RFP09112026 - Cybersecurity Maturity Model Certification (CMMC) Program Services

Request for Proposal (RFP)
RFP Number 09112026
Cybersecurity Maturity Model Certification (CMMC) Program Services
RFP RELEASE DATE: September 11, 2026
MANDATORY PRE-PROPOSAL: No pre-proposal conference will be held for this solicitation
PROPOSAL DUE DATE: October 16, 2026*
PROPOSAL DUE TIME: 2:30 PM CST*
BID OPENING EVENT: 2:30 PM CST
SUBMIT ALL PROPOSALS TO: UA Formal Bid Submission
(NOTE: Take care to choose the CORRECT BID NUMBER from the dropdown menu.)
Signature Required For Proposal
Respondent complies with all articles of the Standard Terms and Conditions documents as counterpart to this RFP
document, and with all articles within the RFP document. If Respondent receives the University's purchase order,
Respondent agrees to furnish the items and/or services listed herein at the prices and/or under the conditions as indicated in
the RFP.
Respondent Name:
Mailing Address:
City, State, Zip:
Telephone:
Email:
Authorized Signature: _______________________________________ Date: ______________
Typed/Printed Name of Signor: ________________________________ Title: ______________
*Under no circumstances will late bids be accepted.
Bid opening event will be conducted at the date and time specified via Microsoft Teams. Notice of bid opening event
will be posted on HogBid once the Teams meeting is set up.
INTERGOVERNMENTAL/COOPERATIVE USE OF COMPETITIVELY BID PROPOSALS AND
CONTRACTS:
In accordance with Arkansas Code Annotated 19-11-249, any State public procurement unit, including any University
of Arkansas System campus or unit, may participate in any contract resulting from this solicitation upon approval by the
issuing agency and with a participating addendum signed by the contractor.
1

General Campus Background for University of Arkansas
Founded in 1871 as a land-grant institution, the University of Arkansas, Fayetteville Arkansas (UofA), is the flagship
campus of the University of Arkansas System. Our students represent all 50 states and more than 120 countries. The UofA
comprises 10 colleges and schools offering an internationally competitive education for undergraduate and graduate
students in more than 270 academic programs. The UofA contributes new knowledge, economic development, basic and
applied research, and creative activity while also providing service to academic and professional disciplines. As of Fall
2025, student enrollment totaled approximately 34,175. The faculty count totaled 1,490 and the staff count totaled 3,350.
The UofA is one of the nation's top public research universities and the state's foremost partner and resource for
education and economic development. Its public service activities reach every county in Arkansas, throughout the nation,
and around the world. The Carnegie Foundation classifies the UofA among only 3 percent (3%) of universities in
America that have the highest level of research activity.
1. DESCRIPTION AND OVERVIEW OF RFP
The Board of Trustees of the University of Arkansas, acting on behalf of the University of Arkansas, located in
Fayetteville, Arkansas (UA) is seeking bid proposals from qualified and reputable Respondents to provide services
for the Cybersecurity Maturity Model Certification (CMMC) Program pursuant to the specifications, terms and
conditions stated in this RFP ("Proposal(s)").
UA is seeking to award a term contract for two (2) fiscal years with the option to renew for two (2) additional years
to the Respondent that provides the best overall value to the University. This value will be determined by UA based
on the overall competence, compliance, format and presentation of each RFP response and in-person presentation,
as necessary. Respondents may submit a proposal for all the services entailed in this RFP or may submit a proposal
for a specific service identified in this RFP. Note also that the award may be split between Respondents for each of
the services for which bidding is requested.
Respondent presentations may be held following the bid due date. Projected timeframe for when presentations
could occur is specified in the "Projected Timetable of Activities" section of this RFP. Please keep these dates open
to schedule a presentation if you are selected to present.
UA expects to achieve the following goals (at minimum) through the selected Respondent:
1. Establish and sustain a scalable Cybersecurity Maturity Model Certification (CMMC) program that supports
compliance with CMMC Levels 1, 2, and 3 and protects Federal Contract Information (FCI) and Controlled
Unclassified Information (CUI), and/or similar data classifications.
2. Develop efficient, repeatable, and sustainable compliance processes that reduce administrative burden and enable
researchers, faculty, and support personnel to focus on research and innovation rather than compliance
administration.
3. Implement cybersecurity controls, monitoring capabilities, and operational frameworks that provide continuous
compliance visibility, improve risk management, and support ongoing assessment readiness.
4. Create a scalable research security and compliance foundation that expands the UA's ability to pursue, support,
and manage future Department of Defense/War and other federally sponsored research opportunities.
2. SCOPE OF WORK
2

