University of Arkansas - Cybersecurity Maturity Model Certification (CMMC) Program Services - RFP 09112026 (2026)
University Of ArkansasHigher Ed · Fayetteville, AR- Due
- Oct 16, 2026
- Deadline passed
- Posted
- Sep 11, 2026
- Contract term
- 2 years
- Primary contact
- Geoff Hulse
- (475) 575-2000
The 30-second brief
The University of Arkansas is seeking proposals from qualified firms to provide cybersecurity advisory, architecture, engineering, compliance, and operational planning services to support the maturation of the University's Cybersecurity Maturity Model Certification (CMMC) Program. The engagement focuses on CMMC Levels 1, 2, and 3 compliance maturation, cybersecurity control architecture and operating models, continuous monitoring and security operations, secure research architecture, compliance automation, and assessment readiness and sustainment. The resulting term contract is for two (2) fiscal years with the option to renew for two (2) additional years. Proposals are due by October 16, 2026 at 2:30 PM CST via UA Formal Bid Submission. No pre-proposal conference will be held. Questions are due by September 25, 2026.
Level 1 Maturity review, Level 2 Maturity review, Level 3 Readiness review, Compliance Gap Analysis, Control Implementation Roadmap, Prioritized Remediation Plan, Assessment Readiness Strategy, Cybersecurity Control Framework, Control Ownership Matrix, Compliance Operations Model, Governance and Escalation Procedures, Compliance Lifecycle Management Process, Continuous Monitoring Strategy, Security Operations Monitoring Framework, Compliance Monitoring Requirements Matrix, Security Metrics Framework, Key Risk Indicator (KRI) Framework, Compliance Dashboard Requirements, Security Event Use Cases, Compliance Evidence Collection Framework, CMMC Environment Reference Architecture, Security Architecture Standards, Data Protection Standards, Access Control Architecture, Secure Research Environment Design Patterns, Scalability and Growth Planning Recommendations, Compliance Automation Strategy, Compliance Tooling Recommendations, Evidence Management Framework, Control Validation Procedures, Compliance Analytics Requirements, Repository framework/solution, Mock Assessment Results, Assessment Readiness Reports, Corrective Action Recommendations, Assessment Playbooks, Sustainment and Continuous Improvement Plan
Complete/Thorough Technical Proposal (40 Points), Respondent Qualification (30 Points), Cost (30 Points)
Get notified when University Of Arkansas posts the next one.
Get alerts freeFree account · 30-second setup · No credit card
Summary
The University of Arkansas is seeking proposals from qualified firms to provide cybersecurity advisory, architecture, engineering, compliance, and operational planning services to support the maturation of the University's Cybersecurity Maturity Model Certification (CMMC) Program.
The engagement focuses on CMMC Levels 1, 2, and 3 compliance maturation, cybersecurity control architecture and operating models, continuous monitoring and security operations, secure research architecture, compliance automation, and assessment readiness and sustainment. The resulting term contract is for two (2) fiscal years with the option to renew for two (2) additional years. Proposals are due by October 16, 2026 at 2:30 PM CST via UA Formal Bid Submission. No pre-proposal conference will be held. Questions are due by September 25, 2026.
EVALUATION CRITERIA
REQUIRED DELIVERABLES
37- Level 1 Maturity review
- Level 2 Maturity review
- Level 3 Readiness review
- Compliance Gap Analysis
- Control Implementation Roadmap
- Prioritized Remediation Plan
- Assessment Readiness Strategy
- Cybersecurity Control Framework
- Control Ownership Matrix
- Compliance Operations Model
- Governance and Escalation Procedures
- Compliance Lifecycle Management Process
- Continuous Monitoring Strategy
- Security Operations Monitoring Framework
- Compliance Monitoring Requirements Matrix
- Security Metrics Framework
- Key Risk Indicator (KRI) Framework
- Compliance Dashboard Requirements
- Security Event Use Cases
- Compliance Evidence Collection Framework
- CMMC Environment Reference Architecture
- Security Architecture Standards
- Data Protection Standards
- Access Control Architecture
- Secure Research Environment Design Patterns
- Scalability and Growth Planning Recommendations
- Compliance Automation Strategy
- Compliance Tooling Recommendations
- Evidence Management Framework
- Control Validation Procedures
- Compliance Analytics Requirements
- Repository framework/solution
- Mock Assessment Results
- Assessment Readiness Reports
- Corrective Action Recommendations
- Assessment Playbooks
- Sustainment and Continuous Improvement Plan
REQUIRED ATTACHMENTS
9- Official Bid Price Sheet
- Appendix I Official Bid Price Sheet
- Appendix II for format
- Minimum of three (3) references
- Proof of Insurance
- Bidder Conflict of Interest Form
- Contract and Grant Disclosure and Certification Form
- Signed digital copy
- Redacted copy (if applicable)
REQUIRED STAFFING
5- Submit to
- https://hogbid.uark.edu
- Duration
- 48 months
- Scope location
- Fayetteville, AR
- Reported agency
- University of Arkansas
Questions about this RFP
How do I respond to this RFP from University Of Arkansas?
