Attachment 5: PAM OCIO Memo Acqusition of IT Cloud Services Policy Signed (004)

United States Department of the Interior

OFFICE OF THE SECRETARY

Washington, DC 20240
March 6, 2025

Memorandum
To:

Bureau and Office Associate Chief Information Officers
Heads of the Contracting Activity

Digitally signed by MEGAN

From:

MEGAN OLSEN OLSEN

Date: 2025.03.06 13:48:01 -05'00'

Megan Olsen
Director, Office of Acquisition and Property Management and Senior Procurement Executive

DARREN ASH Date: 2025.03.06 10:35:56 -05'00'

Darren B. Ash
Chief Information Officer
Office of the Chief Information Officer

Digitally signed by DARREN ASH

Subject:

Acquisition of Information Technology Cloud Services

Purpose
This memorandum updates requirements to procure and manage cloud hosting services1 in compliance with Office of Management and Budget (OMB) Memorandum, M-24-15, Modernizing the Federal Risk and Authorization Management Program (FedRAMP)2 to reduce duplication of cybersecurity efforts while offering a consistent, reusable authorization framework. It also strengthens the U.S. Department of Interior’s (Interior, Department) alignment with the Federal Information Technology Acquisition Reform Act of 2014 (FITARA)3. This policy rescinds and replaces Office of the Chief Information Officer (OCIO) Memorandum, Acquisition of Information Technology Cloud Services/Mandatory Use of PreApproved Cloud Hosting Services and Contracts policy, published August 7, 2018. Background
Over the past several years, there has been an exponential growth in cloud acquisitions. Since 2023, Interior has spent more than $300 million adopting commercial cloud services. As a result of the growth and potential cyber security risks and pitfalls of incorporating new systems into an enterprise environment, Interior is strengthening its governance and review process. This approach aims to optimize information management and technology (IMT) resources, eliminate duplicative spending, drive modernization, and increase shared services across the Department. Scope
This policy applies to acquisitions for all public cloud services as defined under NIST SP 8001

Definition of cloud services as defined under National Institute of Standards and Technology (NIST) Special Publications (SP) 800-145, The NIST Definition of Cloud Computing M-24-15 Modernizing the Federal Risk and Authorization Management Program as of July 25, 2024 Federal Information Technology Acquisition Reform Act (FITARA) as of December 2014

145. This includes all public cloud system investments that Interior directly manages or