What Is the JWCC Contract? Vendors, Ceiling, and Task Orders

The JWCC contract, formally the Joint Warfighting Cloud Capability, is a multi-vendor Department of Defense cloud computing agreement worth up to $9 billion that lets military organizations buy commercial cloud services from Amazon Web Services, Google, Microsoft, and Oracle. Awarded in December 2022, it replaced the canceled single-vendor JEDI program and runs through December 7, 2027 if both option years are exercised. Roughly $2.3 billion in task orders had been issued against the $9 billion ceiling by early 2025.

The Four Vendors and Why the Pentagon Went Multi-Cloud

The contract holders are Amazon Web Services, Google Public Sector LLC, Microsoft, and Oracle.¹ Each had to demonstrate the ability to deliver cloud services across every DoD classification and impact level at the time of award.²

JWCC replaced the Joint Enterprise Defense Infrastructure (JEDI) contract, a $10 billion single-vendor effort the Pentagon canceled in July 2021 after years of bid protests between AWS and Microsoft. The DoD cited evolving requirements, a more mature commercial cloud market, and the need for multi-cloud environments as reasons the single-vendor approach had become obsolete.³ Under JWCC, the four providers compete for individual task orders rather than sharing a fixed slice of the pie, which keeps them competing on price and capability throughout the life of the contract.

What the Contract Covers

JWCC delivers cloud services across the full spectrum of DoD data sensitivity, organized by Impact Levels (ILs):

Impact Level 2 covers publicly releasable DoD information with low confidentiality requirements.
Impact Level 4 handles Controlled Unclassified Information, such as data marked “For Official Use Only.”
Impact Level 5 covers higher-sensitivity CUI and National Security Systems, including intelligence activities, military command and control, and weapons systems.
Impact Level 6 is reserved for classified information up to SECRET, which requires dedicated infrastructure physically separated from commercial networks.

Every vendor must deliver services at all four levels.² At Impact Level 6, the cloud infrastructure sits in facilities approved for classified processing and is completely isolated from the provider’s commercial environment, both physically and at the network layer.

Tactical Edge and Disconnected Operations

The contract explicitly requires vendors to deliver services at the tactical edge, meaning forward-deployed locations where network connectivity is unreliable, contested, or entirely unavailable. The Performance Work Statement uses the term “DDIL” for disconnected, disrupted, intermittent, and limited bandwidth conditions.² Edge devices must function as if connected, running data analytics and machine learning workloads locally when the link drops, and must support configurable synchronization when connectivity returns, with controls over bandwidth and priority.

In practical terms, providers ship ruggedized, portable hardware designed for field conditions. Oracle markets its “Roving Edge” devices for this purpose. The contract also requires field-level repair and replacement options with minimal mission disruption, on the reasoning that a hardware failure in a remote location carries higher stakes than a server going down in a climate-controlled data center.

Zero Trust Security

JWCC operates within the DoD Zero Trust Strategy published in October 2022, which requires every user, device, and network connection to be continuously verified through multi-factor authentication, endpoint checks, and micro-segmentation.⁴ Nothing is trusted by default, even inside the Pentagon’s own networks. The strategy set a five-year implementation timeline from 2022, targeting full adoption across DoD components by roughly 2027. Every JWCC cloud service must align with this framework, which organizes its security model around five functions: identify, protect, detect, respond, and recover.

Contract Ceiling, Timeline, and Spending

JWCC uses an Indefinite-Delivery, Indefinite-Quantity (IDIQ) structure. The government commits to no specific spending amount but sets a maximum ceiling of $9 billion across all four vendors combined.⁵ Money only flows when a military organization issues a task order for specific services.

The ordering period is structured in three parts:

Base period: December 8, 2022 through December 7, 2025 (three years).
Option Period I: December 8, 2025 through December 7, 2026 (one year).
Option Period II: December 8, 2026 through December 7, 2027 (one year).

The option years are exercised at the government’s sole discretion based on continued vendor performance and mission needs.² Individual task orders can use firm-fixed-price arrangements, time-and-materials pricing, or a hybrid, depending on the work.

With about $2.3 billion in task orders issued during the first two-plus years of the base period, spending has run well below the annual pace that would exhaust the $9 billion ceiling. Some of that reflects the time it took to stand up the program and onboard the first wave of military users.

How Task Orders Get Awarded

A task order starts when a military organization identifies a cloud computing need. The default rule is fair competition: the requesting agency gives all four vendors a chance to bid, evaluates them on technical fit and cost, and awards the order to the best-qualified provider.⁶

Sole-source orders are allowed when only one vendor can meet the requirement, typically because it depends on proprietary technology unique to that provider. The GAO has upheld this approach; in 2025 it dismissed a small business protest of a sole-source JWCC task order to AWS worth more than $75 million, noting that only companies holding JWCC contracts are eligible to receive task orders under the vehicle.⁷

The Defense Information Systems Agency (DISA) manages JWCC through its Hosting and Compute Center, which runs a customer portal where military organizations request, provision, and track cloud services.¹ DISA has also built onboarding tools it calls “cloud accelerators” to reduce the friction of getting military workloads onto commercial cloud platforms.

What JWCC Does Not Cover

Application migration sits outside the contract’s scope. The Performance Work Statement is explicit on this point.² If a program office runs a legacy application and wants it in a JWCC environment, the contract provides the destination — compute, storage, networking — but not the refactoring, database migration, or user retraining needed to get it there. That work has to be funded and contracted separately, which has surprised some organizations that assumed JWCC was a turnkey solution. The DoD’s Chief Software Officer has acknowledged the gap, and future contracting strategies are exploring how to bring in small businesses and systems integrators for migration, workload optimization, and security management.

JWCC Next

The Pentagon is already building the successor. Known as JWCC Next, the follow-on contract is expected to launch in the second quarter of fiscal year 2026 (January through March 2026). DISA officials have said the new contract aims to expand the vendor pool beyond the four hyperscale providers, potentially opening the door to third-party cloud companies that build specialized services on top of AWS, Azure, Google Cloud, and Oracle Cloud.

Operational lessons from the current contract are shaping the redesign. Managing cloud resources across four vendors through separate authorization points created inefficiencies, and tracking spending across the enterprise proved difficult. JWCC Next plans to embed financial operations tools, automation, and multi-cloud management capabilities directly into the contract framework.

Task orders already issued under the current contract will run through their individual performance periods, but new orders will eventually shift to the successor vehicle. Program offices with cloud initiatives extending into 2027 and beyond should build that transition into their acquisition planning.

1
U.S. Department of War. Department of Defense Announces Joint Warfighting Cloud Capability Procurement
2
Department of Defense. Joint Warfighting Cloud Capability Performance Work Statement
3
U.S. Department of War. Future of the Joint Enterprise Defense Infrastructure Cloud Contract
4
Department of Defense. DoD Zero Trust Strategy
5
Defense Information Systems Agency. Joint Warfighting Cloud Capability Quality Assurance Surveillance Plan
6
Department of Defense. Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations Volume 3
7
U.S. Government Accountability Office. G2 Ops, Inc.