Purpose:
The UA seeks proposals from qualified firms to provide cybersecurity advisory, architecture, engineering, compliance,
and operational planning services to support the maturation of the UA's Cybersecurity Maturity Model Certification
(CMMC) Program.
The UA has established foundational program governance, program strategy, and initial compliance documentation
supporting CMMC Level 1 requirements. The objective of this engagement is to accelerate the UA's implementation of
scalable cybersecurity capabilities, operational controls, monitoring solutions, and technical compliance frameworks
necessary to achieve and maintain compliance with CMMC Levels 2 and 3 requirements while supporting future growth
in protected research activities and CUI environments.
The Contractor shall work collaboratively with UA stakeholders to design and operationalize cybersecurity capabilities
that support ongoing compliance, assessment readiness, continuous monitoring, and long-term program sustainability.
Scope of Services
A. CMMC Level 1, Level 2, and Level 3 Compliance Maturation
The Contractor shall review the UA's current compliance posture and provide expert guidance for the implementation and
maturation of cybersecurity controls necessary to satisfy applicable CMMC Level 1, Level 2, and Level 3 and/or future
CMMC requirements.
Services shall include:
Review of existing compliance artifacts and templates
Identification of gaps between current-state capabilities and Level 1/2/3/future requirements
Security control implementation plan
Development and solution build of remediation strategies
Compliance prioritization and sequencing recommendations
Assessment readiness plan
Deployment strategy and implementation support of strategy deliverables
Alignment of technical controls to CMMC practices and objectives
Deliverables
Level 1 Maturity review
Level 2 Maturity review
Level 3 Readiness review
Compliance Gap Analysis
Control Implementation Roadmap
Prioritized Remediation Plan
Assessment Readiness Strategy
3

B. Cybersecurity Control Architecture and Operating Model
The Contractor shall assist the UA in designing a scalable cybersecurity control environment capable of supporting
multiple research programs, protected enclaves, departments, and future compliance requirements.
Services shall include:
Control architecture design
Shared services control strategy
Security responsibilities model
Compliance operating model design
Control ownership framework
Exception management processes
Risk management processes
Continuous compliance processes
Deliverables
Cybersecurity Control Framework
Control Ownership Matrix
Compliance Operations Model
Governance and Escalation Procedures
Compliance Lifecycle Management Process
C. Continuous Monitoring and Security Operations
The UA seeks support for establishing a sustainable monitoring and compliance validation capability rather than point-in-
time assessment preparation.
The Contractor shall assist in developing operational monitoring strategies necessary to demonstrate ongoing compliance
and effective control operation.
Services may include:
Security monitoring architecture design
Continuous monitoring framework development
Responsibilities Matrix
Log management strategy
Security event monitoring solution
Compliance monitoring solution
Vulnerability management solution
Configuration monitoring processes & solution
Audit evidence automation strategies
Security performance measurement
4

Deliverables
Continuous Monitoring Strategy
Security Operations Monitoring Framework
Compliance Monitoring Requirements Matrix
Security Metrics Framework
Key Risk Indicator (KRI) Framework
Compliance Dashboard Requirements
Security Event Use Cases
Compliance Evidence Collection Framework
D. CMMC Environment and Secure Research Architecture
The Contractor shall assist the UA in designing secure, scalable environments capable of supporting present and future
protected research activities involving the CMMC environment.
Services may include:
CMMC enclave architecture review & recommendations
Research computing security architecture
Secure collaboration architecture
Secure data storage architecture
Identity and access management architecture
Network segmentation strategies
Third-party service integration assessments
Scalability planning
Deliverables
CMMC Environment Reference Architecture
Security Architecture Standards
Data Protection Standards
Access Control Architecture
Secure Research Environment Design Patterns
Scalability and Growth Planning Recommendations
E. Compliance Automation and Scalability
The UA seeks recommendations that reduce compliance management overhead and improve the ability to scale
compliance operations as the volume of regulated research increases.
The Contractor shall identify opportunities to automate compliance activities and operational controls.
5

