GAO Mandates NSF CIO to Standardize Cloud SLAs and Strengthen IT Governance

The Government Accountability Office (GAO) has formally directed the National Science Foundation's Chief Information Officer to implement critical improvements in cloud procurement and IT oversight. In a February 12, 2026 letter addressed to NSF CIO Clyde Richards, the congressional watchdog agency outlined specific compliance requirements to rectify governance deficiencies in the foundation's $9 billion technology operations.

Regulatory Action: Mandatory Cloud SLA Standardization

Under the GAO's directive, the NSF must develop and implement agency-wide guidance for standardized cloud service-level agreements (SLAs) by Q4 2026. This requires:

1. Binding SLAs with every cloud vendor, specifying measurable performance metrics
2. Remediation protocols for provider non-compliance, including financial penalties
3. Centralized tracking of SLA adherence across all cloud operations

The GAO explicitly stated that NSF must "consistently hold cloud service providers accountable for performance" through enforceable contractual terms. This responds to findings that cloud operations lacked consistent performance benchmarks, particularly for high-value assets.

Infrastructure Overhaul Requirements

For systems classified as High Value Assets (HVAs) operating in the cloud:

1. Existing contracts must undergo comprehensive review by Q3 2026
2. New procurement templates must incorporate FISMA 2014 security requirements
3. Documentation must demonstrate risk-based vendor selection criteria

IT Portfolio Management Mandate

The NSF CIO must conduct annual enterprise-wide IT portfolio reviews starting FY2027, aligned with federal requirements (OMB Circular A-130). These reviews must:

• Identify redundant systems across scientific research divisions
• Document resource optimization plans
• Validate cost-saving projections through benchmark analysis

Cybersecurity Compliance

Outstanding recommendations under the Federal Information Security Modernization Act (FISMA 2014) require immediate attention. The NSF must:

• Complete security control assessments for cloud-migrated systems
• Implement continuous monitoring protocols for HVAs
• Submit remediation progress reports quarterly

Operational Context

These directives impact NSF's ongoing digital transformation, including the $20 million CloudBank initiative providing cloud resources to researchers and the transition of the NCAR-Wythington Supercomputing Center to third-party management. CIO Clyde Richards, appointed permanently seven months ago after Defense Department service, must demonstrate progress before the GAO's next audit cycle.

Failure to implement these recommendations risks non-compliance with federal acquisition regulations and could impact NSF's ability to efficiently support critical scientific research programs. The GAO has requested a formal implementation plan within 60 days.