Department of Homeland Security (DHS) - Department-Wide Cloud (Cumulus) Multiple Award Solicitation

This solicitation (70RTAC26R00000004, Amendment 0001) is issued by the U.S. Department of Homeland Security (DHS), Office of the Chief Information Officer (OCIO), to establish a multiple-award Indefinite-Delivery, Indefinite-Quantity (IDIQ) contract for department-wide cloud services, titled "Project Cumulus." Valued at a ceiling of $503 million, the contract features a one-year base period and four one-year option periods. It seeks to acquire Anything as a Service (XaaS) cloud services, marketplace services, enterprise support, training, and professional services under NAICS code 518210. The solicitation outlines a unique "Revolutionary Federal Acquisition Regulation Overhaul" (RFO FAR) framework. This framework explicitly prohibits Cloud Service Providers (CSPs) from incorporating separate, external terms—such as End User License Agreements (EULAs) or Non-Disclosure Agreements (NDAs)—or making unilateral changes to pricing and service levels. Proposals must be submitted by September 11, 2026, and will be evaluated using a best-value source selection process across three descending factors: Technical Capability (Factor 1), Relevant Past Performance (Factor 2), and Price (Factor 3). To qualify under Technical Capability, CSPs must demonstrate robust technical architectures, FedRAMP compliance, specific scaling capacities, and a large public cloud market presence. Volume I (Technical) is capped at a 2-page cover letter, 8 pages for technical assumptions and capability, and 6 pages for past performance. Volume II (Price) requires completed pricing models and links to commercial pricing portals. Award schedules anticipate distinct single awards for major cloud providers (Amazon, Oracle, Google, Microsoft) alongside a multiple-award vehicle.

This document contains Industry Questions and Department of Homeland Security (DHS) Responses (Amendment 0002) for Solicitation 70RTAC26R00000004, known as the Cumulus multi-award cloud service provider (CSP) IDIQ. Key clarifications provided by DHS include: - **Marketplace Solutions:** DHS will not publish a marketplace approval template. Independent Software Vendors (ISVs) cannot contract directly with DHS via Cumulus under a Bring Your Own License (BYOL) model; however, BYOL licenses procured externally can be used. Marketplace solutions require demonstrated customer need and are evaluated individually per IDIQ award track (AWS, Oracle, Google, Microsoft). FedRAMP Moderate is sufficient for initial intake. - **Contract Administration & Pricing:** Program Management Office (PMO) services must be built into unit pricing under existing CLINs, as no separate IDIQ-level PMO task order will be issued. The $1.76M Marketplace Services estimate covers all in-scope SaaS, including specialized applications. - **Technical & Operational Requirements:** Scaling to 4,000 virtual instances within 10 minutes applies to the initiation and execution of the request, including OS and application startup. DHS Components retain the flexibility to choose enterprise workload orchestration platforms and maintain administrative access over their own billing data. - **Submission Details:** The proposal submission deadline is updated to 4:00 PM ET on September 14, 2026, and proposals must be emailed to Contracting Officer Gregory Blaszko. Award will be made on a best-value basis.

This combined synopsis/solicitation (No. 70RTAC26R00000004) issued by the Department of Homeland Security (DHS) Office of the Chief Information Officer (OCIO) details a multiple-award Indefinite-Delivery, Indefinite-Quantity (IDIQ) contract vehicle titled "Cumulus." The acquisition seeks to secure Department-wide Anything as a Service (XaaS) cloud services, marketplace services, enterprise support, training, and Cloud Service Provider (CSP) specific professional services. The contract structure consists of a one-year base period and four one-year optional ordering periods, carrying an overall ceiling value of $503 million. DHS intends to establish several single-award contracts with major CSPs (specifically naming Amazon, Oracle, Google, and Microsoft) alongside a multiple-award vehicle featuring on- and off-ramping terms. Proposals will be evaluated using a best-value source selection process across three descending factors of importance: Technical Capability (Factor 1), Relevant Past Performance (Factor 2), and Price (Factor 3). Key technical requirements mandate that the government maintains full ownership of all root accounts and metadata, has the ability to bypass the public internet via direct network connections up to 10Gbps, and receives a minimum availability level of 99.9%. Crucially, the solicitation prohibits contractors from introducing separate end-user license agreements (EULAs), non-disclosure agreements, or unilateral contract changes outside of the bilaterally executed IDIQ contract. Price proposals must apply significant, non-customary discounts to the CSP's publicly available commercial pricing for the duration of the agreement.

