University of Arkansas - Cybersecurity Maturity Model Certification (CMMC) Program Services - RFP 09112026 (2026)
University Of ArkansasHigher Ed · Fayetteville, AR- Due
- Oct 16, 2026
- Deadline passed
- Posted
- Sep 11, 2026
- Contract term
- 2 years
- Primary contact
- Geoff Hulse
The 30-second brief
The University of Arkansas seeks proposals from qualified firms to provide cybersecurity advisory, architecture, engineering, compliance, and operational planning services for its Cybersecurity Maturity Model Certification (CMMC) Program under RFP Number 09112026. The engagement focuses on compliance maturation for CMMC Levels 1, 2, and 3, protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), designing cybersecurity control architecture, establishing continuous monitoring and security operations, and developing secure research environments. The contract term is for two fiscal years with the option to renew for two additional years. Proposals are due by October 16, 2026, at 2:30 PM CST via UA Formal Bid Submission. Questions are due by September 25, 2026.
Discovery and Current-State Assessment; CMMC Compliance Maturity Assessment; Cybersecurity Architecture Design; Governance and Operating Model; Continuous Monitoring Program; Compliance Automation Strategy; Assessment Readiness Support; Knowledge Transfer and Training
Complete/Thorough Technical Proposal (40 Points), Respondent Qualification (30 Points), Cost (30 Points)
Get notified when University Of Arkansas posts the next one.
Get alerts freeFree account · 30-second setup · No credit card
Summary
The University of Arkansas seeks proposals from qualified firms to provide cybersecurity advisory, architecture, engineering, compliance, and operational planning services for its Cybersecurity Maturity Model Certification (CMMC) Program under RFP Number 09112026.
The engagement focuses on compliance maturation for CMMC Levels 1, 2, and 3, protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), designing cybersecurity control architecture, establishing continuous monitoring and security operations, and developing secure research environments. The contract term is for two fiscal years with the option to renew for two additional years. Proposals are due by October 16, 2026, at 2:30 PM CST via UA Formal Bid Submission. Questions are due by September 25, 2026.
EVALUATION CRITERIA
REQUIRED DELIVERABLES
8- Discovery and Current-State Assessment
- CMMC Compliance Maturity Assessment
- Cybersecurity Architecture Design
- Governance and Operating Model
- Continuous Monitoring Program
- Compliance Automation Strategy
- Assessment Readiness Support
- Knowledge Transfer and Training
REQUIRED ATTACHMENTS
Official Price Sheet, Respondent Information/References
REQUIRED STAFFING
5- Submit to
- https://forms.uark.edu/xfp/form/906
- Duration
- 48 months
- Scope location
- Fayetteville, AR
- Reported agency
- University of Arkansas
Questions about this RFP
How do I respond to this RFP from University Of Arkansas?
Review the full solicitation document for submission requirements, evaluation criteria, and deadlines. The submission deadline is October 16, 2026. The solicitation specifies required deliverables that must be addressed in your response. Be sure to include all required attachments as outlined in the solicitation. Submissions should be delivered to: https://forms.uark.edu/xfp/form/906. For questions, contact Geoff Hulse.
Can small businesses or minority-owned firms bid on this RFP?
Most government agencies, including University Of Arkansas in AR, encourage participation from small businesses, minority-owned, women-owned, and disadvantaged business enterprises (MBE/WBE/DBE). Check the full solicitation for any small business participation goals.
What happens after the RFP submission deadline?
After the deadline, the issuing agency reviews all submissions against the stated evaluation criteria. This typically includes a compliance check, technical evaluation, cost analysis, and may involve oral presentations with shortlisted vendors.
Can I ask questions about this solicitation before submitting?
Yes, most solicitations allow vendors to submit questions during a designated period. The primary contact is Geoff Hulse. Questions and answers are typically shared with all prospective bidders.
What staffing is required for this project?
This solicitation outlines specific staffing requirements. The required roles include: Security Control Implementation Support, Security Engineering Support, Compliance Analyst Support, Security Architect Support, Project Manager Support. Proposers should demonstrate relevant qualifications and experience for each required role.
What are the key deliverables?
The solicitation specifies the following deliverables: Discovery and Current-State Assessment; CMMC Compliance Maturity Assessment; Cybersecurity Architecture Design; Governance and Operating Model; Continuous Monitoring Program; Compliance Automation Strategy; Assessment Readiness Support; Knowledge Transfer and Training. Proposals should clearly address how each deliverable will be met.
Show 5 more questions
What are the evaluation criteria for this solicitation?
This solicitation includes specific evaluation criteria that will be used to score proposals. The criteria include: "Complete/Thorough Technical Proposal (40 Points), Respondent Qualification (30 Points), Cost (30 Points)" Vendors should carefully align their proposals with each criterion to maximize their score.
Where can I find more RFPs from University Of Arkansas?
All active and historical solicitations from University Of Arkansas are tracked and searchable. As a higher ed agency, University Of Arkansas regularly publishes solicitations. Visit the agency profile to see current open bids, past contracts, vendor relationships, and decision-maker contacts.
What is the contract term for this solicitation?
The anticipated contract term is 2 years. Contract terms may include renewal options.
What documents are required to bid on this RFP?
Requirements vary by solicitation, but common documents include a technical proposal, cost/price proposal, proof of insurance, relevant certifications, past performance references, and any forms specified in the solicitation. This solicitation specifically requires the following attachments: Official Price Sheet, Respondent Information/References. Additionally, proposals should address staffing requirements as outlined in the solicitation. Review the full document from University Of Arkansas for the complete list.
What is the scope of this project?
This solicitation defines a specific project scope. The scope covers the following locations: Fayetteville, AR. Review the full solicitation for detailed scope requirements.