Controlled Unclassified Information Enclave

Background

Clemson University is seeking bids for a secure, third-party-hosted Controlled Unclassified Information (CUI) enclave and associated managed compliance services. This initiative supports research projects under the Virtual Prototyping of Ground Systems (VIPR-GS) Research Center and other federally sponsored initiatives involving sensitive research information. The goal is to provide a fully managed, scalable, CMMC Level 2 compliant environment that facilitates secure collaboration and development activities while ensuring compliance with applicable cybersecurity requirements.

Work Details

The selected vendor will provide a fully managed CMMC Level 2 compliant research environment capable of supporting various activities including secure collaboration, software development, modeling and simulation, artificial intelligence and machine learning development, digital engineering activities, and the storage and processing of CUI. Key services include:

Compliance Management Services

CMMC Level 2 compliance management, Shared Responsibility Matrix (SRM) development, System Security Plan (SSP) maintenance, audit preparation support, annual compliance assessments.

Security Operations

Managed Security Operations Center (SOC), continuous monitoring, vulnerability management, incident response coordination.

Identity and Access Management

Multi-factor authentication, role-based access control.

Research Computing Support

Support for programming languages such as Python, MATLAB, C/C++, Rust; tools like GitHub Enterprise; and secure document collaboration.

Secure Software Development

Support for secure CI/CD pipelines and container security scanning. The solution must accommodate the unique operational requirements of a university research environment including frequent onboarding/offboarding of users and multi-organizational collaboration.

Period of Performance

The contract will be awarded for a maximum of 5 years total as a series of 1-year agreements.

Place of Performance

The services will be performed at Clemson University or as specified in the proposal by the selected vendor.

Bidder Requirements

Vendors must demonstrate experience in managing CMMC Level 2 environments and supporting organizations handling Controlled Unclassified Information (CUI). They should provide evidence of successful third-party CMMC assessments and certifications. Additionally, vendors must comply with all applicable laws and regulations relevant to higher education environments.