GAO: 22 of 24 CFO Act Agencies Use Imprecise Cloud Procurement Data

The U.S. Government Accountability Office (GAO) has identified a systemic weakness in how federal agencies buy and manage cloud services, finding that 22 of 24 CFO Act agencies rely primarily on historical procurement and contract data to inform cloud-purchasing decisions. That reliance is problematic because such data can be imprecise—an individual contract may carry only a single product or service code, meaning the recorded spend category may not accurately reflect the mix of cloud offerings actually purchased. For a government that has spent years pushing agencies toward commercial cloud adoption, the finding suggests that the buying side of the equation has not kept pace with the technology side.

The data-quality gap matters because cloud purchasing is rarely a one-time event. Agencies continuously procure compute, storage, software-as-a-service, platform capabilities, and related professional services across multiple vehicles, including GSA schedules, agency-specific indefinite-delivery/indefinite-quantity contracts, and reseller agreements. When the underlying procurement records collapse diverse cloud purchases into coarse categories, budget officials, chief information officers, and acquisition executives lose the granularity needed to compare prices, identify duplication, negotiate enterprise agreements, or forecast future demand. GAO's finding effectively confirms that many agencies are steering significant cloud investments with a rear-view mirror rather than a real-time dashboard.

The problem extends beyond data taxonomy. Agencies reported a cluster of interrelated challenges: cost-control difficulties, conflicting guidance from oversight and policy bodies, outdated acquisition rules that lag behind commercial cloud consumption models, and difficulty obtaining authorized cloud solutions. These issues echo long-standing tensions in federal IT acquisition, where subscription-based, consumption-priced cloud services do not always fit neatly into appropriation structures, contract types, and approval processes designed for hardware and perpetual-license software. Conflicting guidance—potentially spanning directives from OMB, standards from NIST, and acquisition rules administered through GSA—can slow down or complicate awards, particularly when agencies must demonstrate that a chosen solution meets security and authorization requirements.

For procurement teams, the findings point to two distinct areas of exposure. First, cloud-spend visibility is weaker than it should be, which undermines cost control and strategic sourcing. Second, acquisition processes are not fully aligned with how cloud is commercially bought and consumed, creating friction that can delay delivery of authorized solutions. Both weaknesses represent potential demand signals for contractors. Vendors offering cost-analysis tools, spend-management platforms, acquisition support services, and cloud-compliance advisory work may find new opportunities as agencies look to close these gaps. Cloud providers and service firms should also account for agencies' reported cost-control and authorization challenges when shaping solutions and proposals—positioning offerings around predictable pricing, clear authorization pathways, and simpler contracting constructs could be a competitive differentiator.

The GAO findings arrive amid sustained federal scrutiny of IT and cloud spending, including efforts to improve data transparency through dashboards and reporting requirements. Agencies named in the broader oversight ecosystem—including DHS, GSA, OMB, and NIST—each play a role in either setting policy, providing acquisition vehicles, defining security standards, or overseeing implementation. The report's central implication is that better data alone will not solve the problem; agencies also need modernized rules and clearer, more consistent guidance. Until then, historical contract data will remain the default basis for cloud decisions at most CFO Act agencies, and the precision of those decisions will remain in question. Contractors that can help agencies bridge the gap between what their procurement systems record and what their cloud programs actually need will be well positioned in the coming budget cycles.

• GAO found 22 of 24 CFO Act agencies rely primarily on historical procurement and contract data for cloud-purchasing decisions.
• Data can be imprecise because a contract may carry only one product or service code, obscuring the true mix of cloud purchases.
• Agencies reported cost-control challenges, conflicting guidance, outdated acquisition rules, and difficulty obtaining authorized cloud solutions.
• The findings indicate weaknesses in cloud-spend visibility across much of the federal government.
• Potential contractor opportunities include cost analysis, acquisition modernization, and cloud compliance support.
• Cloud providers should address agencies' cost-control and authorization challenges in solution design and proposals.
• Oversight and policy players in the ecosystem include GAO, DHS, GSA, OMB, and NIST.
• Agencies can use the findings to prioritize better cloud-cost visibility and more reliable procurement data.
• Acquisition-support contractors can target agencies' outdated rules, conflicting guidance, and barriers to authorized cloud solutions.
• The report underscores that better data alone is insufficient without modernized acquisition rules and consistent guidance.