Is Deltek's Dela available in GovCon Cloud Moderate, and what are GCCM customers' options for AI?

Contractors who run Costpoint in GovCon Cloud Moderate chose it for a reason: something they hold needs the controls that environment adds. The same reason makes every AI question harder, because the first thing any AI needs is the data.

Deltek's documents give two answers

The Dela FAQ in the Costpoint 8.2 help is direct. Asked "Is Dela available in the GCCM Cloud?" it answers "No. Dela currently is not available in Deltek's GCCM Cloud offering," and says the restriction helps Deltek meet the security and compliance requirements of that offering. Elsewhere it says "Dela is available to all Costpoint Cloud customers, except those in the GCCM Cloud offering." The page carries no date. The only version it names is 8.2.8, where Dela first appeared.

Deltek's Costpoint Dela/GenAI overview, a slide deck titled "Costpoint version 2025.3/2025.4 August 2025" and posted under Deltek's cloud release notes, says something else, in the present tense: "For Costpoint GCCM, Dela leverages Microsoft OpenAI, hosted in Azure GCC High - a FedRAMP High Authorized cloud service." Its data processing slide repeats it: for Costpoint GCCM, Dela uses Microsoft's OpenAI hosted on Azure Government Cloud, "a U.S.-based, FedRAMP High-Authorized, cloud hosting platform." It adds that Deltek "will maintain" the license and API key for that service.

We could not settle it from public sources. The Costpoint 2025.3, 2026.1, 2026.3 and 2026.4 release notes list Dela features without saying which cloud environments get them. Deltek's page of features that are not active in GCC Moderate names Bank Account Integration, IAGs, ICR scanning and Microsoft 365 GCC Adaptive Cards, and does not mention Dela at all. A dated document in the present tense is normally stronger evidence than an undated FAQ, but neither says when GCCM customers could switch Dela on, so we will not guess. If you run GCCM, ask your Deltek account team in writing: Is Dela enabled, or enableable, on our system today? Since which release? Which Azure environment processes our prompts? Which features: Ask Dela, Smart Summaries, the agents, the Agentic Financial Close cards, the MCP server? The answer belongs in your System Security Plan if CUI is anywhere near Costpoint, and in your AI use policy either way.

GCCM raises the bar for anything that reads Costpoint

GovCon Cloud Moderate is Deltek's Costpoint cloud with controls added. Deltek's 2020 launch article says the controls align with NIST SP 800-53 and CNSSI 1253 and that the environment "allows government contractors to safely store Covered Defense Information (CDI) and ITAR data." Its compliance status is easy to overstate: GCCM reached FedRAMP Moderate Ready in January 2024 and completed a FedRAMP Moderate Equivalency assessment by Schellman on April 30, 2025. It is not FedRAMP Authorized; the FedRAMP Marketplace showed it as Legacy FedRAMP Ready with zero authorizations as of December 12, 2025.

The operating rules follow from that. The SaaS Customer Administrator must be a U.S. Person in the United States, and only U.S. Persons may access ITAR data. Deltek's own guidance tells customers and consultants not to share any data with Deltek team members outside the GCCM environment. In GCCM production, only Deltek's cloud operations team can reach the database directly; Deltek provides read-only ODBC access instead. Each rule is the same idea: data leaves this environment only through a path somebody approved, to a place with equal or stronger controls. Any AI you add lives by it.

Route	Where the model runs	What it reaches	Status for GCCM today
Dela inside Costpoint	Microsoft Azure	Costpoint, as the signed-in user; attached contract documents	Deltek's FAQ says not available; its August 2025 overview says it runs on Azure GCC High. Confirm in writing.
Microsoft 365 Copilot in GCC or GCC High	Microsoft GCC or GCC High	Your Microsoft 365 documents, mail and chat; not Costpoint unless a connection is built	Generally available in GCC since December 2024 and GCC High since December 2025. Costpoint connection via Deltek's MCP server: GCCM availability not stated.
Custom assistant in a government cloud	Azure Government or AWS GovCloud	Costpoint through read-only ODBC, web services or BI extracts your administrator grants, plus documents and other systems	Available now. FedRAMP High AI services exist in both clouds; access is granted by you, not Deltek.
Model on your own hardware	Your servers	Whatever you connect to it	Available now. Every NIST SP 800-171 control falls on you.

Sources: Deltek's Dela FAQ and Costpoint Dela/GenAI overview, the Costpoint 2026.3 release notes, Deltek's GCCM cloud documentation, Microsoft's Azure Government blog, Nextgov and Summit 7 on Copilot availability, and the FedRAMP Marketplace. Routes two to four exist whichever way Deltek answers the Dela question. Our recommendation: confirm route one in writing, use routes one and two for what they already cover, and put the questions that span Costpoint and documents on route three.

Route one: Dela, once Deltek confirms it for your system

If your account team confirms Dela, use it for what it is built for. Ask Dela works anywhere in Costpoint and in Teams, Smart Summaries sit in the Contracts module, and the agents handle time entry, expense creation and contract record creation from uploaded documents. The 2025.3 release added AI-powered AP voucher approvals and let customers point Ask Dela at internal policy and handbook URLs. The 2026.3 and 2026.4 release notes describe Agentic Financial Close, with Dela-flagged bills and financial and indirect rate anomaly cards. Dela is included with the Costpoint license, inherits each user's organization and security permissions, and, in Deltek's words, "acts as another user in Costpoint." Deltek says requests to Azure are stateless, that Costpoint does not store inquiries or responses, and that customer data is never used to train the model.

