By GAO reported in June 2026 that 15 of 24 CFO Act agencies said outdated FAR provisions impeded cloud procurements. The FAR still has no cloud definition, and GAO put the fix to Congress, so bidders have to write the definition into their own offers.
In June 2026, GAO published Cloud Computing: Federal Government Needs to Address Procurement Challenges (opens in a new tab) (GAO-26-107530). Senior officials in the CIO and Senior Procurement Executive offices at 15 of the 24 CFO Act agencies told GAO that outdated Federal Acquisition Regulation provisions impeded their cloud procurements.
GAO named three gaps. The FAR still has no definition of cloud computing, its definition of information technology is about 20 years old, and its definition of a commercial product or service does not align with cloud computing.
GAO called updating the FAR "essential to effectively contracting for cloud services."
This finding did not go to an agency. GAO put two matters to Congress: update the statutory definitions of commercial products and services and have acquisition regulations reflect them, and require regulations to define information technology consistent with FITARA and cloud computing consistent with the definition from the National Institute of Standards and Technology (NIST).
No single agency can close this. The FAR Council writes the FAR, and the commercial definitions trace back to statute, which is why GAO's matters sit with Congress.
Agencies have worked around the gap one policy at a time. Officials at five agencies said the missing cloud definition created extra drafting work, and eleven agency acquisition policies and contract clause documents borrowed NIST's definition. Of the 15 agencies, five said the FAR's definition of information technology did not match OMB's under FITARA.
The commercial definitions drew the most complaints. DHS told GAO that classifying cloud as a service was difficult because cloud runs on consumption, like a utility. Interior said software licensing fit poorly within the FAR's definitions. Twelve of the 15 agencies said the FAR needs a definition for consumption-based services.
Attempts to fix it have stalled or missed. OMB put a cloud definition based on NIST SP 800-145 into a proposed FAR rule on cybersecurity requirements for unclassified federal information systems in October 2023, and as of May 2026 the rule was not final. The Revolutionary FAR Overhaul revised all 53 FAR parts between April and October 2025, including Parts 2, 12, and 37. GAO reported that the changes did not address these cloud challenges.
Without a regulatory definition, each solicitation sets its own. One performance work statement says cloud services, another says hosting, a third says SaaS and treats the subscription as a product. The contracting officer then decides whether the buy is a commercial product, a commercial service, or both, and that choice shapes how the work gets priced and ordered.
Evaluators score what the offeror says it understands. An offer that uses the agency's loose language back at it leaves gaps the agency has to fill after award. An offer that states its service model, separates what it builds from what the provider bills, and lists its assumptions about the classification reads as a team that has bought cloud before.
The risk lands on the sub's work too. Implementation labor, a provider's consumption charge, and a reseller's licenses can all appear under one line in a solicitation. A prime that can point to a sub's work in countable units keeps that labor from being swallowed by a pass-through line.
The method below comes from Avalon's SaaS/IaaS Implementation service and the Cloud Migration & Development service. It describes how the work is done, at the methodology level.
The work produces assessor-ready environments and evidence. It does not write the security plan, issue an authorization, or change any provider's FedRAMP status.
GAO has no closure evidence to cite, because both matters are open. Fixed would be three changes in law and regulation:
For an offeror, the target is smaller and within reach: every deliverable in the offer carries a service-model label, a quantity, and an evidence artifact, so an evaluator can read the scope without a definition from the FAR.
Open as of GAO's last update. GAO's product page, read October 8, 2026, lists both matters as open and shows no status update dated after the June 23, 2026 release.
| Item | Directed to | Status |
|---|---|---|
| Matter 1: commercial product and service definitions | Congress | Open |
| Matter 2: information technology and cloud computing definitions | Congress | Open |
GAO's three recommendations to agencies (GSA, DHS, and the Federal CIO Council) do not concern the FAR.
| Field | Detail |
|---|---|
| NAICS | 541512, 541519 |
| Avalon's sub role | Tenant or landing-zone standup, identity federation, security baselines, and numbered migration waves, each with control-mapped evidence, under the prime's cloud task order |
| Small-business status | Small business; HUBZone (in progress) |
| Likely vehicles | GSA MAS (SIN 518210C Cloud Computing and Cloud Related IT Professional Services); GSA MAS (SIN 54151S IT Professional Services); GSA Alliant 3 |
If a cloud migration or SaaS and IaaS implementation task order is in your capture plan, Avalon teams as the sub that scopes its work in named integrations, numbered waves, and evidence keyed to control IDs, so your offer reads clearly whatever definition the solicitation uses.