Amazon Web Services secured a contract worth up to $2.56 billion from the Department of Homeland Security on June 15, 2026, under DHS's new Cumulus enterprise cloud acquisition program — the first agencywide hyperscaler award in the department's history, as reported by FedScoop. The single-award, indefinite-delivery/indefinite-quantity contract was posted to SAM.gov the same day and covers the full spectrum of cloud service offerings across all DHS components.
Contract Structure and Scope
The Cumulus IDIQ is structured with a one-year base ordering period and up to four option years, giving it a potential five-year lifecycle and a ceiling of $2.56 billion. The vehicle covers Infrastructure as a Service, Software as a Service, Platform as a Service, Database as a Service, training services, professional services, and marketplace solutions — essentially the full catalog of commercially available anything-as-a-service cloud offerings. All services must be delivered as on-demand, scalable cloud computing resources accessible through a graphical user interface portal, application programming interfaces, or a software development kit.
DHS issued the award as a noncompetitive, sole-source action. That approach was announced in April 2026, when the department disclosed it would pursue a mix of noncompetitive and competitive IDIQ awards to major cloud providers rather than holding a single competitive down-select. By structuring Cumulus as a portfolio of parallel vehicles — one per major provider — DHS retains flexibility to route task orders to whichever provider best fits each mission's technical and cost requirements, rather than locking all components into a single hyperscaler.
To qualify for the Cumulus program, vendors were required to meet stringent technical baseline requirements: simultaneous support for at least 1,000 firewall rules, the ability to provision 100,000 virtual machines, and hundreds of petabytes of storage capacity available across all DHS components. DHS confirmed that AWS met all stated technical requirements and that its commercial cloud environment satisfies the department's security and scale standards.
A Structural Shift for DHS Cloud Procurement
The Cumulus initiative represents a fundamental change in how DHS buys cloud services. Previously, individual DHS components — including Customs and Border Protection, FEMA, the Transportation Security Administration, and others — each procured commercial cloud independently, resulting in fragmented contracts, duplicated costs, and inconsistent security baselines. Under Cumulus, all enterprise cloud procurement routes through a single program office, eliminating the siloed, component-by-component acquisition model that DHS had relied on since its founding.
DHS projects at least $142 million in savings during the first year alone from this centralized model. The projected savings stem directly from consolidating what had been dozens of separate component-level cloud agreements into a single enterprise vehicle with unified pricing and terms negotiated at the department level. Officials have framed the Cumulus program as a lever for standardizing security baselines across DHS's diverse mission components — from border enforcement to disaster response to transportation screening.
DHS first announced the enterprise cloud consolidation strategy in January 2026 and moved to the AWS contract award within approximately five months — a relatively fast acquisition timeline for a program of this scale and value. The April 2026 justification filing for the mixed procurement approach was a key milestone that signaled the department's intent to run separate, parallel vehicles for each major cloud provider rather than conduct a competitive shoot-off. That approach allows DHS to onboard multiple hyperscalers without the delay and legal risk that a single competitive award — and the inevitable protests — would entail.
Follow-On Awards Expected
The AWS contract is the first of at least four expected Cumulus awards. Oracle Cloud Infrastructure, Google Cloud, and Microsoft Azure are each anticipated to receive their own sole-source IDIQs within the next quarter. Every provider will receive a separate IDIQ, meaning Cumulus will ultimately function as a multi-vendor portfolio of parallel enterprise agreements rather than a winner-take-all vehicle. Award amounts for the three follow-on providers have not been disclosed.
DHS has not published a consolidated ordering guide or task order competition procedures for Cumulus, but the structure mirrors other multi-award enterprise cloud vehicles where task orders are placed against individual provider contracts based on mission fit, cost, and technical capability. As DHS components begin issuing task orders against the AWS vehicle, the ordering patterns and requirements that emerge will likely shape how the follow-on Oracle, Google, and Azure vehicles are structured and utilized.
What It Means for Contractors
Subcontracting pipeline is open now. AWS's Cumulus IDIQ will generate task orders covering professional services, integration work, training delivery, and managed services across every DHS component. Small businesses and systems integrators that hold existing AWS Partner Network designations — particularly those with FedRAMP-authorized offerings — are well-positioned to pursue subcontract roles as DHS components begin placing orders. Firms should proactively reach out to AWS's federal business development teams rather than waiting for public subcontracting notices.
Watch for Oracle, Google, and Azure awards in the next quarter. All three remaining providers are anticipated to receive their own Cumulus IDIQs in the near term. Contractors that have built federal offerings on any of those platforms should begin cultivating DHS component relationships now, before task order competitions open. The pattern established by the AWS award — sole-source IDIQ followed by competitive task orders — is expected to repeat for each provider.
FedRAMP authorization is a hard gate. All services delivered under Cumulus must meet federal cloud security requirements. Any contractor planning to deliver managed services, software, or professional services through the Cumulus vehicles will need FedRAMP-authorized offerings or must be operating under an existing agency authorization to operate. Firms without a current FedRAMP package should assess the timeline for authorization before investing in Cumulus pursuit.
Track Cumulus task orders on SAM.gov. Because the base IDIQ awards are sole-source, the public competitive activity will occur at the task order level — particularly for larger, complex orders that may trigger fair opportunity requirements. Contractors should set SAM.gov searches on DHS Cumulus and monitor the DHS Office of the Chief Information Officer procurement forecast for upcoming task order solicitations across CBP, FEMA, TSA, CISA, and other components.
