70RTAC26R00000004 A0002 - Q-A Matrix updated.pdf
Posted: Sept. 10, 2026
• Type: .pdf
• Size: 0.14MB
Opportunity Assistant
Loading
Overview
Related Opportunity
Related Agency
Profiled People
Summary
Amendment 0002 to DHS Solicitation 70RTAC26R00000004, an Industry Questions and DHS Responses document, clarifies requirements for the Cumulus multiple-award IDIQ vehicle for commercial cloud service providers, marketplace solutions, SaaS, cloud operations, security, financial management, scalability, and proposal submission.
DHS confirms that the solicitation is full and open to commercial providers able to satisfy the Statement of Work, including the named AWS, Google Cloud, Microsoft Azure, and Oracle tracks. Anticipated multiple-award task orders will be limited to in-scope requirements and offered to all applicable IDIQ holders, while no timeline currently exists for potential professional-services task orders.
The responses establish that marketplace products require DHS customer-identified need and IDIQ Contracting Officer intake. DHS will approve or reject solutions separately for each CSP award, will not publish a marketplace approval template, and may evaluate specialized vertical SaaS products case by case.
ISVs cannot contract directly with DHS for BYOL licenses under Cumulus, although DHS may use externally procured BYOL licenses within CSP marketplace products. FedRAMP Moderate is sufficient for DHS review intake, but third-party products that do not meet applicable FedRAMP or NIST 800-53 requirements may have significantly limited availability.
Offerors are not responsible for certifying third-party services unless they are the publisher. DHS will use existing FOCUS and Cost and Usage Report workflows, retain component-level billing administration rather than serve as the sole cloud broker, and seek recommendations for future organizational and billing structures.
DHS further clarifies that IDIQ-level administration, management, overhead, and PMO costs must be included in applicable CLIN prices rather than funded through a separate IDIQ task order. CLIN X003 Enterprise Support may provide PMO services at the task-order level.
A five-minute requirement applies to initiating provisioning, access, configuration, and termination operations—not necessarily completing complex operations—and CSPs may satisfy it using commercially available capabilities.
CSP-owned colocated network connections are acceptable. Scalability to 4,000 virtual instances within 10 minutes may use aggregate architectures or autoscaling, and the measurement excludes operating-system initialization and subsequent application readiness.
The amendment also confirms that the proposal deadline is 4:00 p.m. Eastern Time on September 14, 2026. Proposals must be emailed to Gregory Blaszko with the subject “Solicitation 70RTAC26R00000004 – Proposal Submission.”
Task-order place of performance, personnel citizenship, data-hosting boundaries, and other operational requirements will be determined based on task-order needs and applicable DHS, FedRAMP, and SOW provisions.
DHS confirms that the solicitation is full and open to commercial providers able to satisfy the Statement of Work, including the named AWS, Google Cloud, Microsoft Azure, and Oracle tracks. Anticipated multiple-award task orders will be limited to in-scope requirements and offered to all applicable IDIQ holders, while no timeline currently exists for potential professional-services task orders.
The responses establish that marketplace products require DHS customer-identified need and IDIQ Contracting Officer intake. DHS will approve or reject solutions separately for each CSP award, will not publish a marketplace approval template, and may evaluate specialized vertical SaaS products case by case.
ISVs cannot contract directly with DHS for BYOL licenses under Cumulus, although DHS may use externally procured BYOL licenses within CSP marketplace products. FedRAMP Moderate is sufficient for DHS review intake, but third-party products that do not meet applicable FedRAMP or NIST 800-53 requirements may have significantly limited availability.
Offerors are not responsible for certifying third-party services unless they are the publisher. DHS will use existing FOCUS and Cost and Usage Report workflows, retain component-level billing administration rather than serve as the sole cloud broker, and seek recommendations for future organizational and billing structures.
DHS further clarifies that IDIQ-level administration, management, overhead, and PMO costs must be included in applicable CLIN prices rather than funded through a separate IDIQ task order. CLIN X003 Enterprise Support may provide PMO services at the task-order level.
A five-minute requirement applies to initiating provisioning, access, configuration, and termination operations—not necessarily completing complex operations—and CSPs may satisfy it using commercially available capabilities.
CSP-owned colocated network connections are acceptable. Scalability to 4,000 virtual instances within 10 minutes may use aggregate architectures or autoscaling, and the measurement excludes operating-system initialization and subsequent application readiness.
The amendment also confirms that the proposal deadline is 4:00 p.m. Eastern Time on September 14, 2026. Proposals must be emailed to Gregory Blaszko with the subject “Solicitation 70RTAC26R00000004 – Proposal Submission.”
Task-order place of performance, personnel citizenship, data-hosting boundaries, and other operational requirements will be determined based on task-order needs and applicable DHS, FedRAMP, and SOW provisions.
Show All