This Statement of Work (SOW) outlines the U.S. Department of Homeland Security (DHS) Cumulus Program, which aims to establish a secure, interoperable, and integrated multi-cloud ecosystem. DHS requires Department-wide enterprise cloud service provider (CSP) "Anything as a Service" (XaaS) solutions, including commercial and government cloud services, professional support, and training. The scope supports a single-award, indefinite-delivery, indefinite-quantity (IDIQ) contract over a five-year ordering period (one-year base and four option years) using Firm-Fixed-Price and consumption-based pricing models. The contract provides true on-demand CSP solutions, excluding third-party resellers or managed service providers. Key requirements span technical scalability—requiring horizontal and vertical scaling to 4,000 virtual instances in under 10 minutes—and reliability, with a minimum 99.9% service availability. The SOW mandates strict security and governance protocols, including full DHS ownership of tenancies, compliance with NIST and FedRAMP standards (Low, Moderate, and High), and rigorous metadata controls that prohibit unauthorized AI/ML training or third-party sharing. Additionally, CSPs must provide comprehensive enterprise support, annual training seats, FinOps-compliant billing reporting, and Section 508 accessibility compliance. Non-technical deliverables include a post-award meeting, an enrollment transfer plan, monthly usage reports, and proactive usage threshold notifications.

This federal document presents Amendment 0002 for the Department of Homeland Security (DHS) Cumulus solicitation (70RTAC26R00000004). It provides official industry questions and DHS responses concerning a multi-award Cloud Service Provider (CSP) IDIQ contract. Key clarifications address the marketplace solution intake process, noting that third-party SaaS products must demonstrate a marketplace need initiated by a DHS representative prior to approval. FedRAMP Moderate is confirmed as sufficient for initial marketplace review, though Bring Your Own License (BYOL) licenses must be procured outside of Cumulus. DHS clarifies that the IDIQ will utilize CLIN x003 (Enterprise Support) for task-order level Program Management Office (PMO) services rather than issuing a standalone IDIQ-level PMO task order. Furthermore, the document outlines technical parameters, confirming that scaling to 4,000 virtual instances within ten minutes must include operating-system initialization, policy application, and application startup. DHS will maintain existing decentralized billing workflows, with individual components holding administrative access. Finally, the proposal submission deadline is updated to September 14, 2026, at 4:00 PM ET, with submissions directed to Contracting Officer Gregory Blaszko.

This document is Amendment 0002 to Request for Proposal (RFP) 70RTAC26R00000004, issued by the U.S. Department of Homeland Security (DHS), Office of Procurement Operations, Information Technology Acquisition Center. The RFP supports DHS Department-Wide Cloud (Cumulus) requirements and is administered by Contracting Officer Gregory Blaszko. The primary purpose of this amendment is to execute four key administrative actions: 1. Provide official DHS responses to timely submitted industry questions regarding the solicitation. 2. Release a track-changes version of the solicitation document reflecting updates and edits made in response to industry feedback. 3. Release a track-changes version of the solicitation’s Statement of Work (SOW) to reflect corresponding updates. 4. Extend the proposal submission deadline from the date previously established in Amendment 0001 to 4:00 p.m. Eastern Time on September 14, 2026. All other terms and conditions of the original solicitation not modified by this amendment remain unchanged and in full effect. Offerors are required to formally acknowledge receipt of this amendment prior to the specified proposal deadline using Standard Form 30 or through an authorized alternative method to avoid rejection of their offers.

This document is Amendment 0001 to Solicitation 70RTAC26R00000004, issued by the U.S. Department of Homeland Security, Office of Procurement Operations, Information Technology Acquisition Center. The primary purpose of this amendment is to implement two key schedule modifications and provide clarification on question submissions. First, the deadline for proposal responses is extended to 2:00 p.m. ET on September 11, 2026. Second, the deadline for submitting solicitation questions is extended to 2:00 p.m. ET on September 2, 2026. Additionally, the amendment provides further clarification regarding the content of submitted questions and includes a track-changes version of the solicitation as an attachment. All other terms and conditions of the original request for proposals (RFP) remain unchanged and in full effect. Offerors must acknowledge receipt of this amendment prior to the specified submission deadline to avoid potential rejection of their proposals.

This Department of Homeland Security (DHS) combined synopsis/solicitation (No. 70RTAC26R00000004) seeks proposals to establish multiple-award, Indefinite-Delivery, Indefinite-Quantity (IDIQ) contracts for Department-Wide Cloud Services, titled "Project Cumulus." Administered by the Office of Procurement Operations (OPO) on behalf of the Office of the Chief Information Officer (OCIO), this unrestricted acquisition has an estimated ceiling value of $503 million. The contract structure consists of a one-year base ordering period followed by four one-year optional ordering periods under NAICS code 518210. Key requirements include Anything as a Service (XaaS) cloud services, marketplace services, enterprise support, enterprise training, and Cloud Service Provider (CSP) specific professional services. Proposals must be submitted in two volumes: Volume I (Technical Proposal) and Volume II (Price Proposal), which are due by August 28, 2026, at 2:00 PM ET. Contracts will be awarded on a best-value basis using three descending evaluation factors: Technical Capability (Factor 1), Relevant Past Performance (Factor 2), and Price (Factor 3). Combined, the technical factors are significantly more important than price. DHS intends to make single-award IDIQ allocations directly to major CSPs—including Amazon, Oracle, Google, and Microsoft—alongside a multiple-award vehicle featuring on/off-ramping terms. To maintain federal sovereignty, the solicitation explicitly prohibits separate, vendor-executed terms and conditions (such as external EULAs) or unilateral pricing and service changes by the contractors.

