JWCC task order
AWS catalog. A bill that can pay GovCloud this fiscal year. Not occupancy. Not a circuit. Not an ATO.
Do not collapse these
Five planes. Order is the order.
JWCC is the vehicle. The circuit is the pipe. The landing zone is occupancy. Thunderdome is how people arrive. The AO is who signs. A CLIN is none of the last four.
The link to AWS
10 Gig floor. 100 Gig the likely production interconnect. BCAP still protects DISN. Not a JWCC CLIN. Not Thunderdome user HTTPS.
GovCloud landing zone
Control Tower BYO Audit + Log Archive. Test OU is not prod. Hub VPC. SCPs on. Account Factory cannot create accounts here.
How people arrive
SASE to a connector in the mission VPC. ICAM names the person. Catalog names the app. Not the landing zone. Not the pipe.
IATT then ATO
IATT is bounded test. ATO is operations. cATO is Monitor after ATO. IATO is gone. A DISA PA is not this signature.
Engage the vehicle
JWCC buys the right to order. It does not occupy.
Joint Warfighting Cloud Capability — 7 Dec 2022, multiple-award IDIQ, four primes. First occupancy is AWS. A task order on four vendors is four inheritances. Do not wait on JWCC Next to name this CLIN.
Name AWS GovCloud
IL from the data. CUI vs NSS. First occupancy is one prime.
Package to DITCO or your KO
Direct to the CSP. Not a reseller.
Four primes on the IDIQ
Award AWS if that is the door. Catalog membership is not a DISA PA.
Catalog and a bill
IaaS / PaaS the CSO listed at this IL. Labor CLINs do not sign the ATO.
Check DCAS for the offering at this IL. Marketplace listing is not a PA. Yellow on the first-occupancy service list is a redesign, not a hope.
The link to AWS
10 Gig at the floor. 100 Gig more likely.
Size the interconnect from east-west and data-at-rest movement, not from user HTTPS. Thunderdome takes the person to the app. This pipe still carries cloud→DISN, S2S, backup, replication, and anything that is not a published ZTNA app.
10G
Floor · dedicated Direct Connect
Minimum occupancy link
Dedicated 10 Gig into GovCloud. Hosted DX — megabit-class or a leftover 1 Gig — is not first occupancy of a 500–2000 server estate.
100G
Likely · production interconnect
Plan this as the pipe
100 Gig for a midsize estate that will actually occupy: multiple missions, on-prem residual, file, S2S. Dual-homed. Two DX locations. Two BCAP paths.
Not a JWCC CLIN
JWCC pays the CSP catalog. The DISN / BCAP / Direct Connect circuit is a different ticket, a different office, a different bill. SNAP/CPTC is permission to connect. SCCA engineers BCAP. AWS DX is the CSP attachment. Phase Zero names both the TO and the pipe.
Name the design
A LAG of 10 Gig circuits can approach 100 Gig. That is a design you write down — not a silent substitute. One circuit is a finding waiting for a cut. Production ATO wants two paths. MACsec belongs on 10 Gig and above.
The IATT uses the same arrival path production will use. The IATT does not invent a skinny circuit “just for test.”
Request the landing zone
GovCloud Control Tower is not commercial Control Tower.
Account Factory cannot create accounts in GovCloud. CreateGovCloudAccount in commercial, then invite into an independent GovCloud org. Control Tower setup names two existing accounts — Log Archive and Audit. It will not vend them. Then OUs: Security, Sandbox/Test, Prod (SCP-locked empty until ATO).
Orgs, billing, IAM IC
SCPs do not bind here. Keep it empty.
Org trail, Config, VPC flow
Immutable. Government region.
GuardDuty, Security Hub
Delegated admin. Access Analyzer.
TGW, DX / BCAP, shared subnets
No 0.0.0.0/0 user ingress. The 10 Gig / 100 Gig lands here.
IAM IC delegated
SAML to ICAM. ACS signin.amazonaws-us-gov.com/saml.
The occupancy
Workload accounts under test. Not prod. Not management. This is the tenancy the letter names.
SCCA four functions still sit in the LZ: BCAP (protect DISN from the cloud), VDSS (virtual stack around the VPC), VDMS (host and posture — the 03:00 owner reads this), TCCM (a person, not a product). Thunderdome logs are not VDMS. User ICAM is not standing admin.
How people arrive
Thunderdome is the access plane. Not the landing zone.
DISA Thunderdome is Zero Trust network access: enterprise ICAM + IL5-authorized SASE + SD-WAN / CESS. Occupying Thunderdome is not inheriting 152 for this mission system. It is not a JWCC landing zone. It is not the 10 Gig / 100 Gig pipe.
User / CAC→Thunderdome SASE + ICAM→Connector in mission VPC→App
User → SASE → connector → mission VPC
Direct to the published app. No DODIN hairpin as production. Path-trust is SNAT. Identity-trust is the ICAM assertion. The app refuses every other user door.