Services may include:
Evidence collection automation strategies
Compliance workflow automation recommendations
Policy lifecycle management approaches
Control validation automation
Asset inventory management processes
Continuous assessment methodologies
Repository processes and support
Deliverables
Compliance Automation Strategy
Compliance Tooling Recommendations
Evidence Management Framework
Control Validation Procedures
Compliance Analytics Requirements
Repository framework/solution
F. Assessment Readiness and Sustainment
The Contractor shall assist the UA in developing repeatable capabilities that support future audits, self-assessments, and
certification activities.
Services shall include:
Mock assessments
Routine compliance facilitation
Evidence reviews
Control validation exercises
Assessment interview preparation
Assessment preparation playbooks
Sustainment planning
Deliverables
Mock Assessment Results
Assessment Readiness Reports
Corrective Action Recommendations
Assessment Playbooks
Sustainment and Continuous Improvement Plan
6

Key Deliverables Summary
The UA expects the Contractor to deliver:
Strategic Deliverables
Level 1, Level 2, and 3 and/or future level Roadmap
Compliance Operating Model
Control Framework
Technical Deliverables
CMMC Security Architecture
Continuous Monitoring Program
Security Operations Framework
Compliance Automation Strategy
Operational Deliverables
Control Ownership Model
Evidence Management Framework
Vulnerability Management Framework
Compliance Metrics Program
Readiness Deliverables
Mock Assessments
Readiness Assessments
Remediation Plans
Sustainment Plans
The UA seeks a partner capable of assisting with the design, implementation, operationalization, and scaling of
cybersecurity and compliance capabilities. Preference will be given to firms demonstrating experience establishing
sustainable cybersecurity operating models, continuous monitoring programs, secure research environments, and CMMC
Level 1, Level 2, and Level 3, and/or future CMMC capabilities within complex organizations. The UA is specifically
seeking expertise that enables long-term operational maturity rather than solely the development of compliance
documentation.
3. COSTS / PRICING
Respondents must provide detailed/itemized retail pricing for each individual component, and/or the overall system,
as listed on the Official Bid Price Sheet provided within this RFP document:
Reference Appendix I Official Bid Price Sheet
If pricing is dependent on any assumptions that are not specifically stated on the Official Price Sheet, please list
those assumptions accordingly on a separate spreadsheet and show detailed pricing.
Any additional pricing lists should remain attached to the Official Price Sheet for purposes of accurate
7

evaluation. Pricing must be valid for one hundred twenty (120) days following the bid Proposal due date
and time. Upon bid award, all pricing and/or discounts must be firm for a period of two (2) years with the option to
renew for two (2) additional years.
UA will not be obligated to pay any costs not identified on the Official Price Sheet. Respondents
must certify that any costs not identified by the Respondent, but subsequently incurred in order to achieve
successful operation of the service will be borne by the Respondent. Failure to do so may result in
rejection of the Proposal.
4. RESPONDENT REFERENCES
Respondents must provide a minimum of three (3) references, preferably in higher education, (including the
organization's name, address, persons to contact, telephone numbers, and email addresses) located in the continental
United States currently served by respondent. References are to be parties who can attest to the qualifications
relevant to providing services requested. UA reserves the right to contact any references provided to evaluate the
level of performance and customer satisfaction.
Reference Appendix II for format.
5. PRE-PROPOSAL
No pre-proposal conference will be held for this solicitation.
6. RESPONDENT'S RESPONSIBILITY TO READ RFP
It is the Respondent's responsibility to thoroughly examine and read the entire RFP document, including any and all
appendices. Failure of Respondents to fully acquaint themselves with existing conditions or the amount of goods
and work involved will not be a basis for requesting extra compensation after the award of a Contract. This
engagement is separate from any other engagement bidder may be currently pursuing with the University of
Arkansas. Interpretation by and of the University of Arkansas is final.
7. PROJECTED TIMETABLE OF ACTIVITIES
The following schedule will apply to this RFP, but may change in accordance with the UA's needs:
09/11/26 RFP released to prospective respondents
09/25/26 [5:00 PM] CST - Last date/time UA will accept questions
10/05/26 Last date UA will issue an addendum
10/16/26 Proposal Submission Deadline and Bid Opening Event 2:30 PM CST
Note: Attendance of RFP opening is not required. No award will be made. Only
names of respondents, and a preliminary determination of proposal
responsiveness will be made at this time.
TBD* Respondent Presentations (if necessary)
TBD* Notice of Intent to Award
Upon Intent to Award TBD* Contract Negotiations Begin (upon intent to award) *
Upon Contract Approval: Service to Commence (upon final legislative approval, if applicable)
*UA places a value on all elements of this RFP. As such, after evaluation of Proposals and selection of
Contractor(s), the UA reserves the right to further negotiate with the selected respondent on any or all elements, and
to award accordingly.
8. CONTRACT TERM AND TERMINATION
The term ("Term") of any resulting Contract will begin upon date of Contract award. If mutually agreed upon in
writing by the Contractor and UA, the term shall be for a term of 2 Fiscal Years with the option to renew for 2
additional years, for a combined total of Four (4) years (or 48 months). The University of Arkansas may
terminate this Agreement without cause, at any time during the Term (including any renewal periods), by giving the
other party thirty (30) days advance written notice of termination. Additionally, in the event of non-appropriation of
funds necessary to fulfill the terms and conditions of this Agreement during any period of the Term (including any
renewal periods), the parties agree that this Agreement shall automatically terminate without notice.
8

