Cybersecurity Maturtiy Model Certification Third-Party Assessment Organization Services (C3PAO)

Virginia Tech seeks an authorized Cybersecurity Maturity Model Certification (CMMC) Third‑Party Assessment Organization (C3PAO) to perform Level 2 certification assessments for several of its research and computing environments. The contractor will deliver fixed‑price assessment services, including on‑site or remote evaluation, certification reporting, and coordination with existing System Security Plans. The effort covers a high‑performance computing cluster, two secure enclaves (approximately 130 and 300 assets), and a set of standalone systems, with potential follow‑on recertification work for up to three years after initial certification. The contract will be a two‑year base period with up to four optional two‑year extensions, and the vendor must meet insurance and SWaM participation requirements. • Conduct CMMC Level 2 assessments for the ARC HPC cluster, COMPASS enclave, NSI enclave, and standalone SSPs. • Provide certification reports, executive summaries, and any required remediation documentation per CMMC Accreditation Body standards. • Submit a fixed‑price proposal per system type, inclusive of travel, onsite labor, and any required subcontracting, with a mandatory insurance package (General Liability $2M, Employers Liability $100k, Workers’ Comp). • Respond to mandatory pre‑submission questions, disclose conflict‑of‑interest information, and indicate SWaM status. • Potential for additional recertification work within three years and possible contract extensions up to a total of ten years.