70RTAC26R00000004_A0002 - Q-A Matrix.pdf

Question No. Solicitation Reference Question DHS Response

1 SOW 5.1.8, 5.2.7

Once a CSP track is awarded, what is the process and typical timeline for an independent software vendor (ISV) — as distinct from the awarded CSP itself — to have a FedRAMP-authorized SaaS product reviewed and approved by the IDIQ Contracting Officer and COR as an “in-scope” marketplace solution? Is there a standing intake process for ISVs to submit products proactively, or does review occur only reactively once a DHS HQ or Component CO requests a specific solution?

DHS Response - For products already reviewed by Component specific Technology Reference Model (TRM) teams, the process is expected to take roughly 5 business days. New TRM insertions are required to follow Component specific TRM insertion workflows.

DHS representitives are required to demonstrate a marketplace need prior to intake (marketplace approval) being initiated.

2 SOW 5.2.7

Marketplace-approved services must “meet or exceed FedRAMP High, Moderate, and Low (as available)” accreditation. For a SaaS product currently authorized at FedRAMP Moderate, is that sufficient for marketplace-solution approval, or does the required accreditation level depend on the data sensitivity/categorization of the requesting component’s intended use case?

DHS Response - FedRAMP modateate is sufficient for the DHS team to provide a review (intake) of the marketplace solution. DHS representitives are required to demonstrate a marketplace need prior to intake (marketplace approval) being initiated.

3 SOW 5.2.7, 5.2.8

Section 5.2.7 states that terms and conditions for marketplace/BYOL products are “negotiated, executed, and enforceable solely between the Government and marketplace service providers.” Please confirm whether an ISV may contract directly with DHS under a Bring Your Own License (BYOL) model for a SaaS product procured through this IDIQ, or whether all marketplace SaaS purchases must instead flow through the awarded CSP’s standard marketplace billing and EULA terms.

DHS Response - Independent Software Vendors (ISVs) may not contract directly with DHS to procure BYOL licenses within the Cumulus contract but DHS can use BYOL licenses procured outside of Cumulus to be used within CSP marketplace products available through Cumulus

4 Attachment 1

The Attachment 1 pricing model estimates approximately $1.76M in base-year Marketplace Services (CLIN X002) against Product Service Code DA10 (Business Application/Application Development Software as a Service). Is that estimate intended to encompass specialized vertical compliance SaaS applications (e.g., pharmaceutical serialization and supply-chain traceability software), or is it scoped primarily to general enterprise/productivity SaaS categories?

DHS Response - The pricing model is intended to encompass all in scope marketplace solutions. All SaaS solutions including specialized vertical compliance SaaS applications will be evaluated on a case by case basis for scope compliance. DHS representitives are required to demonstrate a marketplace need prior to intake (marketplace approval) being initiated.

5 SOW 5.1.8

Will DHS publish (or has DHS already published) the referenced marketplace-solution approval template that HQ and Component Contracting Officers use to request a marketplace product? If so, may an ISV submit its product for pre-approval consideration ahead of a specific component’s request, and if so, through what channel?

DHS Response - A marketplace approval template has not been published and DHS does not intend on publishing one. DHS representitives are required to demonstrate a marketplace need prior to intake (marketplace approval) being initiated.

U.S. Department of Homeland Security (DHS) Solicitation 70RTAC26R00000004

Amendment 0002 Industry Questions & DHS Responses

6 SOW 5.1.8, 5.2.7

Because the solicitation contemplates separate single-award tracks (Amazon, Oracle, Google, Microsoft) plus a multi-award on/off-ramp vehicle, will marketplace-solution approval need to be sought separately for each awarded CSP track, or does approval of a product on one CSP’s marketplace (e.g., Azure Government Marketplace) extend to that CSP’s task orders specifically, independent of the other tracks?

DHS Response - Marketplace solution requests and subsequent review and approval/rejection will be based on the intake request and will be separate and disctinct per referenced, anticipated award. DHS representitives are required to demonstrate a marketplace need prior to intake (marketplace approval) being initiated.

7 General

Are DHS HQ or Component Contracting Officers able to name a specific marketplace SaaS solution when initiating a task-order-level marketplace request, or must the requested capability be sourced exclusively from what already appears in the awarded CSP’s marketplace catalog at the time of the request?

