This Solicitation opportunity from Michigan was posted on May 1, 2026. The submission period has ended. Browse the details below for market research, or find similar active opportunities.
Cybersecurity Capability Maturity Program Assessment
Contract Overview
Solicitation details, issuing organization, response deadlines, documents, and interested companies for this government contract opportunity.
Active Opportunities Like This One
AI Contract Overview
The University of Michigan, acting through its Regents and on behalf of U-M Health West and U-M Health Sparrow, is seeking a qualified supplier to conduct a comprehensive cybersecurity capability maturity assessment aligned with the NIST Cybersecurity Framework. The project involves interviews, information gathering, and evaluations to measure the maturity of cybersecurity programs across the university’s health systems, with the goal of delivering actionable insights and recommendations. The selected supplier will be engaged for an initial three-year period, with the possibility of extending the engagement for two additional assessments based on mutual agreement. Proposals must be submitted electronically via the Sourcing Directory by June 22, 2026, and require an intent to bid to be submitted prior to engaging with the RFP system. All proposal materials become the property of the University and may be incorporated into any resulting contract, under the precedence order of Contract Terms and Conditions, Statement of Work, and the RFP. The University explicitly states it assumes no liability for any costs incurred by the supplier in preparing or submitting a proposal. The supplier must demonstrate financial stability, relevant experience in healthcare cybersecurity, adherence to industry standards including NIST, ISO 27001, OWASP Top 10, SSAE 18, and PCI-DSS, and full compliance with HIPAA and data governance requirements. Key personnel, including a designated Supplier Security Officer and Service Manager, must remain in place throughout the contract term unless replaced under strict conditions approved by the University. The supplier is required to conduct background checks on all personnel, implement strict access controls with revocation within 12–24 hours of termination, maintain annual security policy reviews, and ensure physical and logical security standards meet NIST and other recognized frameworks. Subcontracting is prohibited without prior written consent, and the supplier remains fully liable for all subcontractor actions. The supplier must also execute a Business Associate Agreement if handling protected health information and disclose any organizational conflicts of interest. Proposals must include executive summaries, staffing resumes limited to two pages per individual, a detailed cost proposal in Excel format, and supporting documentation in Word. Evaluation will be based on technical quality, cost, experience, compliance, service quality, and value-add, using a trade-off approach rather than lowest price technically acceptable. No contract value is specified due to the absence of completed pricing data in the submitted RFP materials.
General Info
Agency
Place of Performance
Not specifiedSet-Aside
Timeline
Submission Closed
Organization & Contact Information
Full Description
More opportunities from University of Michigan
Same awarding agency
Find Active Opportunities Like This
Get AI-powered intelligence on the opportunities still open
Every page of the solicitation package shredded into a compliance breakdown
AI-powered matching based on your capabilities and past performance
Competitor and incumbent history on the requirement
Automated alerts on amendments, Q&A deadlines, and award
Join 750+ contractors already using CLEATUS
