Cybersecurity Capability Maturity Program Assessment

University of Michigan Health system seeks a qualified vendor to assess the maturity of its cybersecurity program using the NIST Cybersecurity Framework. The effort includes conducting interviews, gathering information across multiple hospital sites, and delivering a comprehensive maturity assessment report with recommendations. • Perform interviews and information‑gathering activities with technology teams at U‑M Health, U‑M Health‑West, and U‑M Health‑Sparrow. • Evaluate existing cybersecurity controls, policies, and processes against NIST CSF domains (Identify, Protect, Detect, Respond, Recover). • Produce a detailed maturity assessment report, executive summary, risk analysis, and a three‑year roadmap for improvement. • Required to sign the University’s standard Business Associate Agreement and Data Security Agreement “as‑is,” demonstrate relevant cybersecurity certifications (e.g., SOC 2, ISO 27001), and comply with HIPAA and Michigan state regulations. • Contract term: initial 3‑year assessment period with an optional two‑year extension; firm price hold for at least three years; payment via virtual‑card (Net 0) or Net 45.