Cybersecurity Maturity Model Certification (CMMC) Third-Party Assessor Organization (C3PAO)

The University of Michigan (“University”) seeks proposals from certified Suppliers of Cybersecurity Maturity Model Certification (CMMC) Third-Party Assessor Organization (C3PAO). The major goal of this project is to provide a certification of the cloud hosted, third-party managed environment for CMMC Level 2. The selected supplier will provide a Level 2 CMMC assessment including a review of the implementation and documentation of all NIST SP 800-171r2 domains, controls, and assessment objectives. The proposal must be comprehensive by including all services and costs necessary to meet the business and technical requirements of the University as outlined in this RFP. In addition, the proposal must specify a detailed approach/methodology, supplier and University staffing requirements, and any other assumptions to complete the proposed work. The University would like the project deliverables completed no later than 1 year after the contract start date. The University is not liable in any manner or to any extent for any cost or expense incurred by the supplier in the preparation, submission, presentation or any other action connected with proposing or otherwise responding to this RFP. Such exemption from liability applies whether such costs are incurred directly by the supplier or indirectly through the supplier’s agents, employees, assigns or others, whether related or not to the supplier. BACKGROUND ON THE UNIVERSITY The primary scope of this RFP includes the University of Michigan campus located at Ann Arbor, as well as the University of Michigan- Health. The mission of the university is to serve the people of Michigan and the world through preeminence in creating, communicating, preserving and applying knowledge, art, and academic values, and in developing leaders and citizens who will challenge the present and enrich the future. With nearly 50,000 undergraduate and graduate students enrolled at 19 schools and colleges on the Ann Arbor campus, the university is highly ranked nationally and throughout the world. The College of Engineering, College of LSA (Literature, Science, and the Arts), and the Ross School of Business are a few of the top choices for students. Michigan Medicine includes the top-ranked U-M Medical School and the University of Michigan Health System, which includes the C.S. Mott Children’s Hospital, Von Voigtlander Women’s Hospital, University Hospital, the Frankel Cardiovascular Center, the Rogel Cancer Center, and Metro Health. Michigan Medicine’s adult hospitals were ranked number 11 in the nation by U.S. News and World Report in 2020-21 and C.S. Mott Children’s Hospital was the only children’s hospital in Michigan nationally ranked in all 10 pediatric specialties analyzed by U.S. News and World Report for 2020-21. The U-M Medical School is one of the nation's biomedical research powerhouses, with total research funding of more than $500 million. BACKGROUND ON PROJECT Information and Technology Services (ITS) will partner with a third-party vendor to build a CMMC Level 2 certified secure enclave service which provides compute, storage and collaboration tools and high performance computing (HPC) and large file storage options. This effort will result in a C3PAO certification attempt of the environment for CMMC Level 2. Pre Bid Conference is scheduled for June 3, 2026, 11 a.m. -12 p.m. EST. Questions submitted after the pre bid conference may not recieve a response from the university.Join Zoom Meeting https://umich.zoom.us/j/97000350641