Cybersecurity Maturity Model Certification (CMMC) Program Services

The University of Arkansas Fayetteville issued solicitation 09112026 for a term contract consisting of two years with two optional renewal years to provide cybersecurity advisory, architecture, engineering, and compliance services. The primary objective was to mature the university's Cybersecurity Maturity Model Certification (CMMC) program to achieve and maintain compliance with CMMC Levels 1, 2, and 3 for Federal Contract Information and Controlled Unclassified Information. The scope of work included strategic deliverables such as compliance roadmaps and operating models, technical deliverables including security architecture and continuous monitoring programs, and readiness activities such as gap analyses and mock assessments. The procurement process included several modifications, including the addition of a 2 million dollar Professional Liability insurance requirement and extensions to the proposal deadline. Evaluation criteria were weighted based on the technical proposal (40 points), respondent qualifications (30 points), and cost (30 points). However, the University of Arkansas Fayetteville officially cancelled this solicitation via Addendum 3 on October 19, 2026, citing changes in federal guidance that necessitated a reassessment of the procurement scope. The university intends to issue a new solicitation once the requirements are clarified.