By In November 2024, GAO found that five of six selected agencies reported restrictive software licensing practices affecting their cloud efforts. VA and DoW each have open recommendations to issue guidance for identifying, analyzing, and mitigating them.
In November 2024, GAO published Cloud Computing: Selected Agencies Need to Implement Updated Guidance for Managing Restrictive Licenses (opens in a new tab) (GAO-25-107114). GAO defines restrictive licensing practices as vendor processes that limit, impede, or prevent agencies' efforts to use software in cloud computing. It reviewed six randomly selected agencies and 11 cloud investments.
Five of the six reported impacts. Four saw cost increases and three reported a narrower choice of cloud provider.
GAO made two recommendations to each agency. VA received recommendations 5 and 6: update and implement guidance to fully address identifying, analyzing, and mitigating the impacts, and assign and document responsibility for identifying and managing them. VA agreed. GAO rated VA as not having demonstrated full implementation of either key activity.
DoW (formerly DoD) got a similar finding first. In September 2023, DOD Software Licenses: Better Guidance and Plans Needed to Ensure Restrictive Practices Are Mitigated (opens in a new tab) (GAO-23-106290) found that officials from all three selected components reported restrictive practices. GAO recommended that the DoW CIO, in coordination with the Enterprise Software Initiative (ESI), update and implement guidance and plans covering the same three activities. DoW agreed.
GAO gave two reasons in the civilian report. Responsibility was unassigned: officials pointed to the CIO or a shared group of IT, acquisition, and legal staff, but none had documented who was accountable. And the topic ranked low, because officials said they had seen few instances.
The DoW report adds a pattern. Four of the six DoW investments reported no impacts, and GAO suggested that may be because they deploy software inside the cloud rather than move it there. The practice bites at migration. Where it bites, the money is hard to see: DoW officials could not specify the amount of most cost increases they reported.
Timelines have slipped. DoW said in 2023 that it intended to publish guidance by the end of fiscal year 2024. In November 2024, the DoW CIO told GAO the department planned to define restrictive license practices clearly and issue guidance by June 2026.
DoW also set up an enterprise cloud management board in February 2025. VA told GAO it planned a working group by the end of fiscal year 2026. By GAO's January 2026 notes, no guidance existed at either agency.
Migration, rehosting, and hosting task orders are where installed commercial software meets a cloud provider's infrastructure. GAO's examples of restrictive practices are the kind that change a price after award: repurchasing licenses for cloud use, charging extra to run a vendor's software on another provider's infrastructure, charging a conversion fee, and steering customers toward the vendor's own cloud.
An agency with no guidance and no dollar figure has no baseline to hold a price against. GAO said the full extent of the impact on DoW remains unknown. An offeror that treats vendor license terms as a named migration risk, with a way to measure them, is answering a question the agency cannot yet answer for itself.
Recompetes raise the stakes. An incoming contractor inherits the incumbent's enterprise agreements, marketplace subscriptions, and commitments along with the workloads. A cost volume that assumes licenses move at no added cost is a bet on terms nobody has checked.
VA's separate license-count recommendation is covered in The License Count GAO Keeps Asking VA to Produce.
The method below comes from Avalon's FinOps service. It works from billing and contract records with read-only access, in unclassified environments, and it supplies the measurement that GAO's guidance recommendations depend on.
Avalon advises; the contracting officer negotiates with vendors. This work does not write the agency's licensing guidance or assign responsibility, which are the agency's decisions. It is not a financial audit or attestation, and savings depend on actions only the agency can take.
GAO has published closure evidence for one of the twelve civilian recommendations. NASA's recommendation to assign and document responsibility closed after NASA updated its Cloud and Computing Services guidance in July 2025, and GAO reviewed and confirmed it. That is the only closure on the page.
For the guidance recommendations, GAO's own wording sets the test: guidance that fully addresses identifying, analyzing, and mitigating the impacts. These are targets:
VA recommendations 5 and 6 and the DoW CIO recommendation were open as of GAO's last update, January 2026. Eleven of the twelve GAO-25-107114 recommendations were open; NASA's recommendation 8 is the one closed.
| Field | Detail |
|---|---|
| NAICS | 541519, 541512 |
| Avalon's sub role | Billing-data baseline, licensing model fit analysis, and a dollar-ranked evidence workbook of cloud licensing costs under the prime's cloud migration or hosting task order |
| Small-business status | Small business; HUBZone (in progress) |
| Likely vehicles | GSA MAS (SIN 518210C Cloud Computing and Cloud Related IT Professional Services); GSA MAS (SIN 54151S IT Professional Services); GSA Alliant 3 |
If VA or DoW cloud migration or hosting work is in your capture plan, Avalon teams as the sub that puts a dollar figure on what vendor license terms add to each cloud investment.