Review the full solicitation document for submission requirements, evaluation criteria, and deadlines. The submission deadline is October 16, 2026. The solicitation specifies required deliverables that must be addressed in your response. Be sure to include all required attachments as outlined in the solicitation. Submissions should be delivered to: https://hogbid.uark.edu. For questions, contact Geoff Hulse.
Can small businesses or minority-owned firms bid on this RFP?
Most government agencies, including University Of Arkansas in AR, encourage participation from small businesses, minority-owned, women-owned, and disadvantaged business enterprises (MBE/WBE/DBE). Check the full solicitation for any small business participation goals.
What happens after the RFP submission deadline?
After the deadline, the issuing agency reviews all submissions against the stated evaluation criteria. This typically includes a compliance check, technical evaluation, cost analysis, and may involve oral presentations with shortlisted vendors.
Can I ask questions about this solicitation before submitting?
Yes, most solicitations allow vendors to submit questions during a designated period. The primary contact is Geoff Hulse at (475) 575-2000. Questions and answers are typically shared with all prospective bidders.
What staffing is required for this project?
This solicitation outlines specific staffing requirements. The required roles include: Security Control Implementation Support, Security Engineering Support, Compliance Analyst Support, Security Architect Support, Project Manager Support. Proposers should demonstrate relevant qualifications and experience for each required role.
What are the key deliverables?
The solicitation specifies the following deliverables: Level 1 Maturity review, Level 2 Maturity review, Level 3 Readiness review, Compliance Gap Analysis, Control Implementation Roadmap, Prioritized Remediation Plan, Assessment Readiness Strategy, Cybersecurity Control Framework, Control Ownership Matrix, Compliance Operations Model, Governance and Esc. Proposals should clearly address how each deliverable will be met.
Show 5 more questions
What are the evaluation criteria for this solicitation?
This solicitation includes specific evaluation criteria that will be used to score proposals. The criteria include: "Complete/Thorough Technical Proposal (40 Points), Respondent Qualification (30 Points), Cost (30 Points)" Vendors should carefully align their proposals with each criterion to maximize their score.
Where can I find more RFPs from University Of Arkansas?
All active and historical solicitations from University Of Arkansas are tracked and searchable. As a higher ed agency, University Of Arkansas regularly publishes solicitations. Visit the agency profile to see current open bids, past contracts, vendor relationships, and decision-maker contacts.
What is the contract term for this solicitation?
The anticipated contract term is 2 years. Contract terms may include renewal options.
What documents are required to bid on this RFP?
Requirements vary by solicitation, but common documents include a technical proposal, cost/price proposal, proof of insurance, relevant certifications, past performance references, and any forms specified in the solicitation. This solicitation specifically requires the following attachments: Official Bid Price Sheet, Appendix I Official Bid Price Sheet, Appendix II for format, Minimum of three (3) references, Proof of Insurance, Bidder Conflict of Interest Form, Contract and Grant Disclos. Additionally, proposals should address staffing requirements as outlined in the solicitation. Review the full document from University Of Arkansas for the complete list.
What is the scope of this project?
This solicitation defines a specific project scope. The scope covers the following locations: Fayetteville, AR. Review the full solicitation for detailed scope requirements.