Controlled Unclassified Information Enclave

Clemson University is seeking a vendor to provide a third-party-hosted Controlled Unclassified Information (CUI) enclave and managed compliance services. The selected vendor will be responsible for providing a fully managed, scalable, CMMC Level 2 compliant research environment capable of supporting secure collaboration, software development, modeling and simulation, artificial intelligence and machine learning development, digital engineering activities, and storage and processing of CUI. The vendor will also serve as Clemson University's primary compliance partner for the enclave and provide all associated managed services necessary to support and maintain compliance with applicable DFARS requirements, NIST SP 800-171 Rev. 2 (and future revisions), CMMC Level 2 requirements, and related Department of Defense cybersecurity requirements. Some key requirements for the proposal include: • A fully managed CMMC Level 2 compliant environment and associated managed services • Compliance management services, including CMMC Level 2 compliance management services, Shared Responsibility Matrix development and maintenance, System Security Plan development and maintenance, and more • Security operations, including a Managed Security Operations Center (SOC), continuous monitoring, vulnerability management, patch management, threat detection, log aggregation and retention, Security Information and Event Management (SIEM) capabilities, and more • Identity and access management, including multi-factor authentication, role-based access control, privileged access management, account lifecycle management, and integration with Clemson identity systems • Research computing support, including support for research, engineering, and development workflows, and compatibility with various software and systems • Scalability plan, including growth from 20 to 50 users, growth from 50 to 100 users, additional storage expansion, GPU and HPC expansion, and multi-project segregation capabilities • Higher education and research experience, including experience supporting universities, research laboratories, FFRDCs, UARCs, and Department of Defense research programs • Project timeline and implementation schedule, including milestones, deliverables, dependencies, resource requirements, and estimated completion dates • Vendor experience metrics, including the number of organizations successfully supported through third-party CMMC assessments, the number of organizations achieving CMMC Level 2 certification, and more • Warranty, including a warranty that the enclave and all managed services will meet the specified CMMC compliance level and performance SLAs for the duration of the contract term • Service and support, including support channels, response times, dedicated account manager and technical support team, and more.