University of Michigan-Ann Arbor Sciquest #RFP-0012230-TECH-2026

CMMC Level 2 Assessment Services for University of Michigan Cloud Environment

The University of Michigan is seeking certified CMMC Third-Party Assessor Organizations (C3PAO) to conduct a CMMC Level 2 assessment for its cloud-hosted, third-party managed environment. - Government Buyer: - University of Michigan, Information and Technology Services (ITS) - Includes Ann Arbor campus and Michigan Medicine health system - OEMs and Vendors: - No specific OEMs or vendors are named; only CMMC-accredited C3PAOs are eligible - Products/Services Requested: - CMMC Level 2 Assessment Service - Comprehensive review of NIST SP 800-171r2 domains, controls, and assessment objectives - Assessment covers secure enclave service offering compute, storage, collaboration tools, HPC, and large file storage - Quantity: 1 assessment engagement - Unique or Notable Requirements: - Vendor must be a certified CMMC Third-Party Assessor Organization (C3PAO) - Assessment is for a cloud-hosted, third-party managed environment - Deliverables must be completed within one year of contract start - Proposal must detail methodology, staffing, and all costs - Place of Performance: - University of Michigan Ann Arbor Campus - University of Michigan Health System (Michigan Medicine)

Description

The University of Michigan is seeking proposals from certified suppliers for Cybersecurity Maturity Model Certification (CMMC) Third-Party Assessor Organization (C3PAO) services. The project aims to provide certification of a cloud-hosted, third-party managed environment for CMMC Level 2. The selected supplier will conduct a Level 2 CMMC assessment, including review of implementation and documentation of all NIST SP 800-171r2 domains, controls, and assessment objectives. The proposal must include all services and costs necessary to meet the University's business and technical requirements, a detailed approach/methodology, staffing requirements, and assumptions. The deliverables are expected to be completed within one year of the contract start date.

View original listing