The GAO's new cloud computing procurement report lands like a gift for challengers if you know how to read it. Most of the GovCon press covered it as a cautionary tale about agency dysfunction. It's actually a detailed map of where incumbent-locked agencies are vulnerable — and where they're not.
The report, Cloud Computing: Federal Government Needs to Address Procurement Challenges, found that senior officials from 22 of 24 selected agencies reported relying primarily on historical pricing data to evaluate cloud costs — a procurement practice that structurally advantages whoever built the baseline. That's the single most important sentence in 60 pages of findings, and the trade press barely touched it.
What "Historical Pricing Reliance" Actually Means for BD
When an agency uses its own historical spend as the primary cost benchmark for a new cloud acquisition, the incumbent doesn't just have a performance advantage — they built the ruler. Any challenger who bids against that baseline is competing on the incumbent's terms, using data the incumbent supplied.
This isn't conjecture. It's how cloud contract modifications and follow-on task orders stay with the same vendor for years after the original award. The contracting officer isn't necessarily captured — they're just using the only cost data they have, and that data came from the current provider.
For BD purposes, this means: if you see a cloud services recompete where the agency's statement of objectives is denominated in the incumbent's proprietary service tiers, walk away. You're not losing on price or technical approach. You're losing on the benchmark.
Where the Actual Opportunity Is
The GAO report identifies two failure modes that create genuine openings for challengers.
Conflicting guidance between OMB, agency CIO shops, and acquisition offices. When internal governance is fragmented, agencies are more likely to issue broad, requirements-heavy RFPs — because nobody internal has the authority to narrow scope. Broad RFPs are harder for incumbents to lock, because the requirements often exceed what any single legacy relationship can cover cleanly.
If you're tracking cloud opportunities, watch for solicitations where the PWS mixes infrastructure, managed services, and application support in a single vehicle. That scope mismatch often signals internal governance failure, not thoughtful acquisition design. It's messy — but it's genuinely competitive.
Lack of cost control mechanisms in existing contracts. GAO found that most agencies had no meaningful mechanism to control cloud costs once a contract was in place. That's an incumbent vulnerability, not an incumbent advantage. When a recompete eventually launches (and it will — even wired procurements eventually expire), the incumbent is defending a cost record they can't fully explain. Your job in capture is to make that record visible to the evaluators before the RFP drops.
How to Read the Pre-Solicitation Signals
The GAO report is useful background. The actual BD work happens in the pre-solicitation signals on SAM.gov and in the agency's IT spending disclosures. Here's what to look for:
RFIs that request incumbent-format responses. If an agency publishes a cloud-related RFI and the response template maps directly to a specific platform's service structure — think compute instance types, managed service tiers, storage classifications — they already know what they're buying. An RFI structured that way isn't market research; it's requirements validation for a decision already made.
Sources Sought with narrow NAICS scope. Cloud services can be acquired under several NAICS codes. A Sources Sought that uses an unusually narrow code — particularly one where the incumbent holds a vehicle the agency already uses — is often a signal that the competition is being shaped, not opened.
Short draft RFP comment windows. GAO specifically noted that agencies struggle with cloud acquisition timelines. When you see a draft RFP for a complex cloud requirement with a five-day comment window, the timeline isn't an oversight. It's a filter. Incumbents don't need 30 days to respond to a draft RFP — they helped write it.
The Quantum Wrinkle Coming Down the Pipeline
This is worth flagging even though it's 18-24 months from procurement materiality for most small businesses: the Trump administration's recent executive orders accelerating post-quantum cryptography migration are going to collide with the cloud procurement dysfunction GAO just documented.
Agencies that can't control cloud costs now are going to face mandatory encryption migration requirements on top of existing modernization debt. That intersection — cloud recompetes plus post-quantum compliance requirements — is where small businesses with dual capability (cloud managed services and cryptography expertise) will find their best leverage. The RFPs aren't written yet, but the requirements are being set today.
For more on reading compliance requirements as competitive signals rather than pass/fail gates, the Wired RFPs archive has the framework.
Your Capture Checklist for Cloud Recompetes
Before you commit proposal budget to a cloud services opportunity, run this:
1. Who built the cost baseline? If the agency's IGE (independent government estimate) references the incumbent's pricing structure, your price-to-win analysis needs to start there — not from your own rate card.
2. What does the IT dashboard show? The OMB IT Dashboard (itdashboard.gov) shows agency CIO ratings on major IT investments. A cloud program with consistent "needs attention" ratings is a program where the incumbent is already on defense, regardless of what the SOW says.
3. Is the scope realistically singular? Cloud RFPs that bundle IaaS, PaaS, application management, and help desk into one vehicle are almost always written around a GSA Schedule or GWAC that the incumbent already holds. Check the intended acquisition vehicle before investing in capture.
4. What's the protest history? GAO sustain rates on cloud procurements have been meaningful. A past protest on a predecessor contract — even an unsuccessful one — tells you the agency has been here before and the evaluators know they're being watched.
The GAO report is a symptom-level diagnosis of what federal cloud procurement looks like when agencies treat acquisition as a budget exercise instead of a competition. For small business BD, the symptoms are signals. The broken cost benchmarking, the conflicting guidance, the lack of oversight mechanisms — each one maps to a procurement pattern you can screen for before you spend a dollar on proposal development.
Run your pipeline against those patterns. The opportunities that survive the filter are the ones worth pursuing. For a broader framework on allocating BD resources to winnable work, the Bid Strategy category lays out the math.
The GAO didn't write this report for contractors. But that doesn't mean you can't use it like they did.
Frequently Asked Questions
How do I know if a cloud RFP has been wired for the incumbent?
Look for three things in combination: an SOW that references the incumbent's service tiers by name or structure, a pre-solicitation timeline too short for a non-incumbent to conduct meaningful due diligence, and a NAICS code narrowed to a category where the incumbent holds the agency's existing vehicle. Any two of three is a yellow flag. All three is a no-bid signal.
Does the GAO cloud report apply to small business opportunities specifically?
The report covered all federal cloud procurement, but the dynamics it describes — historical pricing reliance, fragmented governance, weak cost controls — hit challengers harder than large primes. Large integrators can absorb a wired recompete as a competitive loss and move on. Small businesses can't afford that burn rate. The report's findings are more actionable, not less, at the small business level.
What's the best early signal that an agency's cloud recompete will be genuinely competitive?
A strong signal is when the agency issues an RFI that asks open-ended questions about market capabilities rather than validating a specific architecture. Bonus signal: if the CO explicitly references GAO findings or OMB guidance in the pre-solicitation notice, they're on record that the acquisition needs to be defensible. That's a very different posture from an agency that's already decided and is running out the compliance clock.
Should small businesses avoid cloud opportunities dominated by large incumbents?
Not categorically. The question is whether the specific opportunity has structural features that allow a well-positioned challenger to compete on merit — realistic scope, defensible evaluation criteria, and a cost baseline that isn't built around the incumbent's rate card. Some cloud recompetes on large vehicles are genuinely open. Most aren't. The work is in telling the difference before you commit proposal resources, not after.
Field notes for federal small business contractors. Sharp, direct, and free of the consultant-speak that dominates the GovCon trade press. We help BD leaders allocate proposal capacity better — fewer wasted bids, more wins on the bids that matter.