Cyber Security Maturity Model Certification Assessment Service

Overview

Cybersecurity & Data Privacy

College Park, Maryland, United StatesPosted 3 days agoDeadline: May 26th, 2026

Fit Score

Settle Intelligence

Settle helps teams find, evaluate, and respond to public RFPs. We continuously surface new opportunities, score them against your company strengths, and draft proposal responses so you can focus on the work that wins business.

SUMMARY

Maryland government authority seeks a CMMC Certified Third-Party Assessor Organization to perform Level 2 certification assessments for two distinct Azure Government High tenant environments. The scope includes hybrid security responsibilities spanning on-premises, Azure GCC High, and external service providers.

KEY REQUIREMENTS

Must be an authorized CMMC Certified Third-Party Assessor Organization (C3PAO)
Must have experience assessing hybrid Microsoft/Azure environments, specifically Azure Government GCC High
Must be able to perform CMMC Level 2 certification assessments for two separate information systems
Must ensure all personnel assigned to the project are United States citizens
Must be able to handle Controlled Unclassified Information (CUI) in accordance with DFARS 252.204-7012 and NIST SP 800-171
Must provide a plan for assessing identically configured tenants while maintaining assessor independence
Must provide proof of current eligibility as a C3PAO
Must provide at least three references for comparable engagements

BUDGET

Estimate

$50,000 – $150,000

TIMELINE

Issue Date: May 5th, 2026

Pre-Proposal Conference: May 12th, 2026

Deadline for Questions: May 16th, 2026

Proposal Due Date: May 26th, 2026

QUESTION DEADLINE

May 16th, 2026

Issuing Agency

University Of Maryland, College Park

Organization overview and procurement intelligence available on paid plans.

See Issuer Research

DESCRIPTION

A government authority in Maryland is seeking a vendor to provide Cyber Security Maturity Model Certification (CMMC) assessment services. The selected firm must be a Certified Third-Party Assessor Organization qualified to perform CMMC Level 2 certification assessments.

The work involves assessing two separate information systems implemented as two distinct Azure Government High tenants. Although each tenant is separate and has its own boundary, both are configured identically and will be assessed under the same CAGE code. The environment includes shared security responsibilities across on-premises infrastructure, Azure GCC High, and SaaS or other external service providers.

A pre-bid meeting is scheduled for May 12, 2026. Questions must be submitted no later than May 16, 2026.

Source attribution

This Settle analysis is based on the issuing organization’s public RFP listing.