The Pentagon is building the next version of its enterprise cloud, and the opening piece carries a ceiling of $21.6 billion. To find the hyperscale cloud providers that will anchor it, the Defense Information Systems Agency (DISA) issued the JWCC UCM Core solicitation.
If your firm sells, supports, or builds on the cloud, this ranks among the largest defense IT opportunities on the board right now. And even companies that cannot bid as a prime still have a real way in, through subcontracting and small business participation.
This guide walks through what the JWCC UCM Core contract is, what the solicitation actually says, where the deadline sits, and how contractors can position for it. Every figure below comes from the official solicitation on SAM.gov.
What Is JWCC UCM Core?
JWCC is short for Joint Warfighting Cloud Capability, the Defense Department’s enterprise cloud program. UCM stands for Unified Cloud Marketplace, the model DISA has chosen for the follow-on effort. “Core” is the first and foundational part of that marketplace.
The Core piece handles the hyperscale cloud requirement. Put simply, it is the layer that brings in the large commercial cloud platforms capable of running defense workloads at enormous scale.
DISA has been clear that this is only the first of its UCM solicitations. The agency notes that the current posting covers the Core hyperscale requirement alone and that details on other JWCC UCM opportunities will come later. A separate marketplace solicitation is expected down the road.
How It Differs From the Original JWCC
The first JWCC contract, awarded in 2022, divided work among a small group of major cloud providers. UCM Core is the planned successor, and it is far bigger in dollar terms.
This time, the structure is a marketplace. The idea is to let defense customers buy cloud services across providers more easily, with room to add capabilities as needs change.
Why This Contract Matters
A ceiling this large tells you how central the cloud has become to defense operations. The program is meant to carry workloads across the military for years, from routine administrative systems to classified mission data.
For the GovCon market, that scale shifts the math. A single marketplace this size draws in a long chain of partners, integrators, and specialists. No prime can deliver every service alone, so demand flows down to firms with niche skills in security, migration, and managed support. Even a modest slice of a $21.6 billion program is real work.
The Numbers That Matter
Here are the core facts from the solicitation, as stated in the official documents.
| Item | Detail |
| Contract ceiling | $21,600,000,000 (not to exceed) |
| Minimum guarantee | $100,000 |
| Issuing agency | DISA (Defense Information Systems Agency) |
| Notice ID | 852571198 |
| Solicitation number | HC105026R0001 |
| Contract type | Indefinite-Delivery/Indefinite-Quantity (IDIQ) |
| Task orders | Firm-Fixed-Price under FAR Subpart 16.5 |
| NAICS code | 518210 (Computing Infrastructure Providers) |
| Set-aside | None (full and open) |
| Original proposal due date | October 6, 2026 (being extended) |
The $21.6 billion figure is a ceiling across all task orders, not a guaranteed payout. Actual spending depends on how much the government orders over the life of the contract.
One point worth flagging up front: this is a full and open competition. The solicitation lists no set-aside, so it is not reserved for small businesses at the prime level.
What the Contract Buys
The contract is designed to deliver cloud across both unclassified and classified environments. The solicitation sorts the work by security impact level.
- Unclassified cloud (Impact Levels 2, 4, and 5): Commercial-style cloud services, including tactical edge options, ordered from the Core service catalog.
- Secret classified cloud (Impact Level 6): Cloud services for Secret-level workloads.
- Support packages: Advisory and assistance services, help desk, training, and documentation that sit alongside the cloud offerings.
Task orders are consumption-based, so the government pays for what it uses, with a time-and-materials option where it fits the work. That is the same pay-as-you-go model that defines commercial cloud.
How Long the Work Runs
The contract runs on a base ordering period plus option periods, and task orders can be issued during that window.
Performance can reach beyond it. Under FAR 52.216-22(d), work on a task order issued before the ordering period closes may continue up to five years past the contract’s expiration date. The trade press has put the overall horizon at roughly ten years.
Where the Deadline Stands Right Now
This part is moving, so confirm it before you plan around any date.
Proposals were first due on October 6, 2026. Then, on September 22, 2026, DISA posted a Notice of Intent to Extend the proposal due date. The notice says plainly that proposals will no longer be due on October 6.
