NIST 800-171 Secure Research Enclave

The contract involves the development and support of a cloud-hosted, secure research enclave at the University of Texas at Dallas, designed to meet strict cybersecurity standards including NIST SP 800-171 Revision 2 and achieving Cybersecurity Maturity Model Certification (CMMC) Level 2. The scope encompasses a comprehensive assessment of existing infrastructure, configuration of a FedRAMP moderate baseline environment, detailed documentation such as System Security Plans and Shared Responsibility Matrices, and the provision of training, mock assessments, and ongoing compliance support. The project is structured as a three-year initial contract with two optional one-year renewals, with a total estimated value between five and ten million dollars, although exact pricing details are to be submitted by proposers and finalized through negotiation. The contractual framework emphasizes strict adherence to federal, state, and university-specific cybersecurity, data protection, and procurement regulations. Key clauses mandate compliance with laws governing cybersecurity, data privacy (including FERPA and GDPR), and restrictions on telecommunications equipment from certain foreign entities. The contractor must demonstrate expertise in implementing NIST controls, possess qualified personnel—including potentially certified CMMC assessors—and conduct thorough background checks on staff involved in the project. Deliverables include a secure cloud environment, detailed security documentation, and support for certification processes. The agreement also incorporates provisions for confidentiality, security, and immediate termination rights if compliance or security standards are violated. Payment terms are structured with caps and require detailed invoicing, with the university’s administrative contacts overseeing contract administration and compliance. Overall, the contract establishes a rigorous, security-focused partnership aimed at enabling the university to securely handle controlled unclassified information and achieve federal cybersecurity certification.