On-prem / DISN → BCAP → hub → TGW → mission VPC
S2S, replication, backup, file — anything that is not a published ZTNA app. The 10 Gig floor / 100 Gig likely lives here. Users should not ride this as production.
The app trusts the path
Permit at Thunderdome. Tunnel to the connector in this IL VPC. Security groups: connector only.
The app trusts the person
SAML/OIDC from ICAM. IAM Identity Center is a relying party. No active identity — the app denies even if the path already permitted.
The LZ refuses every other user path
No 0.0.0.0/0. No public user ingress. No IAM user as production. A second door makes the permit theater.
Pick one user PEP. Do not stack Thunderdome and a BCAP hairpin as two production user paths. Cloud→DISN and S2S still BCAP even when people arrive via SASE.
Other missions
Other mission users sit in other VPCs.
A published catalog is not a mesh of trust. Mission A does not see Mission B because they share an org. Thunderdome publishes apps, not subnets. East-west goes through inspection. Reciprocity is written, not assumed.
TGW · DX / BCAP attachment · shared endpoints
The 10 Gig / 100 Gig lands here. No workloads. No users. Missions consume the pipe; they do not each order a DX.
East-west and north-south
Network Firewall or GWLB + NGFW. Between missions, and out to DISN. A drawing is not VDSS.
IAM IC · endpoints · DNS
Shared services are not a mission. Federation to ICAM lives here. PAM / TCCM still on the IL.
ZTNA connector · this ATO
Security groups: connector only. Residual keys, 03:00. Testers occupy this VPC on IATT. Production users occupy it on ATO.
Different catalog · different residual
Other mission users arrive to other published apps. Peering that flattens A into B is a finding, not a convenience. They do not inherit this ATO.
- One C-ITP, one occupancy VPC (or account). Shared services are not a mission.
- TGW + inspection for east-west. No mesh of VPC peering that makes micro-segmentation theater.
- Thunderdome publishes apps, not subnets. Mission A users do not get Mission B in the catalog unless ICAM group and app owner say so.
- Other missions do not inherit this ATO. Reciprocity is written, not assumed.
Who signs
IATT, then ATO, then cATO. IATO is gone.
DoDI 8510.01: IATT is granted only when an operational environment or live data is required to complete specific test objectives, and expires when testing completes. Operate with ATO or IATT. There is no third letter that lets you run production while the package is unfinished.
Bounded test
Time, testers, data, environment, exit. Testers occupy the test OU the way production will arrive — SASE to the connector, DX/BCAP for systems.
Risk decision on this mission
Production users. Live CUI if categorized. Residual named. A DISA PA is not this. Thunderdome 152 is not this.
After ATO
Continuous monitoring, active defense, an approved DevSecOps design. Does not replace the ATO. A pipeline is not a cATO.
Sequence to first occupancy
Order
JWCC task order. AWS GovCloud. IL on the PA named.
Pipe
10 Gig dedicated named. 100 Gig the likely production path. Dual-home before ATO.
Vend
Org + LZA. Test OU separate from prod. SCPs on.
Bound
SCCA four functions. Identity as RP to ICAM. Connector in the test VPC. No public user path.
Ask
Categorize + Select. IATT request + test plan. Conditions the AO can sign.
Occupy
Testers only. Same arrival path production will use. Watch both planes — SASE and DX.
IATT conditions: duration (expires when objectives complete), named testers (not the enterprise), data (test data unless the AO authorizes live), environment (test OU, not management), exit (ATO package or DATO — IATT is not a parking lot). CPTC on an IATT is typically ≤90 days and is not operations.
Phase Zero leaves these named
Awareness, not performance.
Six weeks names the door. It does not submit DAPPS, register SNAP, engineer BCAP, or occupy GovCloud — unless the artifact is already on this laptop, in which case we read it.
Buy vs connect vs arrive
DITCO, SNAP/BCAP, Thunderdome. Three tickets. One RACI.
10 Gig floor · 100 Gig likely
Dual-home. Not a CLIN. Sized from data, not from user HTTPS.
DCAS then the eight services
The CSO at this IL. Yellow is a redesign.
SNAP object · UII name
Not the task order. Not twelve bases. Not Thunderdome.
Hub, inspection, this mission, others
Who inherits what. 03:00 per C-ITP.
One prime · test OU · exit
Testers. Data. IATO not on the paper.
Refuse these collapses
What this paper is not.
The offering may host. This mission may not, yet.
How people arrive. Not what they occupy.
User HTTPS is not replication, S2S, or cloud→DISN.
Other missions sit in other VPCs. A flat enclave is a finding.
The letter is gone. Operate with ATO or IATT.
First occupancy is AWS. Four inheritances is a later year.
cATO is Monitor after ATO. The memo is 3 Feb 2022.
This paper stops at IL5. Secret is a different realm.