70RTAC26R00000004 - A0002 SOW.pdf
Posted: Sept. 10, 2026
• Type: .pdf
• Size: 0.27MB
Opportunity Assistant
Loading
Overview
Related Opportunity
Related Agency
Summary
This Amendment 0002 Statement of Work issued by the U.S. Department of Homeland Security (DHS), Office of the Chief Information Officer, for the Cumulus Program establishes Enterprise Cloud Service Provider (CSP) requirements for a department-wide indefinite-delivery, indefinite-quantity (IDIQ) contract supporting commercial and government “Anything as a Service” (XaaS), professional services, enterprise support, and training.
The contract is intended to help DHS modernize and secure more than 600 cloud-hosted systems through an integrated, interoperable, scalable, automated, and secure multicloud ecosystem supporting mission-critical, safety-critical, and life-critical operations, including disconnected or edge environments and emerging technologies such as artificial intelligence, machine learning, and high-performance computing.
Task orders may acquire true on-demand CSP-provided Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), Functions as a Service, Database as a Service, Container as a Service, and other current or future XaaS offerings, but exclude non-CSP third-party reseller services, managed service provider services, and contractor lead-system-integrator development, architecture, implementation, interoperability, and migration work.
The awarded CSP must provide DHS and its Components ownership and administrative control of all relevant tenancies, root accounts, linked accounts, payer or master accounts, and subscriptions; centralized account organization; GUI and API access; raw usage, billing, spend, and Cost and Usage Report data; exports in FinOps Open Cost and Usage Specification (FOCUS) version 1.X or the Government’s current supported version; product catalogs; and tools for cost optimization, commitment discounts, reserved or spot capacity, configuration management, performance monitoring, and security compliance.
CSPs must provide unrestricted access for DHS technical support requests, architectural reviews using applicable Well-Architected frameworks, proactive workload and cost-optimization assistance, a dedicated program manager and support staff, monthly Program Management Reviews, recurring DHS-directed working groups with authorized subject-matter experts, required training for personnel accessing DHS systems, department-wide ordering guides, account-request and provisioning procedures, and contracting-office points of contact.
Marketplace purchases are permitted only for approved in-scope solutions under task orders, within established not-to-exceed ceilings, after formal approval by the IDIQ Contracting Officer and Contracting Officer’s Representative.
Purchases must be documented, use existing DHS pricing agreements when available, and otherwise demonstrate fair and reasonable pricing, including three quotes when practicable.
Technical requirements include compliance with NIST SP 800-145 and applicable DHS security policies; access to the CSP’s commercial and government cloud regions and current or future service offerings; GSA FedRAMP Low when available; FedRAMP Moderate- and High-authorized services; and the ability to create, configure, and terminate resources within five minutes through infrastructure-as-code, APIs, or GUI workflows.
Offerors must demonstrate:
- At least three years of public-cloud market presence.
- At least $250 million in annual IaaS revenue, excluding managed and professional services.
- At least 100,000 production virtual machines operating simultaneously in the commercial cloud.
The CSP must provide:
- Near-real-time hardware availability.
- Hourly-or-smaller billing increments.
- Direct provisioning without third-party ticketing.
- Scaling to 4,000 virtual instances in under 10 minutes.
- Hundreds of petabytes of storage.
- Databases with at least six terabytes of storage.
- Multizone or multidatacenter deployment.
- A point of presence supporting a direct DHS-network connection of at least 10 GB.
- Geographically distributed redundancy.
- Automated failover.
- At least 99.9% availability, unless a different commercial service-level agreement (SLA) is approved.
The SOW incorporates DHS acquisition and information-security directives and NIST SP 800-145 and SP 800-53 Rev. 5.
Specific additional requirements may be established at the task-order level.
The contract is intended to help DHS modernize and secure more than 600 cloud-hosted systems through an integrated, interoperable, scalable, automated, and secure multicloud ecosystem supporting mission-critical, safety-critical, and life-critical operations, including disconnected or edge environments and emerging technologies such as artificial intelligence, machine learning, and high-performance computing.
Task orders may acquire true on-demand CSP-provided Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), Functions as a Service, Database as a Service, Container as a Service, and other current or future XaaS offerings, but exclude non-CSP third-party reseller services, managed service provider services, and contractor lead-system-integrator development, architecture, implementation, interoperability, and migration work.
The awarded CSP must provide DHS and its Components ownership and administrative control of all relevant tenancies, root accounts, linked accounts, payer or master accounts, and subscriptions; centralized account organization; GUI and API access; raw usage, billing, spend, and Cost and Usage Report data; exports in FinOps Open Cost and Usage Specification (FOCUS) version 1.X or the Government’s current supported version; product catalogs; and tools for cost optimization, commitment discounts, reserved or spot capacity, configuration management, performance monitoring, and security compliance.
CSPs must provide unrestricted access for DHS technical support requests, architectural reviews using applicable Well-Architected frameworks, proactive workload and cost-optimization assistance, a dedicated program manager and support staff, monthly Program Management Reviews, recurring DHS-directed working groups with authorized subject-matter experts, required training for personnel accessing DHS systems, department-wide ordering guides, account-request and provisioning procedures, and contracting-office points of contact.
Marketplace purchases are permitted only for approved in-scope solutions under task orders, within established not-to-exceed ceilings, after formal approval by the IDIQ Contracting Officer and Contracting Officer’s Representative.
Purchases must be documented, use existing DHS pricing agreements when available, and otherwise demonstrate fair and reasonable pricing, including three quotes when practicable.
Technical requirements include compliance with NIST SP 800-145 and applicable DHS security policies; access to the CSP’s commercial and government cloud regions and current or future service offerings; GSA FedRAMP Low when available; FedRAMP Moderate- and High-authorized services; and the ability to create, configure, and terminate resources within five minutes through infrastructure-as-code, APIs, or GUI workflows.
Offerors must demonstrate:
- At least three years of public-cloud market presence.
- At least $250 million in annual IaaS revenue, excluding managed and professional services.
- At least 100,000 production virtual machines operating simultaneously in the commercial cloud.
The CSP must provide:
- Near-real-time hardware availability.
- Hourly-or-smaller billing increments.
- Direct provisioning without third-party ticketing.
- Scaling to 4,000 virtual instances in under 10 minutes.
- Hundreds of petabytes of storage.
- Databases with at least six terabytes of storage.
- Multizone or multidatacenter deployment.
- A point of presence supporting a direct DHS-network connection of at least 10 GB.
- Geographically distributed redundancy.
- Automated failover.
- At least 99.9% availability, unless a different commercial service-level agreement (SLA) is approved.
The SOW incorporates DHS acquisition and information-security directives and NIST SP 800-145 and SP 800-53 Rev. 5.
Specific additional requirements may be established at the task-order level.
Show All