DHS Response - DHS is able to name specific marketplace SaaS solutions within an intake request at the time a task order is established based on task order level requirements. DHS representitives are required to demonstrate a marketplace need prior to intake (marketplace approval) being initiated. Non marketplace approved SaaS offerings are out of scope of Cumulus.

8 General

What enterprise platform, if any, will be used to orchestrate application and data workflows that span multiple cloud providers rather than relying on individual CSP-native scheduling and automation tools?

DHS Response - DHS does not mandate a single enterprise platform.

9 General

For mission-critical workflows crossing APIs, containers, data services, and multiple security fabrics, how does DHS plan to manage dependencies, failures, recovery, and end-to-end operational visibility?

DHS Response - These capabilities will be evaluated and determined by individual DHS Components based on Component specific requirements at the Task Order level.

10 General

Will DHS Components have the flexibility to select enterprise workload orchestration platforms for Cumulus-hosted applications, or will orchestration capabilities be standardized centrally through the

OCIO?

DHS Response - DHS will have the flexibility to select various enterprise workload platforms based on specific need.

11 General

Is the intent of DHS through this solicitation to competitively pursue additional cloud service providers (CSP) in addition to the named brand name CSPs, Amazon Web Services (AWS), Google Cloud (GC), Microsoft Azure (MS), and Oracle Cloud Infrastructure (OCI)?

DHS Response - This solicitation which is publicly posted (SAM.gov) is a full and open solicitation offered commercially to industry partners who are able to satisfy all solicitation requirements to specifically include those represented within the statement of work.

12 SOW

Previously, DHS has indicated that the Cumulus multi-award IDIQ initiative would include competitive professional services task orders that would be in addition to the brand name cloud service provider (CSP) task orders. Does DHS still intend to pursue this course of action?

DHS Response - DHS Cumulus includes only those anticipated awards represented within publicly available (SAM.gov) Cumulus information and as identified within this solicitation page 15.

13 SOW

If DHS intends to pursue competitive professional services task orders in connection under/in relation to the Cumulus IDIQ, could DHS please advise if it will be full and open for lead system integrators

(LSI) ?

DHS Response - All task order solicitations issued against the anticipated multiple award Cumulus IDIQ executed as a result of this solicitation will be offered to all Cumulus IDIQ contract holders and include only requirements in-scope of the anticipated multiple award IDIQ award.

14 SOW

If DHS intends to pursue competitive professional services task orders under/in relation to the Cumulus IDIQ, could DHS please advise DHS's notional solicitation timeline?

DHS Response - At this time there are no notional timelines associated with potential task order solicitations issued against the anticipated multiple award IDIQ.

15 70RTAC26R00000004 Please confirm that any mutually agreeable Offeror commercial terms / agreements will be incorporated into the body of the solicitation.

DHS Response - Mutually agreeable commercial terms and conditions that the offeror confirms are applied uniformly and consistently to all of its commercial customers (customary commercial practice) may be included within the anticipated multiple award IDIQ as addenda/addedum under Revolutionary Federal Acquisition Regulation Overhaul (RFO) 52.212-4(r) Order of precedence, item #4.

16 SOW 3.0, 5.1.8, 5.2.7 (page 3, 7, 11)

Please confirm the Offerors are not responsible for certifying that third-party marketplace products meet FedRAMP High/Moderate/Low or NIST 800-53 requirements unless the Offeror is the publisher of the service.

DHS Response - Offerors are not responsible for certifying that third party marketplace products meet FedRAMP High/Moderate/Low or NIST 800-53 requirements unless the Offeror is the publisher of the service. DHS notes that the inability to certify product FedRAMP or NIST 800-53 compliance may significantly limit product availability for use. DHS requests that third party marketplace products that do meet FedRAMP or NIST 800-53 requirements be advertised in the CSP's marketplace.

17 Multiple including SOW 5.1.6

The SOW contains multiple requirements for deliverables, tasks, and responsibilities not included in a commercial offering, but does not provide a CLIN for the PMO services. Please confirm 1) that a PMO Task Order will be issued at IDIQ award to cover IDIQ-level program management requirements and 2) the CLIN that the PMO services will be authorized under.