Two limits remain whatever the GCCM answer. Dela is Deltek's AI inside Deltek's product; a question that spans Costpoint, a funding modification in SharePoint and the program manager's forecast spreadsheet sits outside it. And the 2026.3 and 2026.4 notes still do not say which of the newer features reach GCCM. We laid out which recurring finance questions fall on each side of that line in What should a government contractor automate with AI first?

Route two: Copilot in GCC or GCC High covers the document side, not Costpoint

If you run Microsoft 365 in GCC or GCC High alongside Costpoint, Copilot is already on the menu. Microsoft 365 Copilot became generally available in GCC in December 2024 and in GCC High in December 2025, and it answers from the Microsoft 365 data each user already has permission to see. It does not see Costpoint. Deltek's Costpoint 2026.3 release notes describe Dela operating as a Model Context Protocol server so that "Copilot or other MCP-compatible tools" can reach Costpoint data and workflows, but the notes say nothing about GCCM or how those connections authenticate, so for a GCCM customer that bridge is a question for Deltek, not a plan. According to Summit 7's June 2026 FAQ, GCC High Copilot also still lacked several features, including Researcher and Analyst agents and Copilot connectors. Which Copilot you have, and what it may touch, is the subject of Is it safe to put CUI or contract documents into ChatGPT or Copilot?

Route three: a custom assistant in a government cloud, on access you grant

This route does not depend on Deltek's roadmap, and it is the one we build. GCCM already provides every path it needs, each granted by the customer: read-only ODBC and JDBC through Deltek's Hybrid Data Pipeline driver, requested by your SaaS Customer Administrator, with up to five allow-listed IP addresses and separate production and non-production credentials; web services, through a "Request Web Services" service request that Deltek says to allow up to five business days for; and scheduled Costpoint Business Intelligence report subscriptions. Deltek's SaaS terms define an Authorized User to include "a third party contracted to implement, access, and use the Services on behalf of Customer," which is how an independent firm works inside your license, under your administrator, with U.S. Persons where ITAR data is in scope. No Deltek partnership is required; Rockford holds none.

The model side has to meet the same bar as the data. Azure OpenAI in Azure Government has been authorized within the Azure Government FedRAMP High package since August 12, 2024, with DoD Impact Levels 4 and 5, and Amazon Bedrock is authorized at FedRAMP High in AWS GovCloud. Inside your own government cloud account, the assistant reads Costpoint, never writes to it, shows the report and period behind every figure, and logs who asked what and which sources answered. That is the work Can AI read our Costpoint data without creating a DCAA problem? describes, and the monthly rate check in Can AI catch indirect rate variances before the incurred cost submission? is a typical first task. Costpoint stays the system of record. AI drafts and flags; people approve and sign.

Route four: a model on your own hardware

Some contractors want nothing to leave the building. Open-weight models run on your own servers, read the extracts you give them and send nothing out. The price is that every NIST SP 800-171 control falls on your team, with no cloud provider's authorization to lean on. For a GCCM customer the extracts still leave through the same approved paths, so the room they land in needs the same discipline.

How to decide

Classify first. Indirect rates, payroll and billing data are sensitive business data but usually not CUI; contract deliverables, technical data and some contract documents may be. If CUI or ITAR data touches Costpoint or the documents attached to it, the AI environment must sit inside your NIST SP 800-171 scope: on our reading of 32 CFR 170.19, a cloud AI service that handles CUI is a cloud service provider in your assessment scope, and the rule says such a provider "shall meet the FedRAMP requirements in 48 CFR 252.204-7012" and be documented in your System Security Plan. If nothing in Costpoint is CUI, the question is contractual: no training on your data, retention you control, U.S. processing, logs you can export.

Then ask Deltek the Dela question in writing and file the answer. Use Dela, if you have it, for in-system transactions, and Copilot for documents. Put the cross-system questions on a route whose environment you choose and whose access you grant; we sort eight typical questions among the three in Deltek Dela, Copilot or a custom assistant: which does a contractor actually need? Small proof first, then scale.

Common questions

Is Costpoint GovCon Cloud Moderate FedRAMP Authorized?

No. Deltek describes GCCM as FedRAMP Moderate Equivalent: Moderate Ready in January 2024, then a Moderate Equivalency assessment by Schellman completed April 30, 2025. The FedRAMP Marketplace listed it as Legacy FedRAMP Ready with zero authorizations as of December 12, 2025. Write Equivalent, not Authorized, in your System Security Plan.

Can an outside firm connect to our Costpoint data in GCCM?

Yes, on access your own administrator grants. Deltek's SaaS terms count a contracted third party as an Authorized User, and GCCM provides read-only ODBC and web services through service requests your SaaS administrator files. Only U.S. Persons may access ITAR data, and Deltek's rule against sharing GCCM data with its own staff outside the environment is a good rule for every outsider.

Does the Costpoint MCP server work in GCCM?

Unknown. The Costpoint 2026.3 release notes say Dela can operate as a Model Context Protocol server for Copilot and other MCP-compatible tools. They do not mention GCCM or government cloud availability, and they do not say how connections authenticate. Ask Deltek before planning on it.

Does Dela train on our Costpoint data?

Deltek says no. Its AI and Trust page states that customer data will not be used to train large language models, and the August 2025 overview says requests to Azure are stateless, that Costpoint does not store inquiries or responses, and that Deltek does not store information processed through Dela. Those are vendor statements; get them into your agreement.