The vehicle · not the landing
JWCC lets you order from a prime. It does not put you in the cloud.
A task order is a catalog and a bill — IaaS, PaaS, SaaS, marketplace software, labor, and edge if that prime listed them. Landing zones, connections, and authorizations are separate work. Hygiene first. Occupancy is the point.
What you can order
Six families. Direct from the CSP. Not a reseller.
iaasIaaSCompute, storage, network. Elastic infrastructure the mission can consume.Still: You still stand the landing zone, place SCCA, and get the AO to sign test.
paasPaaSManaged databases, containers, messaging, analytics the CSP operates.Still: The offering must be on the PA service list at this IL. Yellow is a redesign.
saasSaaSCSP-hosted applications. A different SNAP object than IaaS.Still: Twelve bases are on-ramps to one C-ITP, not twelve apps.
mpMarketplace / third-partyThe current vehicle was modified so ecosystem software can ride the same TO. Listings update.Still: A marketplace listing is not a DISA PA. Candidate ≠ authorized.
psProfessional servicesLabor CLINs: cloud support, migration, architecture help to occupy.Still: They do not sign the ATO. They do not register SNAP.
edgeTactical edgeThe vehicle goal is headquarters to the edge — Outposts / Snow / modular DC, Azure edge, Oracle Roving Edge.Still: First occupancy for an on-prem midsize estate is usually not edge. IL6 / SIPR stays out of this kit.
Three lists
On the TO. On the PA. First occupancy. Do not collapse them.
toOn the task orderThat prime's JWCC catalog. IaaS / PaaS / SaaS, marketplace, labor, edge — at the ILs they listed. Microsoft publishes monthly. Others refresh on their cadence.
paOn the DISA PAService-by-service in DCAS at this IL. The company is not the offering. The offering is not your mission ATO.
firstFirst occupancyThe eight services this mission will actually call. Mark them against the PA. Yellow is a redesign, not a hope.
Not this catalog
Commercial SKU parity is a hope. DCAS is the check.
- Not Commercial SKU parityGovCloud / Azure Government / Assured folder / Defense Cloud is a shorter list. Confirm the CSO.
- Not Every CSO at every IL'All classification levels' is the vehicle goal. Secret and TS exist on JWCC. This kit stops at IL5.
- Not Marketplace as PAThe 3P mod lets ecosystem software ride the bill. Reciprocity is still DCAS.
- Not The follow-on as this CLINUnified Cloud Marketplace / JWCC Next is the successor. First occupancy is the Dec 2022 vehicle.
7 Dec 2022 · multiple-award IDIQ · AWS, Microsoft, Google, Oracle
The task order is a catalog and a bill.
idiqThe vehicleCompete a task order among the four primes. DITCO or your KO. DAPPS / HaCC package. Direct to the CSP — not a reseller.
catalogThat prime's catalogIaaS / PaaS / SaaS and professional-services CLINs the CSP put on JWCC, at the ILs they actually hold.
priceCommercial pathContracted rates and the bill. Consumption is visible if you tag it. Showback is still yours.
edgeEdge / classifiedOnly if that prime's JWCC catalog has the offering. The IDIQ's 'all classification levels' is the vehicle goal, not every CSO.
- Not Landing zoneControl Tower, Azure LZ, Assured folder, OCI tenancy — you still stand it up.
- Not SNAP / CPTCPermission to connect is a different DISA office than the KO.
- Not SCCA / BCAPThe circuit and the stack. Not a CLIN on the TO.
- Not ICAM federationThe person is not in the catalog.
- Not IATT / ATOThe AO signs. The CSP PA is not that signature.
- Not ThunderdomeAccess plane. Separate occupancy.
- Not Cloud IaC appliedDISA templates exist. Applying them is work.
- Not All four primes occupiedA TO on four vendors is four inheritances. First occupancy is one prime.
- Not The PA service listCatalog membership is not a DISA PA. Check DCAS.
Four primes · IL5 floor
Same vehicle. Four partitions. First occupancy is one.
GovCloud (US)AWSPhysical government community. Independent org from commercial.Control Tower BYO Audit + Log Archive. Account Factory cannot create accounts.Service availability ≠ commercial. Confirm the CSO list in DCAS.
Azure Government / DoD regionsMicrosoftPhysical gov. IL5 isolation guidelines on top (dedicated hosts, ANF, CMK).Landing zone in the gov tenant. IL5 isolation is extra configuration, not the region name.Commercial Azure is not the path. DoD regions ≠ US Gov regions — name which.
Assured Workloads Data Boundary for IL5GoogleSoftware-defined community cloud. Not a GovCloud-style physical partition. The AO still accepts that.IL5 folder. US regions. CMEK. Enhanced/Premium. US-person support.The PA is a service list inside the folder. Filestore ≠ GCS. Confirm SMB vs NFS.
Oracle US Government / Defense CloudOracleDedicated government realms. IL5 PA on the Defense Cloud. Classified is a different realm.Tenancy in the DoD realm. Compartment design is the LZ analogue.Do not mix commercial OCI with the Defense Cloud and call it IL5.
DISA
Buy from DITCO. Connect through SNAP. They are not the same ticket.
DITCO / your KO · Buy
The vehicle. A bill that can pay the IL this fiscal year.
SNAP / RACD · Connect
Permission to connect the Cloud IT Project to DISN via BCAP. CPG Appendix C.
