Justification FY26-0030_Redacted.pdf

This is a Justification and Approval (J&A) document for a class deviation permitting other than full and open competition for brand name Cloud Service Provider (CSP) services under the Cumulus project (FY26–0030).

The Department of Homeland Security (DHS), Office of Procurement Operations, seeks to procure enterprise-wide, commercially available Cloud Service Provider (XaaS) services—including Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), Functions as a Service (FaaS), Database as a Service (DBaaS), and Container as a Service (CaaS)—through multiple, single-award, indefinite-delivery, indefinite-quantity (IDIQ) vehicles directly with four brand name CSPs: Amazon Web Services (AWS), Google Cloud (GC), Microsoft Azure (MS), and Oracle Cloud Infrastructure (OCI). The procurement will be conducted under FAR Part 12 Class Deviation 25-21 and FAR Part 15 Class Deviation 26-08, with a rolling award schedule spanning FY26–Q2 through FY26–Q4. Single-award IDIQ vehicles will be established with each CSP on a rolling basis, followed by a competitive multiple-award IDIQ solicitation. Contract awards will include firm fixed price (FFP) and firm fixed unit price (FFUP) contract line items, with a total estimated ceiling across all CSPs covering a base ordering period and four optional one-year ordering periods. DHS requires direct account ownership, unrestricted access to billing and usage data, FedRAMP-approved services meeting High, Moderate, and Low security levels per NIST SP 800-53 Rev. 5, minimum 99.9% availability, geographic redundancy across data centers, and 4,000 virtual instance scaling capability. CSP-specific requirements include AWS services (CloudTrail, CloudWatch, DynamoDB, EC2, S3, RDS, VPC, and others), Azure services (App Services, Kubernetes Service, Virtual Machines, Storage Accounts, SQL Database, Microsoft 365, and others), Google Cloud services (BigQuery, Compute Engine, Cloud Storage, Networking, and others), and OCI services (Exadata, Functions, Kubernetes Engine, and Object Storage). The justification emphasizes that brand name restrictions are necessary due to unique CSP-specific architectures, APIs, and interfaces that prevent interoperability, along with significant migration costs and risks estimated at $100 million per system. DHS expects to realize at least $142 million in first-year savings through centralized procurement and volume discounts.