70RTAC26R00000004 A0002 - Q-A Matrix.pdf
Posted: Sept. 10, 2026
• Type: .pdf
• Size: 0.14MB
Opportunity Assistant
Loading
Overview
Related Opportunity
Related Agency
Profiled People
Summary
Amendment 0002—an Industry Questions and DHS Responses document issued by the U.S. Department of Homeland Security for Solicitation 70RTAC26R00000004—clarifies requirements for the Cumulus multiple-award IDIQ supporting commercial cloud service provider (CSP) offerings, marketplace solutions, SaaS, cloud infrastructure, financial management, resiliency, scalability, security, and proposal submission.
DHS confirmed that marketplace approvals are initiated only when DHS representatives demonstrate a specific marketplace need; there is no proactive ISV intake or published approval template. Products reviewed by applicable Component Technology Reference Model teams may take approximately five business days for review, while new TRM insertions must follow Component-specific workflows.
FedRAMP Moderate is sufficient for DHS intake review, although marketplace solutions must meet applicable FedRAMP High, Moderate, or Low requirements. ISVs may not directly contract with DHS for BYOL licenses under Cumulus, but DHS may use externally procured BYOL licenses within approved CSP marketplace products.
Marketplace approval is distinct for each CSP track, and non-approved SaaS products are outside Cumulus scope.
The responses also establish that Cumulus includes only the anticipated CSP awards identified in the solicitation, rather than separate professional-services task orders. Any future task orders under the multiple-award vehicle will be offered to all applicable contract holders and remain within IDIQ scope, with no current notional schedule.
IDIQ-level administration, management, PMO, and overhead costs will not receive a separate task order and must be included in applicable CLIN pricing. Enterprise Support CLIN X003 may cover task-order-level PMO services.
DHS will retain root ownership and full administrative control of resources in CSP-provided accounts and architectures. DHS will use existing Component-to-HQ financial data workflows rather than act as the sole cloud broker and will allow Component-specific choices for orchestration platforms and operational dependency management.
A CSP-owned direct network connection at a colocated facility is acceptable. Failover capabilities must be identified for services that cannot scale across multiple data centers.
The 4,000-virtual-instance scalability requirement may be met through aggregated scale units or autoscaling. Compliance will be measured through initiation and execution of the scaling request, not operating-system startup or end-user readiness.
Amendment-related clarifications include updates to SOW Sections 5.2.5, 5.3.11, and 5.3.15. The five-minute access/resource requirement applies to initiating creation, provisioning, configuration, or termination using commercially available capabilities.
The data-transfer cost threshold is established at the task-order level. DHS requires notification workflows and suspension of services when authorized funding is exhausted.
Commercial terms, Reserved Instances, and subscription entitlements need not be converted to noncommercial consumption billing. Non-U.S. citizen support is permissible when allowed by applicable FedRAMP and SOW Section 9 requirements, including where personnel may access DHS data.
Proposals are due by 4:00 p.m. Eastern Time on September 14, 2026. Proposals must satisfy the solicitation’s stated submission requirements and must be emailed to the designated DHS point of contact with the prescribed solicitation subject line.
Awards will be made using a best-value source-selection approach, and place of performance will be determined at the task-order level.
DHS confirmed that marketplace approvals are initiated only when DHS representatives demonstrate a specific marketplace need; there is no proactive ISV intake or published approval template. Products reviewed by applicable Component Technology Reference Model teams may take approximately five business days for review, while new TRM insertions must follow Component-specific workflows.
FedRAMP Moderate is sufficient for DHS intake review, although marketplace solutions must meet applicable FedRAMP High, Moderate, or Low requirements. ISVs may not directly contract with DHS for BYOL licenses under Cumulus, but DHS may use externally procured BYOL licenses within approved CSP marketplace products.
Marketplace approval is distinct for each CSP track, and non-approved SaaS products are outside Cumulus scope.
The responses also establish that Cumulus includes only the anticipated CSP awards identified in the solicitation, rather than separate professional-services task orders. Any future task orders under the multiple-award vehicle will be offered to all applicable contract holders and remain within IDIQ scope, with no current notional schedule.
IDIQ-level administration, management, PMO, and overhead costs will not receive a separate task order and must be included in applicable CLIN pricing. Enterprise Support CLIN X003 may cover task-order-level PMO services.
DHS will retain root ownership and full administrative control of resources in CSP-provided accounts and architectures. DHS will use existing Component-to-HQ financial data workflows rather than act as the sole cloud broker and will allow Component-specific choices for orchestration platforms and operational dependency management.
A CSP-owned direct network connection at a colocated facility is acceptable. Failover capabilities must be identified for services that cannot scale across multiple data centers.
The 4,000-virtual-instance scalability requirement may be met through aggregated scale units or autoscaling. Compliance will be measured through initiation and execution of the scaling request, not operating-system startup or end-user readiness.
Amendment-related clarifications include updates to SOW Sections 5.2.5, 5.3.11, and 5.3.15. The five-minute access/resource requirement applies to initiating creation, provisioning, configuration, or termination using commercially available capabilities.
The data-transfer cost threshold is established at the task-order level. DHS requires notification workflows and suspension of services when authorized funding is exhausted.
Commercial terms, Reserved Instances, and subscription entitlements need not be converted to noncommercial consumption billing. Non-U.S. citizen support is permissible when allowed by applicable FedRAMP and SOW Section 9 requirements, including where personnel may access DHS data.
Proposals are due by 4:00 p.m. Eastern Time on September 14, 2026. Proposals must satisfy the solicitation’s stated submission requirements and must be emailed to the designated DHS point of contact with the prescribed solicitation subject line.
Awards will be made using a best-value source-selection approach, and place of performance will be determined at the task-order level.
Show All