Disclosure: I work on Google Cloud (but I wasn't involved at all with anything regarding JEDI). I think it's more accurate to say that we did not have (and do

Disclosure: I work on Google Cloud (but I wasn't involved at all with anything regarding JEDI). I think it's more accurate to say that we did not have (and do not have) the Impact Level 6 (IL-6) authorization that JEDI strongly suggested. As a commenter below says, that doesn't actually mean "vastly behind" any more than "Oh, you don't have < French Law thing >" would mean vastly behind. The Defense Department now has a writeup actually [1] about some of this (search for "Impact Level"): > In an October 22, 2018 letter to the OIG, Representatives Womack and Cole raised concerns about the RFP’s “gating or restricting provisions” that seemed to be tailored to one specific contractor that the Representatives did not identify. On September 6, 2018, Oracle made a similar allegation in its supplemental complaint to the GAO. For example, the Representatives referred to “the requirement that the Cloud Service Provider meets the Defense Information Systems Agency Impact Level 6. Currently, this unnecessary requirement, along with many others, can only be met by one specific contractor." > [...] As of December 2018, Amazon Web Services was the only contractor granted an IL-6 authorization." > [...] We reviewed the JEDI Cloud RFP and found that it did not include a gate criteria that required a contractor to meet the IL-6 security requirements; rather, the RFP Statement of Objectives required a contractor to have infrastructure capable of meeting security requirements associated with hosting information classified at the Secret level within 180 days of contract award. The contractor’s infrastructure also had to meet security requirements associated with hosting information classified at the Top Secret level, within 270 days of contract award. Additionally, on December 12, 2019, DISA granted Microsoft IL-6 authorizations, demonstrating that more than one contractor was capable of meeting the security requirements. [1] https://media.defense.gov/2020/Apr/15/2002281438/-1/-1/1/REPORT%20ON%20THE%20JOINT%20ENTERPRISE%20DEFENSE%20INFRASTRUCTURE%20(JEDI)%20CLOUD%20PROCUREMENT%20DODIG-2020-079.PDF https://media.defense.gov/2020/Apr/15/2002281438/-1/-1/1/REP...