DHS Response - A Task Order is not expected to be issued to cover IDIQ award level in-scope administration activities, management, and overhead expenses.

CLIN x003 - Enterprise Support offers scope coverage and shall be used, as required at the task order level, for PMO services, based on task order level requirements.

Responding vendors shall ensure any costs associated with IDIQ award level in-scope administration activities, management, and overhead expenses including for example SOW section 5.2.6 PMO Support are included within the unit prices of in-scope services provided for under those CLINs represented within this solicitation and its anticipated IDIQ contract award.

18 SOW 5.3.15

Please confirm that the metadata requirements (FIPS 140-3 customer-managed keys, metadata isolation, audit rights up to twice annually, and 24-hour breach / 72-hour root-cause notification) are IDIQ-level commitments, and clarify how they interact with existing FedRAMP continuous-monitoring and incident-response obligations.

DHS Response - SOW 5.3.15 has been updated. Please see latest tracked change SOW

19 SOW 5.2.1

Please clarify whether the five-minute requirement is intended as a best-effort operational objective for supported services or a contractual service-level requirement applicable across all services, regions, quotas, security controls, governance policies, and approval workflows.

Please also clarify whether this requirement applies to:

1) Initial onboarding and establishment of administrative access;

2) Assignment or modification of access permissions;

3) Access to existing accounts, organizational structures, and resources;

4) Provisioning of new cloud resources through existing administrative access; or

5) A contractual service-level commitment for all access requests.

Additionally, please confirm whether commercially available access-control and resource-management capabilities, including role-based access controls, infrastructure-as-code automation, APIs, and administrative portals, satisfy this requirement.

DHS Response - The requirement states "initiate creation, provisioning, configuration, and termination of all resource instances in alignment with the CSP’s commercially available service capabilities". DHS understands that complex operations may exceed five minutes but the requirement is focused on the initiation. This requirement applies to all of the examples listed.

Commercially available access control and resource management capabilities have the capability to satisfy this requirement however distributors of these capabilities need to satisfy all Cumulus requirements for consideration

20 SOW 5.1.3 & SOW 5.2.1 & SF1449

Please confirm whether DHS HQ will have administrative access to all component billing and consumption data, or only to accounts procured under the resulting contract vehicle. Please clarify the Government's desired cloud financial management operating model. Specifically: (1) Does DHS require consolidated cost, usage, budgeting, forecasting, and chargeback reporting across multiple Components, account structures, billing hierarchies, or organizational boundaries? (2) Does DHS expect the awarded CSP to preserve the current organizational and billing structure, or assist with migration to a centralized enterprise billing and cost-management architecture? (3) Are there existing enterprise reporting, FinOps, chargeback, or financial reconciliation platforms that CSP consumption and billing data must integrate with? (4) Is the intent of the requirement to provide access to CSP-native financial management capabilities, or to provide an enterprise-wide financial management solution spanning multiple organizational boundaries?

DHS Response - DHS HQ will have access to all DHS Component billing data through FOCUS / Cost and Usage Report exports provided to HQ by Components in existing workflows. DHS requires each Component to have administrative access to all of their Component billing and subscription data that is able to be easily accessed and maintained by only their Component personnel distinct from other Components. This includes financial management.

1) DHS HQ is not required to have administrative access to all subscription data and does NOT wish to be the sole cloud broker to provide accounts and access to DHS Components.

2) DHS is seeking recommendations on "to be" organizational and billing structure

3) Existing enterprise reporting workflows will remain in place

4) The intent of the requirement is to provide access to CSP native financial management capabilities as well as enterprise wide financial management solutions through existing usage data sharing workflows

21 SOW 5.2.2.1

Please confirm whether a direct CSP-owned network connection at a colocated facility satisfies this requirement, provided the connection meets the required bandwidth and connectivity requirements without reliance on a third-party connectivity provider.

DHS Response - A direct CSP-owned network connection at a colocated facility satisfies the requirement in SOW 5.2.2.1

22 SOW 5.2.2.2

Please clarify whether the requirement for "real-time automatic failover without interruption" applies to every cloud service utilized within the environment, or whether the requirement is intended for mission-critical workloads architected with high-availability, zone-redundant, or multi-region configurations. Further, please clarify whether the intent is for the CSP to provide the capability to architect solutions that support failover objectives, rather than requiring every service to inherently provide uninterrupted failover under all circumstances. Such resiliency objectives are typically dependent upon workload architecture, service selection, deployment design, and operational requirements and may be more appropriately evaluated at the task-order level.

