Cyber Security Maturity Model Certification Assessment (level 2)

Background

The University of Maryland College Park is requesting proposals from qualified contractors to provide Cyber Security Maturity Model Certification Assessment (CMMC) Level 2 certification assessment services. This procurement aims to secure authorized CMMC Certified Third-Party Assessor Organization (C3PAO) services for two distinct Azure Government GCC High tenants, referred to as Tenant A and Tenant B. The University, as a leading public research institution located near Washington, D.C., requires secure IT environments to support its extensive research and academic programs.

Work Details

The contractor will perform CMMC Level 2 certification assessments for two separate information systems configured identically under the same cage code. The assessment will evaluate the implementation of 110 security requirements from NIST SP 800-171 Revision 2 across both tenants. Key deliverables include: 1. Assessment planning and finalized scope documentation for each tenant. 2. Evidence request lists aligned with Level 2 requirements. 3. Interview schedules and status updates during fieldwork. 4. Draft findings for validation by UMD. 5. Final assessment reports clearly distinguishing results for each tenant. 6. Support for POA&M closeout certification assessment if required.

Period of Performance

The contract will commence upon award and is expected to follow a timeline that includes a kickoff meeting, planning phase, execution of assessments, and final reporting, with specific dates to be determined during the proposal process.

Place of Performance

The work will be performed at the University of Maryland locations: 4600 River Road, College Park, MD 20737; and 7005 52nd Ave, College Park, MD 20740.

Bidder Requirements

Contractors must be authorized C3PAOs capable of performing Level 2 assessments in hybrid Microsoft/Azure environments. They must provide proof of eligibility, demonstrate relevant experience, and propose a qualified team with credentialed assessors. Additionally, all personnel assigned must be U.S. citizens, and contractors must comply with confidentiality and data handling standards suitable for sensitive institutional information.