Cybersecurity Maturity Model Certification

Clemson University is seeking a qualified and accredited Certified Third-Party Assessment Organization (C3PAO) to conduct a Cybersecurity Maturity Model Certification (CMMC) Level 2 Mock Assessment and potentially a formal CMMC Level 2 Certification Assessment. The selected vendor will evaluate Clemson's Secure Enclave and associated processes for compliance with NIST SP 800-171 and CMMC Level 2 practices. The scope of work includes two projects: Project 1, a CMMC Level 2 Mock Assessment, and Project 2, a formal CMMC Level 2 Certification Assessment. The vendor must have experience conducting formal CMMC Level 2 assessments and must maintain a certification in good standing with the Cyber AB as a C3PAO throughout the term of the award. Some key points to consider are: • The vendor must provide a detailed approach and methodology for conducting the assessments, including a timeline and resource allocation plan. • The vendor must have experience with the CMMC Assessment Process (CAP) and must be able to exercise professional judgment in areas where the CAP permits assessor discretion. • The vendor must provide a list of assessment team members and their qualifications, including resumes and approximate percentage of total work effort to be undertaken directly by each team member. • The vendor must describe their approach to categorizing assets within the scope of the assessment, including the identification and assessment of Specialized Assets, Security Protection Assets (SPAs), and Security Protection Data (SPD). • The vendor must provide a detailed description of their assessment approach and application of professional judgment when conducting a CMMC Level 2 mock and certification assessments.