

systems acquisition.

Implications for Other Agencies

§ Recommendations are for governmentwide changes that would benefit both DoD and federal 

civilian agencies.

§