DHS NCCS 2.0: What to Have Ready Before the October 6 Phase 1 Deadline

What the September 17 NCCS 2.0 draft solicitation asks for, why a 5-day Phase 1 window is not a 5-day preparation window, and what to have ready before the October 1 final RFP.

DHS is putting a single $626M award for network, cloud, and cybersecurity services on a fast track. The final RFP is expected October 1, and Phase 1 responses are due five days later. Five days is enough time to submit a Phase 1 package, but not enough to discover that a teaming partner's facility clearance doesn't cover the bidding entity, or that your strongest past performance reference has a point of contact who's left the agency. This post covers what the draft asks for, which parts of it can knock a team out before evaluation even starts, and what to have verified and loaded into GovEagle before the final solicitation drops.

TLDR:

• DHS released a draft solicitation for NCCS 2.0 on September 17: a single-award, department-wide IDIQ with a $625.996M ceiling.
• The notional schedule: final RFP October 1, Phase 1 (eligibility) due October 6, notification October 9, Phase 2 (evaluation) due October 21, award late November.
• Phase 1 is a hard eligibility gate on active Top Secret facility clearance, plus verified entity names and CAGE codes in NISS/SAM.gov, for your bidding entity and every named JV partner, mentor-protégé partner, and subcontractor.
• Phase 2 comes down to three one-page past performance references, chosen for relevance over familiarity, with no discussions planned.
• Everything is labeled "notional" and can shift, so the work to do now is preparation against the draft: clearance checks, reference selection, and a Phase 1/Phase 2 compliance matrix. So you aren't starting cold on Oct 1.

What is DHS NCCS 2.0?

DHS released the final draft solicitation and a notional acquisition schedule for Network, Cloud, and Cybersecurity Services (NCCS) 2.0 on September 17, 2026 (HigherGov). It's a planned department-wide, single-award IDIQ, competed full and open for one prime award, not a multiple-award vehicle with several seats to fill (OrangeSlices). DHS is targeting an October 1 final solicitation, Phase 1 due October 6, and award in late November. All dates can move.

DHS's comment window on the draft closed September 22 at noon Eastern (abierto.us). Whatever concerns industry raised about the clearance flow-down language, page-limit mechanics, or anything else in the draft will show up, or won't, in the October 1 final solicitation. That's the next real checkpoint, and where your prep should focus now.

Current milestones and deadlines for DHS NCCS 2.0

Phase 1 is planned for 5 days only, and it's an eligibility gate, not the competition. Phase 2 is where DHS actually differentiates offerors, and non-price factors (experience and staffing/management, together) carry significantly more weight than price (Washington Technology). These dates are DHS's own and remain subject to change. Use the draft to organize your evidence now, not to finalize your proposal language.

Act fast | Do before Oct 1

1. Verify active Top Secret facility clearance status in the National Industrial Security System for your actual bidding entity, and separately for every named joint-venture partner, mentor-protégé partner, and subcontractor the draft's submission instructions cover. "We do cleared work" is a different claim than "this specific entity clears."
2. Confirm the official legal name and CAGE code for every entity above matches SAM.gov exactly. DHS verifies against NISS and SAM.gov, not against your capability statement.
3. Shortlist three candidate contract or task-order references performed within the last five years, comparable in size, scope, and complexity, and confirm each reference point of contact is still reachable. Phase 1 notification (Oct 9) to Phase 2 due (Oct 21) is 12 days, and you don't want to spend three of them tracking down a PM who's since left the agency.
4. Build your requirements matrix now, against the draft, split cleanly into Phase 1 eligibility items and Phase 2 evaluation factors. Make October 1 a diff against the final solicitation, not a cold start under a 5-day clock.

Phase 1: Clear every entity

The draft requires an active Top Secret facility clearance, and its submission instructions extend that requirement to proposed joint-venture and mentor-protégé partners and subcontractors. Have your security and contracts leads check the bidding entity itself, not a general sense that "our company does cleared work." Adding a cleared prime or partner to the team doesn't automatically resolve the question for every entity the submission instructions cover. Check each one.

The output you want by end of week is a documented decision: the proposed team meets the requirement as-is, needs a specific clarification before Phase 1, or the pursuit needs to be reconsidered. A disqualifying gap is far cheaper to find now than after a Phase 2 investment.

Phase 2: Pick the right three

The draft asks for three contract or task-order references from the last five years, comparable in size, scope, and complexity, one page each. With that page limit, the selection decision matters more than the writing. Don't default to the three examples your team is most used to citing. Ask which three most directly establish relevance to NCCS's scope, confirm the dates and reference contacts now, and be precise about which entity actually performed the work if a parent or affiliate's history is involved.

Capture tasks to load into GovEagle before Oct 1

Here's how to run the steps above in GovEagle. This is capture work, not proposal writing. The goal is to walk into October 1 with a package you're confirming against the final RFP, not one you're starting from scratch under a 5-day clock.

