Report Highlights

Cloud Infrastructure Services in the U.S.: Market Overview

The U.S. cloud infrastructure services market, covering infrastructure-as-a-service and platform-as-a-service revenue, reached an estimated USD 165 billion in 2024 and is forecast to reach USD 430 billion by 2032 at a 12.7% CAGR. The United States accounts for roughly 40% of global hyperscale cloud spending, anchored by Amazon Web Services, Microsoft Azure and Google Cloud, which together hold the majority of revenue share.

Private enterprise drove the market's early commercial scale, with AWS launching in 2006 and Microsoft Azure in 2010 before government demand matured. Government then became the decisive force in shaping its current form. The Cloud First policy of 2011 and the Cloud Smart strategy issued by the Office of Management and Budget in 2019 converted federal demand into a standardised, authorisation-led procurement model.

Policy-Driven Growth in U.S. Cloud Infrastructure

The Federal Information Security Modernization Act of 2014 and Executive Order 14028, issued in May 2021, require zero-trust architecture across federal agencies, forcing migration from legacy data centres to authorised cloud platforms. OMB Memorandum M-22-18 requires secure software attestation, pushing workloads toward providers that meet NIST SP 800-53 controls. Each mandate converts compliance obligations into sustained cloud consumption.

The Joint Warfighting Cloud Capability contract, awarded in December 2022 with a combined ceiling of USD 9 billion across AWS, Google, Microsoft and Oracle, created a multi-vendor pathway for Department of Defense workloads. The CHIPS and Science Act of 2022 funded domestic semiconductor supply, lowering hardware costs for hyperscale data centres. Procurement certainty and cheaper compute together translate into durable federal and defence demand.

Regulatory Barriers and Compliance Costs

FedRAMP authorisation, administered by the General Services Administration with the Joint Authorization Board, commonly takes 12 to 18 months and requires independent assessor fees plus continuous monitoring. Certification under the Cybersecurity Maturity Model Certification programme, administered by the Department of Defense through the Cyber AB accreditation body, adds third-party assessment costs for every contractor handling controlled unclassified information.

State privacy statutes add further friction. The California Consumer Privacy Act, as amended by the California Privacy Rights Act, is enforced by the California Privacy Protection Agency and requires data processing agreements and deletion mechanisms. Section 889 of the FY2019 National Defense Authorization Act bars federal procurement of equipment from Huawei, ZTE, Hikvision and Dahua, forcing supply chain audits and component replacement.

Policy-Created Opportunities in the U.S. Cloud Market

The FedRAMP 20x initiative, launched by the General Services Administration in 2025, automates authorisation through machine-readable evidence, opening federal demand to smaller providers that previously could not fund traditional assessments. Vendors delivering automated continuous monitoring stand to capture federal workloads currently held in manual review queues.

The Cybersecurity Maturity Model Certification programme creates a compliant demand pool across the defence industrial base, which comprises roughly 300,000 firms. Contractors need certified enclaves and private cloud environments to hold controlled unclassified information, giving regional providers a route into defence supply chains previously dominated by hyperscalers.

Market at a Glance

Leading Market Participants

• Amazon Web Services
• Microsoft Azure
• Google Cloud
• Oracle Cloud Infrastructure
• IBM Cloud
• Rackspace Technology
• CoreWeave
• Akamai Technologies
• DigitalOcean
• Hewlett Packard Enterprise

Regulatory and Policy Environment

The primary legislation is the Federal Information Security Modernization Act of 2014, codified in Chapter 35 of Title 44 of the United States Code, supplemented by the FedRAMP Authorization Act enacted within the FY2023 National Defense Authorization Act. Compliance requires NIST SP 800-53 controls, continuous monitoring and incident reporting to the Cybersecurity and Infrastructure Security Agency, which administers the federal cybersecurity framework.

The Securities and Exchange Commission's cybersecurity disclosure rules, effective December 2023, require public companies to file Form 8-K Item 1.05 after materiality determinations, affecting cloud customers' vendor risk. Compared with the European Union, whose NIS2 Directive and GDPR impose stricter data transfer rules, the U.S. framework is sector-specific and less prescriptive on data localisation, relying instead on procurement leverage.

Long-Term Policy Outlook for U.S. Cloud Infrastructure

By 2032, FedRAMP 20x is expected to replace manual authorisation for low- and moderate-impact systems, shortening onboarding and lowering costs for mid-tier providers. CMMC Phase 3 begins on 10 November 2027, extending third-party assessment across defence subcontractors and enlarging the compliant private cloud segment.

OMB Memorandum M-25-21, issued in April 2025, directs agencies toward governed AI compute environments, reshaping GPU capacity demand within federal cloud contracts. State privacy legislation will multiply, and federal data-sovereignty requirements will tighten, redirecting regional build-outs toward compliant sovereign zones.