As of early October 2026, DISA has not posted the revised date. The agency says the new submission date and time will arrive in an upcoming amendment, released on SAM.gov together with its answers to industry questions. If you are tracking this one, keep an eye on the SAM.gov notice for that amendment.
The Small Business Angle Most Coverage Misses
Since this is a full and open competition, much of the reporting treats it as a contest among the big cloud providers. That framing misses where most GovCon firms will actually compete.
The solicitation requires offerors to submit a Small Business Participation Plan and a Small Business Subcontracting Plan. DISA even folds an Office of Small Business Programs subcontracting checklist into the package.
So the winning primes will need subcontractors and small business partners. For a specialized firm, the opening is not the prime award. It is a subcontracting or teaming role in cloud engineering, cybersecurity, migration, help desk, training, or documentation support.
If that sounds like your capabilities, the move is to position with the likely primes now, not after the award.
How to Position for JWCC UCM Core
A program this size rewards early, deliberate positioning. These steps help whether you aim to prime, subcontract, or support.
- Confirm your fit. Match your past performance to the service areas: hyperscale cloud, Impact Level work, cybersecurity, or support services.
- Target teaming partners. Pin down the primes most likely to bid and open teaming conversations before the revised deadline.
- Sharpen your capability statement. Make your cloud and defense credentials easy for a busy capture lead to scan.
- Tighten past performance. Gather relevant contracts, CPARS records, and clearance details so partners can vet you fast.
- Track the amendment. Follow the SAM.gov notice for the revised proposal date and the government’s answers to questions.
How CyberX Gov Solutions Can Help
Earning a role on a program like this takes a sharp proposal and the right people ready to deliver.
CyberX Gov Solutions supports contractors through proposal development, including compliance mapping, win themes, and the writing effort for prime or subcontractor bids. When a cloud contract calls for cleared professionals, our cleared recruitment team helps you staff Secret and higher roles for pre-award and post-award needs. And for firms newer to the federal market, Get Fed Ready™ helps build the readiness to team on opportunities like this one.
The aim is simple: help you compete for the work that fits, with a proposal and a team that holds up under evaluation.
Conclusion
JWCC UCM Core stands among the biggest defense cloud opportunities in the market, with a $21.6 billion ceiling and a marketplace model meant to shape DoD cloud for years. The prime competition is full and open, yet the subcontracting and participation requirements open real doors for specialized firms.
The proposal deadline is being extended, so the smart play is to use the extra runway. Confirm your fit, line up teaming partners, and get your past performance and people in order.
If you want help positioning for JWCC UCM Core or responding to a live cloud opportunity, CyberX Gov Solutions can support you from readiness to submission.
Schedule a free consultation at cyberxgovsolutions.com/schedule-a-meeting/.
Frequently Asked Questions
Who can bid on the JWCC UCM Core contract?
The solicitation is a full and open competition with no set-aside, so it is aimed at cloud providers that can meet the hyperscale requirement. Smaller firms can still take part through subcontracting and small business teaming, which the solicitation specifically asks offerors to plan for.
How much is the JWCC UCM Core contract worth?
The contract carries a ceiling of $21.6 billion across all task orders, with a minimum guarantee of $100,000. The ceiling caps potential spending; it is not a guaranteed amount.
When are proposals due for JWCC UCM Core?
Proposals were originally due October 6, 2026, but DISA posted a notice on September 22, 2026, stating it intends to extend that date. The revised date will appear in an upcoming amendment on SAM.gov, so offerors should monitor the notice.
What is the difference between JWCC and JWCC UCM?
JWCC is the Defense Department’s enterprise cloud program, first awarded in 2022. JWCC UCM, or Unified Cloud Marketplace, is the planned follow-on built as a marketplace, and UCM Core is its first and largest solicitation.
What are cloud impact levels?
Impact Levels are Defense Department categories that set security requirements for data in the cloud. JWCC UCM Core covers Impact Levels 2, 4, and 5 for unclassified work and Impact Level 6 for Secret classified work.
Which agency manages JWCC UCM Core?
The Defense Information Systems Agency (DISA) issues and manages the solicitation. The contracting office handling the procurement is based at Scott Air Force Base in Illinois.