BuyDITCO / your KO
- Need / PWS
- DAPPS / HaCC package
- Compete the four
- Task order
- CLIN live
ConnectSNAP / RACD
- C-ITP named
- CSO in DCAS at this IL
- IATT or ATO letter
- SNAP package
- CPTC → BCAP
The mission's cloud project SNAP registers — an application, enclave, data set, or service onboarded into a provisionally authorized CSO. Name it the same as the UII / investment name. Not the JWCC task order. Not the CSO. Not Thunderdome. Not twelve bases.
moMission ownerPM / FSM. Categorizes, assesses, authorizes the C-ITP. Owns the SNAP package.
csoCSOThe CSP product (IaaS / PaaS / SaaS) with a DoD PA at this IL. Listed in DCAS. Registered in SNAP (IL4/5) or SGS (IL6).
caoDISN CAOReviews the SNAP registration. Issues Cloud Permission to Connect.
sccaSCCA PMOEngineers the BCAP/ICAP connection after CPTC. Optional VDSS/VDMS is extra.
- C.1Initiate
- C.2PA check
- C.3Network hygiene
- C.4ADD
- C.5SNAP / SGS
- C.6CPTC
- C.7–C.8CAP
- C.9Onboard
C.1InitiateName the C-ITP. Pick IL from the data (CC SRG §3). Pick CSO, deployment model, service model. This is planning — not SNAP yet.
C.2PA checkDoes this CSO hold a DoD PA at this IL? DCAS for IL4/5/6. SNAP already has current CSOs. No PA → sponsor the CSO or ask DoD CIO for exception. Do not invent an IL5 path on an IL4 offering.
C.3Network hygieneNIC IP space (IaaS/PaaS) or government enclave ranges (SaaS). PPSM tracking ID. NIPR DMZ whitelist if traffic hits the internet. CSSP aligned per DoDI 8530.01. Without these, CAO will bounce the package.
C.4ADDAO signs ATO or IATT. IATO is gone. IATT is test only — CPTC on an IATT is typically ≤90 days and is not operations. ATO required before the C-ITP goes operational in the CSO.
C.5SNAP / SGSRegister as Mission Owner (Cloud IT Project). Unclassified IL2/4/5 → SNAP (snap.dod.mil, CAC, DD 2875). IL6 → SGS. Upload ADD, topology (Appendix E), CSSP agreement, consent to monitor.
C.6CPTCDISN CAO reviews PA, CAP path, package sufficiency. Issues Cloud Permission to Connect. For DISA BCAP this notifies SCCA PMO. For IL2 or a Component CAP, CPTC may only acknowledge registration. Typical review: about five business days if the package is complete.
C.7–C.8CAPIL4/IL5 off-premises commercial CSO → BCAP. On-premises CSO with an external management plane → ICAP. IL2 may use NIPR IAP. SCCA onboarding form; DISA engineers the path. Thunderdome does not replace this for cloud→DISN.
C.9OnboardC-ITP lands on the CSO. Then sustain: keep SNAP current, CSSP live, ADD/PA unexpired. Expired ATO or PA is a temporary disconnect, not a paperwork exercise.
Phase Zero launch
Five artifacts. Start DISA. Sit with the AO. Keep the road on the long paper.
- 1Two on-ramps, two owners
- 2PA service list vs first occupancy
- 3Named Cloud IT Project
- 4Three-column inheritance the AO can mark
- 5One-prime IATT constraint set
Artifact 1Two on-ramps, two ownersOne-page on-ramp RACI: KO, SNAP PO, CSP TAM, ISSM. Dates, not aspirations.Name the KO path (DITCO / DAPPS) and the SNAP path (C-ITP / CPTC / BCAP). Sequence them. A signed TO with no SNAP identity cannot connect. A SNAP package with no CLIN cannot pay.
Artifact 2PA service list vs first occupancyService × PA matrix for one prime. First occupancy only.Do not write 'the CSP is IL5.' List the eight services the first occupancy will actually call. Check them against DCAS / the PA catalog for that prime. Yellow is a redesign, not a hope.
Artifact 3Named Cloud IT ProjectC-ITP charter: name, boundary drawing, categorization, people.Boundary, data types, IL, AO, ISSM. This is what SNAP registers and what the AO authorizes. Twelve bases are on-ramps to one C-ITP, not twelve projects — unless the data and AO say otherwise.
Artifact 4Three-column inheritance the AO can markInheritance sheet. Residual named in verbs, not 'TBD.'CSP PA · access plane (SCCA and/or Thunderdome) · mission residual. Reciprocity is not automatic. The PA is not the ATO. One page, first occupancy, written so the AO can initial each column.
Artifact 5One-prime IATT constraint setDraft IATT conditions + Cloud Foundation RACI. The AO edits; they do not invent.Which prime. Which OU / folder / compartment. Which one site or share family. Duration, testers, data, exit. Who is 03:00. Who sits at the DISA table. Do not occupy four CSPs in Phase Zero.
Leave with the sponsor
These five leave with the sponsor at the end of six weeks. They are enough to start DISA and to sit with the AO. They are not the 48-month road.
Stay on the long paper
Factory, cATO, four landing zones, OSCAL, FinOps Run — those stay on the long paper. Launch does not wait for them.
JWCC Next / Unified Cloud Marketplace is the follow-on. First occupancy is this vehicle. Do not wait on the successor to name a CLIN.