DHS Response - SOW 5.3.2.2 pertains to CSP provided services utilized within the environment and not DHS architected and maintained systems. DHS requests that CSPs provide a list of CSP services that are not capable of "scaling over multiple data centers to provide for real-time automatic failover without interruption to the service..." that have specific region, availability zone or individual data center constraints.

23 SOW 5.3.11

Please revise this requirement to remove the word "all" ("all" CSP provided services) as all services may not support this capability at all times. CSP can meet task order level objectives and recommend the best available solutions in context of task order level requirements.

DHS Response - SOW 5.3.11 has been updated. Please see latest tracked change SOW

24 SOW 5.2.5 Please remove the requirement that SaaS products be available through the Cloud Service Provider (CSP) console.

DHS Response - SOW 5.2.5 has been updated. Please see latest tracked change SOW

25 SOW 5.4.5

The CSP is to limit data-transfer (ingress/egress) costs to a not-to-exceed threshold "agreed to by the CSP and the Government." Please clarify whether this threshold is established at the IDIQ level or the task-order level.

DHS Response - The referenced threshold is established at the IDIQ award level.

26 SOW 8.2 Please clarify what "historic data" means.

DHS Response - Historic data is defined as historic usage, monitoring, auditing and resource data required to accomplish system requirements and maintain existing system operations.

27 SOW 8.4

Please confirm that DHS remains responsible for deprovisioning resources or increasing funding before task-order funding limits are exhausted, and that the awarded CSP is not required to provide services beyond authorized funding levels.

DHS Response - DHS requires awarded CSPs to enforce CSP SLA workflows for notification of critical usage of funds and suspension of services beyond authorized funding levels.

28 SF1449 and 5.2.2.1 Scalability

Please confirm whether the requirement to scale to four thousand virtual instances within ten minutes may be satisfied through an aggregate cloud architecture utilizing multiple scale units, deployment groups, or autoscaling mechanisms across supported regions or availability domains, with required quotas, capacity, networking, images, and automation preconfigured. Please also confirm that the ten-minute measurement applies to the initiation and execution of the scaling request and does not include operating-system initialization, identity integration, policy application, application startup, or end-user readiness.

DHS Response - The requirement to scale to four thousand virtual instances within ten minutes may be satisfied through an aggregate cloud architecture utilizing multiple scale units, deployment groups, or autoscaling mechanisms across supported regions or availability domains, with required quotas, capacity, networking, images, and automation preconfigured.

The ten-minute measurement applies to the initiation and execution of the scaling request and including operating-system initialization, identity integration, policy application, application startup, or end-user readiness.If this requirement is unable to be met, technical limitations need to be clearly represented within the proposal response.

29 70RTAC26R00000004

Regarding "Payment will be made only for charges that are incurred based on the Government's actual consumption of services.", please confirm that DHS is not asking for custom/non-commercial payment terms. For context, certain services such as software and Reserved Instances, are not consumption-based offerings. Commercial terms dictate that payment for them will be based on the subscription entitlement.

DHS Response - DHS is not asking for custom/non commercial payment terms for services such as software and Reserved Instances.

30 70RTAC26R00000004

CSPs periodically update their commercial terms, service availability, and publicly available pricing to reflect new products, updated capabilities, and changing market conditions. Please revise the solicitation to permit Offerors to make such updates during the contract period in accordance with standard commercial practices, subject to the awarded discount structure and applicable notification requirements.

DHS Response - No further solicitation updates are required at this time, where solicitation 70RTAC26R00000004 price factor 3 offers responding vendors the opportunity to further clarify those changes made to it proposed Cumulus portal (hyperlink) in accordance with its commercial practice. For example, factor 3 requests responding vendors to provide clear and concise information regarding the frequency with which updates will be made to the provided link (DHS Cumulus Portal – Your CSP Name) and how those changes will be communicated to DHS.

31 70RTAC26R00000004

Respectfully request the removal of FAR 52.225-1 as only commercial services are being provided, and commercial services are exempt from the Buy America Act.

