Cybersecurity Maturity Model Certification (CMMC) Third-Party Assessor Organization (C3PAO)

The University of Michigan is seeking a certified C3PAO to perform a Cybersecurity Maturity Model Certification (CMMC) Level 2 assessment and certify a cloud‑hosted, third‑party‑managed secure enclave that will support compute, storage, collaboration tools, high‑performance computing, and large‑file storage for its campus and health‑system operations. The vendor must provide a full assessment methodology, deliver a certification package, and complete the work within one year of contract award. The solicitation also requires extensive compliance documentation (BAA, Data Security Agreement, sustainability, accessibility, and cybersecurity questionnaires) and adherence to the University’s payment and e‑settlement terms. • Conduct a CMMC Level 2 assessment covering all NIST SP 800‑171r2 domains, controls, and assessment objectives. • Deliver a certification‑ready report and supporting artifacts for the University’s cloud enclave. • Provide a detailed project plan, staffing chart, and resumes for key personnel. • Sign the standard Business Associate Agreement, Data Security Agreement, and Supplier Code of Conduct “as‑is.” • Meet University‑specified sustainability, accessibility (WCAG 2.1 AA/Section 508), and cybersecurity standards (e.g., ISO 27001, SOC 2, FedRAMP).