JEDI bidding process
"Requirements for the contract had originally been so tough that only four bidders entered the race: Amazon, IBM, Microsoft and Oracle. The DoD then further tightened security requirements so that only MS and Bezos's lot were left in the running."
My reading indicated that you needed to be able to provide multiple DC's in two or more states and they had to be FedRAMP approved - AWS, Azure, IBM and Oracle were already FedRAMP cloud service providers and I believe Googles approval is started but was paused by Google and Google choose to withdraw from JEDI (this may have changed). The only other vendor that I could imagine joining this group is AT&T but I'm unsure if they are a FedRAMP CSP.
The selection process ruled out IBM and Oracle because they were not competitive on price (>$200m higher in years 1-2 due to acquire required DCs) and delivery timelines (1-2 year setup timeline leading to an additional $200m-$500m cost increase for the DoD) - can you provide any information indicating it was a tightened security requirement? The FedRAMP CSP requirements already specified security requirements that are reviewed regularly, so all existing CSP's would have had to comply with those regardless of JEDI.