DHS Response - Referenced terms and conditions will remain as included within the solicitation. Application of 52.225-2 will occur at the Task Order level based on Task Order level requirements.

70RTAC26R00000004 & SOW 9.2

The Government is requesting services for commercial regions which are governed by accreditation standards that do not prohibit support from non-US Citizens. In the context of the referenced HSAR clauses and SOW sections, please confirm (and include in an RFP Amendment) that non-US Citizenship support is permissible as long as it is permitted in the applicable FedRAMP requirements.

Additionally please confirm that U.S. Citizenship requirements listed in these sections not apply to any indirect (non-billable) services.

DHS Response - Non-US Citizen support is permissible as long as it is permitted in the applicable FedRAMP requirements and requirements set forth in section 9 in the SOW. SOW Section 9 requirements apply to any personnel with access to DHS data which may apply to indirect services based on use case. At this time, there are no further revisions required to the referenced SOW Section 9.

33 70RTAC26R00000004

In reference to subparagraph (b), customary commercial contracts do not include a graphical representation or month-by-month data.

Respectfully request the removal of this requirement.

DHS Response - DHS does not require graphical representations of data beyond what is existing in CSP self service options currently.

34 70RTAC26R00000004

According to FAR 52.219-9(g), a commercial small business plan is the preferred type of subcontracting plan for contractors furnishing commercial products and commercial services. Please confirm that commercial small business plans may be submitted in lieu of a Cumulus-specific plan.

DHS Response - Referenced terms and conditions will remain as included within the solicitation.

35 70RTAC26R00000004

As no end products will be provided under this effort, we believe FAR 52.222-18 Certification Regarding Knowledge of Child Labor for Listed End Products is not applicable and respectively request it be removed.

DHS Response - Referenced terms and conditions will remain as included within the solicitation.

36 General Can DHS please provide any documents not posted to SAM.gov?

DHS Response - All documentation supporting the subject solicitation 70RTAC26R00000004 has been included within the SAM.gov solicitation notice publicly posted.

37 SOW 7.1 Can DHS please confirm whether the period of performance requires on-site work in DC?

DHS Response - The place of performance shall be established at the task order level based on task order level requirements. Tasks shall be performed primarily at the CSP’s facility; with limited Government facility access as directed by the task order award and task order level CO and COR.

38 SF1449 Basis for Award – Best Value Source Selection Can DHS please confirm the evaluation basis for proposals?

DHS Response - An award(s) will be made on the basis of best value, please see the Basis for Award section included within the subject solicitation 70RTAC26R00000004.

39 General Can DHS please confirm the scope boundaries for data processing and hosting services under this multiple award vehicle?

DHS Response - Boundries for data processing and hosting services will occur within CSP provided accounts and architectures offered to DHS who will retain root ownership and full administrative control of all resources within these constructs. If a DHS entity wishes to leverage a 3rd party SaaS capability for processing of DHS data, it would have to be done in accordance with anticipated multiple award IDIQ terms and conditions and DHS task order level requirements.

40 SF1449

Can DHS please confirm the proposal response time and date of on or before 2:00pm ET on September 11,2026, as represented within the SAM.gov solicitation and its amendment 0001 is correct?

DHS Response - The proposal response time and date is now on or before 4:00pm ET on September 14, 2026.

41 SF1449 Proposal Submission

Could DHS please confirm whether there are any administrative participation steps that responding vendors should complete in addition to the requirements contained within the solicitation posted on SAM.gov?

DHS Response - All proposal response requirements are identified within the subject solicitation 70RTAC26R00000004 publicly posted on SAM.gov.

42 SF1449 Proposal Submission Can DHS please confirm required proposal response content and proposal submission location?

DHS Response - All proposal response requirements are identified within the subject solicitation 70RTAC26R00000004 publicly posted on SAM.gov.

Referenced Offeror proposal shall be submitted via e-mail to the Contracting Officer

Contracting Officer: Gregory Blaszko Email: Gregory.Blaszko@hq.dhs.gov

The subject line of the e-mail should contain the following:

“Solicitation 70RTAC26R00000004 – Proposal Submission.”

70RTAC26R00000004 - Q&A