a) If at any time the services become unsatisfactory, UA will give thirty (30) days written notice to the Contractor.
If at the end of the thirty (30) day period the services are still deemed unsatisfactory, the Contract shall be
cancelled by UA, Office of Business Affairs. Additionally, the Contract may be terminated, without penalty, by
UA without cause by giving thirty (30) days written notice of such termination to Contractor.
b) Upon award, the agreement is subject to cancellation, without penalty, either in whole or in part, if funds
necessary to fulfill the terms and conditions of this Contract during any biennium period of the Term (including
any renewal periods) are not appropriated.
c) In no event shall such termination by UA as provided for under this section give rise to any liability on the part
of UA, its trustees, officers, employees or agents including, but not limited to, claims related to compensation for
anticipated profits, lost business opportunities, unabsorbed overhead, misrepresentation, or borrowing. UA's sole
obligation hereunder is to pay Contractor for services ordered and received prior to the date of termination.
The terms, conditions, representations, and warranties contained in the Contract shall survive the termination of the
Contract.
9. GENERAL INFORMATION FOR RESPONDENTS
9.1 Distributing Organization
This RFP is issued by the Office of Business Affairs at UA. The University Purchasing Official is the sole point of
contact during this process. Only written communication is considered formal and can be supported throughout this
process.
Respondent Questions and Addenda: Respondent questions concerning all matters of this RFP should be sent via
email to: Geoff Hulse - Procurement Coordinator
Office of Business Services
ghulse@uark.edu
Questions received via email will be directly addressed via email, and compilation of all questions and answers
(Q&A), as well as any revision, update and/or addenda specific to this RFP solicitation will be made available on
HogBid, the UA bid solicitation website: http://hogbid/uark.edu . During the time between the bid opening and
contract award(s), with the exception of Respondent's questions during this process, any contact concerning this
RFP will be initiated by the issuing agency and not Respondent. Specifically, the persons named herein will initiate
all contact.
Respondents shall not rely on any other interpretations, changes, or corrections. It is Respondent's responsibility to
thoroughly examine and read the entire RFP document and any Q&A or addenda to this RFP. Failure of
Respondents to fully acquaint themselves with existing conditions or information provided will not be a basis for
requesting extra compensation after the award of a Contract.
9.2 Agency Employees and Agents
Contractor shall be responsible for the acts of its employees and agents while performing services pursuant to the
terms of any Contract. Accordingly, Contractor agrees to take all necessary measures to prevent injury and loss to
persons or property while on the UA premises. Contractor shall be responsible for all damages to persons or
property on and off campus caused solely or partially by Contractor or any of its agents or employees. Contractor's
employees shall conduct themselves in a professional manner and shall not use UA's facilities for any activity or
operation other than the operation and performance of services as herein stated. UA reserves the right to deny
access to any individual. The following conduct is unacceptable for Contractor's employees and agents: foul
language, offensive or distasteful comments related to age, race, ethnic background or sex, evidence of alcohol
influence or influence of drugs, refusal to provide services requested, refusal to make arrangements for additional
services needed and general rudeness. Contractor shall require standard criminal background checks on all
employees of the Contractor's business in advance of the performance of any on-campus duties. Employees whose
background checks reveal felony convictions of any type are to be either removed from all support activities on the
UA campus or reported to UA for review and approval in advance of the performance of any on-campus duties.
9

