Description
Michigan State University is seeking a Certified Third-Party Assessment Organization (C3PAO) to perform a mock assessment of their Regulated Research Enclave (RRE) hosted service. The RRE is a NIST Special Publication 800-171 compliant environment intended to protect projects with controlled unclassified information (CUI) at the Cybersecurity Maturity Model Certification (CMMC) Level 2 requirement. The assessment should be completed between January 2026 and March 2026. The selected vendor must be listed in the Cyber-AB Marketplace as a Certified 3rd Party Assessment Organization (C3PAO).
Key points to consider:
• The RRE is hosted in an Azure GovCloud environment, completely separated from the rest of MSU's IT infrastructure.
• The service is intended to meet high regulatory controls, standards, and reporting requirements that come from sponsored contracts subject to the Defense Federal Acquisition Regulation Supplement (DFARS), including CMMC clauses.
• Vendors must be certified by the Cyber-AB Marketplace to be eligible for this opportunity.
• The assessment will evaluate the RRE's compliance with CMMC Level 2 requirements.
• The contract award will be based on the lowest total cost to the University, with consideration of the vendor's experience and qualifications.