This federal document (Contract ID: 70RTAC26D00000004) is a Performance Work Statement (PWS) outlining technical, non-technical, and contract requirements for Cloud Service Provider (CSP) services. The scope of work encompasses delivering secure, scalable, and reliable Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) environments, alongside professional services, support, and training. Key technical requirements focus on ownership, management, reporting, and operational support. The CSP must deliver robust service performance, ensure high availability, scalability, and reliability, and maintain compliance with Federal Risk and Authorization Management Program (FedRAMP) standards and Section 508 accessibility requirements. Non-technical obligations include contract reporting, managing Government Furnished Property/Information (GFX), and adhering to a structured IDIQ deliverables schedule. The contract defines specific management protocols, including post-award meetings, account transfer plans, and periodic reporting. It establishes clear guidelines for the place and period of performance, contract type, and management roles, ensuring the federal government receives secure, compliant, and continuously supported cloud environment solutions.

This document is Attachment 4, a Past Performance Questionnaire (PPQ) for the U.S. Department of Homeland Security's (DHS) Department-Wide Cloud (Cumulus) solicitation (70RTAC26R00000004). The purpose of the questionnaire is to evaluate the quality of past performance of contractors bidding on the Department-wide contract, which encompasses commercial Cloud Service Provider (CSP) Anything as a Service (XaaS) cloud services, professional services, marketplace solutions, and training. The document requests evaluators (such as project managers, contracting officers, or representative oversight personnel) to provide administrative project details, including contract numbers, periods of performance, total project values, annual hours, and brief scope descriptions to determine project relevancy. The core of the questionnaire consists of 12 qualitative performance evaluation questions. These cover critical performance areas, including: - Consistency in providing required staffing and solutions. - Record-keeping, certifications, and documentation accuracy. - Professionalism, attentiveness, and problem-solving abilities. - Quality control, project management, and contract transition capabilities. - Supervision adequacy and compliance with subcontracting plan goals. - Willingness to hire the contractor again. Ultimately, respondents must provide an overall performance rating of either Highly Acceptable, Acceptable, or Unacceptable, and return the completed questionnaire directly to DHS Contracting Officer Gregory Blaszko.

This document is Attachment 3, Past Performance Form, for federal solicitation 70RTAC26R00000004. It serves as a standardized template for offerors to document and submit information regarding their previous contracts to demonstrate relevant experience and performance history. The form requires offerors to provide comprehensive project details, including the contractor's name, solicitation number, client organization details, contract number, award date, total and annual project pricing, period of performance, security clearance levels, annual labor hours, and staffing levels. It also requires contact information for both technical and contracting points of contact, as well as the geographic locations where the work was performed. Additionally, contractors must indicate whether a finalized Contractor Performance Assessment Report (CPARS) is available in SAM.gov. In the narrative sections, offerors must describe the scope, magnitude, and complexity of the work to establish its relevance to the current solicitation. This includes explaining any unique requirements, performance challenges, corrective actions taken, and any Department of Labor investigations. Finally, the form requires details on subcontracting plans and the specific roles of any subcontractors utilized. Detailed, item-by-item instructions are provided to guide offerors in accurately completing each section.

This document is Attachment 1 to the Department of Homeland Security (DHS) solicitation 70RTAC26D00000004 for Department-Wide Cloud Services (Cumulus). It establishes the Cloud Service Provider (CSP) Catalog Discount Model, which is used to evaluate pricing for multiple-award cloud solutions. The model outlines estimated service quantities and costs across five primary Contract Line Item Numbers (CLINs): - X001: XaaS Cloud Services (SOW Sections 5.2 and 5.3) - X002: Marketplace Services (SOW Section 5.2.7) - X003: Enterprise Support (SOW Section 5.4.1) - X004: Enterprise Training (SOW Section 5.4.2) - X005: CSP Specific Professional Services (SOW Section 5.4.4) To evaluate proposals, the model uses a standardized unit price of $1.00 to represent varying units of measure. Vendors must input their proposed catalog discount percentages for each category, which will apply to all in-scope services. The total evaluated model price across the base period, four optional ordering periods, and the FAR 52.217-8 option-to-extend period is estimated at $578,925,047.97. The breakdown of estimated baseline costs includes approximately $50.3 million for the Base Period, $75.5 million for Option Period One, $100.7 million for Option Period Two, $125.9 million for Option Period Three, $151.0 million for Option Period Four, and $75.5 million for the FAR 52.217-8 evaluation period. Actual procurement quantities may vary based on agency needs.