WASHINGTON — The Department of Homeland Security has set a seven-week schedule to award a $626 million contract that would consolidate network, cloud and cybersecurity operations across the entire department under a single vendor. The final solicitation is due Oct. 1, and DHS anticipates an award in late November.
The Network, Cloud and Cybersecurity Services 2.0 procurement, known as NCCS 2.0, is a single-award, department-wide indefinite-delivery, indefinite-quantity contract with a five-year ordering period. The DHS Office of Procurement Operations is running the competition on behalf of the Office of the Chief Information Officer. Industry questions on the final draft solicitation were due Sept. 22.
The contract would replace an arrangement that DHS has described as fragmented. The department wants “one centralized hub for IT service management functions across all of the department’s network infrastructure, cloud and platform services, and cybersecurity operations,” work currently divided among headquarters and component-level organizations under several contracts.
A Schedule With Little Slack
The timeline leaves unusually little room between milestones. DHS plans to release the final solicitation Oct. 1, with Phase 1 proposals due Oct. 6. That is a five-day window, and it includes a weekend.
The department expects to notify bidders advancing to the second stage on Oct. 9, with Phase 2 proposals due Oct. 21. From the release of the final solicitation to the anticipated award in late November, the entire competition runs roughly seven weeks.
For a department-wide vehicle of this size, that compression shifts the real work earlier. Bidders who wait for the Oct. 1 solicitation to begin assembling a response will have five days to produce a Phase 1 submission. Teams that have been tracking the requirement since the request for information, which drew responses in March, are positioned very differently from those entering now.
The Clearance Gate Does the Filtering
The structure of the evaluation matters as much as its speed. Phase 1 is a pass/fail gate that turns on a single question: whether the bidder holds a facility clearance. Reporting on the draft solicitation indicates a Top Secret facility clearance is required to advance.
Only bidders who clear that threshold reach Phase 2, where DHS evaluates prior experience and references, staffing and management approach, and price.
The competition is formally full and open. In practice, a pass/fail clearance gate at the front end narrows the field to contractors that already operate a cleared facility. A facility clearance cannot be obtained inside a five-day proposal window, so the requirement functions less as an evaluation factor than as a precondition that was effectively settled long before the solicitation drops.
What the Winner Actually Runs
The scope centers on the DHS Network Operations Security Center, which the department describes as responsible for “identifying, detecting and mitigating cybersecurity threats” across its networks. The NOSC operates in two tiers: Tier 1 handles initial detection and triage, and Tier 2 coordinates incident resolution.
The winning contractor would provide Tier 1 and Tier 2 operational staffing on a 24/7/365 basis, covering cybersecurity monitoring, log management, incident response, threat intelligence, penetration testing and vulnerability management. The work supports OneNet, the DHS enterprise wide-area network, along with component local-area networks.
DHS has identified NOSC facilities in three locations: the National Capital Region, Mississippi and Arizona. An earlier request for information described the requirement as “the full range of cybersecurity, network operations, management and other professional support services.”
An Incumbent on a Bridge
Leidos currently holds the core NOSC support work on a short-term bridge order. General Dynamics IT and Peraton hold pieces of adjacent legacy contracts that NCCS 2.0 would absorb.
A bridge arrangement gives the incumbent operational familiarity but no long-term position to defend, and the consolidation means the eventual winner takes scope that is presently split across at least three companies. For the two contractors holding adjacent work rather than the core bridge, the consolidation presents a straightforward choice: win the single award or exit the mission.
DHS has pursued this requirement before. The department issued a comparable solicitation in January 2024 valued at more than $594.3 million, and conducted market research on similar services in 2022. The current effort is the furthest along of those attempts.
The Automation Clause
One element separates NCCS 2.0 from a conventional operations-and-maintenance recompete. DHS expects solutions to incorporate agentic AI to automate low-level responses to IT issues, freeing staff for higher-value threat detection and analysis.
That expectation cuts against the traditional economics of a staffing-heavy contract. Tier 1 operations are exactly the repetitive, high-volume work that automation targets first, and Tier 1 staffing is also where a bidder would normally build billable headcount. A vendor proposing aggressive automation may reduce its own labor base; one proposing minimal automation may not meet the stated requirement. How bidders resolve that tension in their staffing and management approach is likely to be a meaningful discriminator in Phase 2.
What Bidders and Observers Should Watch
With the final solicitation days away, several questions remain open:
- Whether the Oct. 1 date holds. Federal solicitation dates slip routinely. A delay would relieve the five-day Phase 1 crunch but compress the back end against the late-November award target.
- How the clearance requirement is written in final form. The precise clearance level and the date by which it must be held will determine the size of the eligible field.
- Whether small-business participation appears through subcontracting. A single-award, clearance-gated IDIQ leaves team composition as the primary route for smaller firms.
- How DHS evaluates the automation requirement. Agentic AI expectations stated in a draft do not always survive into measurable evaluation criteria.
- Whether the award survives protest. Single-award consolidations that displace multiple incumbents carry elevated protest risk, and a sustained protest would extend the bridge.
DHS has built a schedule that rewards contractors who prepared during the request-for-information period and penalizes those reacting to the solicitation itself. Whether the department can move from a final solicitation on Oct. 1 to an award in late November, with a two-phase evaluation in between, will be the first real measure of whether the compressed timeline was realistic or aspirational.