• Track the notice now. Load the September 17 draft into a GovEagle opportunity and turn on amendment tracking through Opportunity Search and bid agents, so the October 1 final solicitation and any subsequent amendments land automatically instead of depending on someone re-checking SAM.gov by hand.
• Build the matrix in two parts. Use the Excel add-in to extract submission instructions and evaluation criteria from the draft into a working compliance matrix, grouped separately for Phase 1 eligibility items and Phase 2 evaluation factors. Add an owner and an open-questions column so it's a work plan your team can act on, not another summary to read once.
• Search before you assume. Run a content library search now for candidate past performance matching NCCS's network, cloud, and cybersecurity scope at comparable size and complexity. Ask GovEagle to show the requirement addressed, the supporting source, and what still needs verification for each candidate. Treat the result as a shortlist to confirm with the people who ran the work, not an automatic qualification. And "not found in the content library" is not the same as "we don't have it": a missing record usually means a conversation with the program manager who ran the work, not a real capability gap, but you need to know which one you're looking at before October 1, not during Phase 2 drafting.

After October 1: reconcile, don't restart

When the final solicitation lands, compare it against the draft line by line rather than assuming it's unchanged. Re-run your compliance matrix, recheck the clearance and reference requirements for any language DHS added in response to industry's comments, and confirm page limits and attachment formats before you finalize anything. Teams that used the draft to get organized will spend October 1 reconciling; teams that waited will spend it reading the RFP for the first time.

With the final RFP reconciled, move into proposal work:

• Draft only after your three references are locked. Once the team has selected and verified its Phase 2 references, use the Word add-in to build a requirements-mapped outline and first-pass narratives from that validated evidence, so Phase 2 drafting starts from confirmed facts instead of a blank page on October 9.
• Structure staffing data, but don't touch DHS's pricing template. GovEagle can help organize labor category and staffing information in Excel; it doesn't replace confirming personnel availability or rates. Keep DHS's pricing template columns and formulas exactly as issued.

FAQs

What is DHS NCCS 2.0?

NCCS 2.0 (Network, Cloud, and Cybersecurity Services) is a planned department-wide IDIQ from the Department of Homeland Security with a $625.996M ceiling. It will be competed full and open and awarded to a single prime contractor, not several. DHS released the draft solicitation on September 17, 2026, is targeting an October 1 final solicitation, and expects to award in late November. The whole schedule is notional and can change.

Is the October 6 Phase 1 deadline final?

No. DHS has labeled the entire schedule "notional," meaning it's a planning estimate, not a committed date. Confirm the current package and any amendments directly on the SAM.gov notice before treating any date here as fixed.

What is Phase 1, and what does it actually evaluate?

Phase 1 is an eligibility gate, not a competitive evaluation. Based on the draft, it appears focused on verifying active Top Secret facility clearance status and confirming that legal entity names and CAGE codes match SAM.gov and NISS records exactly, for the bidding entity and every named joint-venture partner, mentor-protégé partner, and subcontractor covered by the submission instructions.

Does clearance for our company as a whole satisfy the Phase 1 requirement?

Not necessarily. The draft's clearance requirement applies to the specific bidding entity and to each named partner or subcontractor individually. A general track record of cleared work at the company level is a different claim than confirming that a specific entity's facility clearance is active in NISS.

What happens in Phase 2?

Phase 2, per the draft, asks for three contract or task-order references from the last five years, comparable in size, scope, and complexity, at one page each. Non-price factors, experience and staffing/management combined, reportedly carry significantly more weight than price (Washington Technology), and DHS intends to award without discussions (GovTribe), so there's limited room to clarify or negotiate after submission.

How much time is there between Phase 1 and Phase 2?

Based on the notional schedule, notification to proceed to Phase 2 is October 9 and Phase 2 proposals are due October 21, a 12-day window. That's tight enough that reference verification (confirming a point of contact is still reachable) needs to happen before Phase 1, not after notification.

Can we modify DHS's pricing template?

No. The draft reportedly prohibits adding columns or altering formulas in DHS's pricing template. Any staffing or pricing analysis should be organized separately, with the template itself kept exactly as issued.

What should we actually be doing before October 1?

Verify clearance status for every covered entity, confirm legal names and CAGE codes against SAM.gov, shortlist and verify three past-performance references, and build a compliance matrix from the draft split into Phase 1 eligibility items and Phase 2 evaluation factors. The goal is to spend October 1 reconciling the final RFP against work already done, not starting from a blank page under a 5-day clock.

Sources: SAM.gov Notice · HigherGov · OrangeSlices · abierto.us · Washington Technology · GovTribe

Confirm the current package and any amendments directly on the SAM.gov notice before acting — this schedule is notional and DHS can revise it.