The Defense Information Systems Agency published a draft performance-of-work statement on May 20, 2026, outlining the architecture for the Pentagon's next-generation cloud contract, officially named the Unified Cloud Marketplace (UCM). The UCM is the designated successor to the Joint Warfighting Cloud Capability (JWCC), the existing $9 billion vehicle held by Amazon Web Services, Microsoft Azure, Google Cloud, and Oracle. For small and nontraditional cloud firms, the draft contains a provision that has never appeared in any prior DoD cloud solicitation: a dedicated entry point reserved specifically for them.
What JWCC Is — and Why It Needs a Successor
JWCC was itself a replacement for the Joint Enterprise Defense Infrastructure (JEDI) contract, awarded in late 2022 to four hyperscale providers after years of protest litigation. It created a multi-vendor marketplace through which DoD components could order cloud infrastructure and platform services, delivering over 200 executed task orders, an average award cycle of 45 days, and capabilities reaching top-secret classification levels. But JWCC was always a bridge, not a destination. The UCM is now the primary Pentagon cloud modernization vehicle for the post-JEDI era.
DISA describes UCM as an evolution beyond the JWCC multi-vendor market — deepening it by adding new vendor tiers, mandating artificial intelligence capabilities across all classification levels, and extending cloud operations into environments where reliable connectivity cannot be assumed.
A Three-Tier Marketplace
The draft establishes a three-tier marketplace that significantly broadens who can compete for Pentagon cloud business.
Tier 1 covers hyperscale infrastructure and platform services. AWS, Azure, Google Cloud, and Oracle are the current incumbents, but the draft leaves room for new entrants who can meet the performance and security thresholds for large-scale government cloud.
Tier 2 covers Everything-as-a-Service offerings — software, platform, and non-hyperscale infrastructure services that complement or run on top of Tier 1 infrastructure. This tier targets enterprise software and managed service providers that hold Federal Risk and Authorization Management Program (FedRAMP) authorizations but are not hyperscale cloud builders.
Tier 3 is the structural innovation. It is reserved for commercial innovators and small businesses offering cloud-based technologies that meet departmental security standards. Unlike prior DoD cloud vehicles, UCM creates a dedicated lane for small and nontraditional firms as direct prime contractors — not just subcontractors to the hyperscale incumbents. That structural change is the most significant contracting opportunity the draft creates for the non-hyperscale market.
AI/ML Requirements Across All Levels
For the first time on a DoD cloud contract of this scale, the draft mandates artificial intelligence and machine learning capabilities at all classification and impact levels — from the unclassified baseline through Secret and Top Secret. Those AI/ML capabilities must also function in denied, disrupted, intermittent, and limited-bandwidth (DDIL) environments. The solicitation calls for services supporting data labeling, model training, and operational AI deployment, and requires that solutions enable data-driven decision-making at tactical, operational, and strategic levels. This directly addresses the operational edge, where forward-deployed units increasingly need AI inferencing capability even when a reliable uplink is unavailable.
Edge Computing at the Tactical Level
The draft's edge requirements are among the most operationally specific in any cloud solicitation to date. Vendors must support cloud operations on man-portable systems, vehicle-mounted equipment, and modular deployable data centers — all operating under DDIL conditions. This requires cloud architectures that can function autonomously, synchronize when connectivity is restored, and withstand field handling in contested environments.
Resilience and Cross-Domain Requirements
The draft imposes stringent resilience requirements. Infrastructure must continue operating through catastrophic failures and active cyberattacks, not just planned maintenance windows. The solicitation calls for secure cross-domain data transfer between disparate networks and classification levels — historically a bottleneck in multi-classification deployments. Vendors will face NSA-certified red team exercises simulating real attack scenarios, meaning security claims will be tested adversarially before award.
Timeline
DISA accepted industry comments on the draft through June 1, 2026, with a separate industry query on XaaS possibilities closing June 4. The final RFP is expected before the end of 2026, with contract awards beginning in 2027. The current JWCC contract remains in place through the transition period.
What It Means for Contractors
Tier 3 is the most significant development in Pentagon cloud contracting for small firms in years. For the first time, there is a dedicated lane — not a subcontracting relationship with a prime, but a direct path to hold prime contract status on a major DoD cloud vehicle. The threshold is real: vendors must demonstrate approved security capabilities, meaning FedRAMP authorization at the relevant impact level and, for classified work, compliance with DoD's Cloud Computing Security Requirements Guide at Impact Level 4 or 5. Firms that have already pursued FedRAMP Moderate or High authorizations are on the right track.
AI and machine learning vendors face a high bar. Demonstrating capability on a cloud console in a clean lab will not be sufficient — vendors must show operability in degraded-network and edge-deployed configurations and be prepared to substantiate claims under adversarial testing. Companies with existing deployments in air-gapped or low-connectivity environments, or experience with the Intelligence Community or Special Operations Command, are best positioned.
The draft and comment period represent the highest-leverage moment in the acquisition lifecycle. Requirements that appear in the final RFP are largely fixed; those shaped during the draft period can still be adjusted. Contractors with relevant capabilities should submit substantive comments on Tier 3 eligibility criteria, security thresholds, DDIL testing protocols, or cross-domain standards. Even though the comment period has closed, firms should engage DISA's industry outreach channels now and be ready to respond to any supplemental RFIs before the final RFP drops.
Practically, firms should assess their FedRAMP authorization status and identify gaps against their target Impact Level. AI/ML vendors should document existing deployments in low-connectivity or classified environments. Every firm interested in UCM should monitor SAM.gov for the final RFP, which could arrive as early as the fourth quarter of 2026.
