GAO: NSA Erred in Technical Evaluations of $10 Billion Cloud Contract

The National Security Agency erred in its technical evaluation of Microsoft’s bid for a classified cloud contract worth up to $10 billion, according to a Government Accountability Office decision made public Monday.

The NSA awarded the contract, code-named “WildandStormy,” on July 7 to Amazon Web Services and Microsoft subsequently challenged the award on numerous grounds.

“Microsoft alleges the significant weakness assigned to its technical proposal regarding the security authorization process for new service offerings was unreasonable. Specifically, the protester contends that the agency’s evaluation was based on a flawed and unreasonable reading of the proposal,” GAO said in its decision. “Here, we agree with the protester and sustain on this basis.”

GAO sustained Microsoft’s protest on Oct. 29, but the decision was issued under protective order to allow for redaction of classified and proprietary information by all legal parties. Through the contract, NSA seeks to acquire software-, platform- and infrastructure-as-a-service cloud services through the full range of data classification levels, from unclassified to top secret. Four companies initially bid on the contract, according to the GAO decision, but only Amazon Web Services’ and Microsoft’s bids made it past the first NSA evaluation. NSA ultimately awarded Amazon Web Services the contract at a base cost of $482 million; Microsoft’s base cost was $422 million, according to the decision.  

However, the NSA erred in reviewing Microsoft’s proposal due in part to agency evaluators’ “unreasonable interpretation” for how the company proposed to onboard top secret commercial services and features. According to GAO, NSA evaluators “assumed” or “guessed” at Microsoft’s approach for onboarding such key features and improperly assigned “a significant weakness” to Microsoft’s proposal.

“We find the agency’s evaluation here to be both unreasonable and prejudicial to Microsoft,” GAO said, noting the evaluation was “based upon an unreasonable interpretation of Microsoft’s proposal.”

“We recommend that NSA reevaluate technical proposals, consistent with this decision, and based on that reevaluation, perform a best-value tradeoff and make a new source selection decision,” GAO said. “If, upon reevaluation, Microsoft is determined to offer the best value to the government, NSA should terminate AWS’s contract for the convenience of the government and make award to Microsoft.”

NSA did not respond to an immediate request for comment. In August, an NSA spokesperson told Nextgov, “NSA respects the oversight of the Government Accountability Office, and will work to ensure that these capabilities can be delivered to support the Agency's mission in a manner consistent with the GAO findings.”