9.3 Tobacco Free Campus
Smoking and the use of tobacco products (including cigarettes, e-cigarettes, cigars, pipes, smokeless tobacco, and
other tobacco products) by students, faculty, staff, contractors, and visitors, are prohibited at all times on and within
all property, including buildings, grounds, and facilities, owned or operated by UA, including all vehicles on UA
property.
9.4 Disputes
Contractor and UA agree that they will attempt to resolve any disputes in good faith. Contractor and UA agree that
the State of Arkansas shall be the sole and exclusive jurisdiction and venue for any litigation or proceeding that may
arise out of or in connection with any Contract. The Respondent acknowledges, understands and agrees that any
claims, demands, suits, or actions for damages against UA may only be initiated and pursued in the Arkansas
Claims Commission, if at all. Under no circumstances does UA agree to binding mediation or arbitration of any
disputes or to the payment of attorney fees, court costs or litigation expenses.
9.5 Conditions of Contract
Contractor shall at all times observe and comply with federal and Arkansas State laws, local laws, ordinances,
orders, and regulations existing at the time of or enacted subsequent to the execution of the Contract which in any
manner affect the completion of work. Contractor shall indemnify and hold harmless UA and all its trustees,
officers, employees, volunteers, students, and agents against any claim or liability arising from or based upon the
violation of any such law, ordinance, regulation, order or decree by an employee, representative, or subcontractor of
the Contractor.
To the extent Contractor shall have access to, store or receive student education records, Contractor agrees to abide
by the limitations on use and re-disclosure of such records set forth in the Family Educational Rights and Privacy
Act (FERPA), 20 U.S.C. 1232g, and 34 CFR Part 99. Contractor agrees to hold student record information in
strict confidence and shall not use or disclose such information except as authorized in writing by UA or as required
by law. Contractor agrees not to use the information for any purpose other than the purpose for which the
disclosure was made. Upon termination, Contractor shall return all student education record information or provide
evidence that it was destroyed within thirty (30) days.
Compliance with digital accessibility standards. When procuring a technology product or when soliciting the
development of such a product, the State of Arkansas is required to comply with the provisions of Arkansas Code
Annotated 2526201 et seq., as amended by Act 308 of 2013, which expresses the policy of the State to provide
individuals with disabilities with access to information technology purchased in whole or in part with state funds.
Contractor expressly acknowledges and agrees that state funds may not be expended in connection with the
purchase of information technology unless that system meets the statutory requirements found in 36 C.F.R.
1194.21, as it existed on January 1, 2019 (software applications and operating systems) and 36 C.F.R. 1194.22, as
it existed on January 1, 2019 (webbased intranet and internet information and applications), in accordance with the
State of Arkansas technology policy standards relating to accessibility by persons with disabilities.
ACCORDINGLY, CONTRACTOR SHALL EXPRESSLY REPRESENT AND WARRANT to the State of
Arkansas through the procurement process by submission of a Voluntary Product Accessibility Template ("VPAT")
or similar documentation to demonstrate compliance with 36 C.F.R. 1194.21, as it existed on January 1, 2019
(software applications and operating systems) and 36 C.F.R. 1194.22, as it existed on January 1, 2019 (webbased
intranet and internet information and applications) that the technology provided to the State for purchase is capable,
either by virtue of features included within the technology, or because it is readily adaptable by use with other
technology, of:
Providing, to the extent required by Arkansas Code Annotated 2526201 et seq., as amended by Act
308 of 2013, equivalent access for effective use by both visual and nonvisual means;
Presenting information, including prompts used for interactive communications, in formats intended for
nonvisual use;
10