NS26-85 Military Installation Development Authority - Managed IT Services & CMMC Level 2 Compliance

The Military Installation Development Authority (MIDA), an independent nonprofit entity of the State of Utah, is soliciting proposals for comprehensive managed IT services and Cybersecurity Maturity Model Certification (CMMC) Level 2 compliance support. The procured services include help desk support, device management, cloud-based software administration, endpoint security and response, backup and disaster recovery, and incident response capabilities for approximately 20 remote-based users operating exclusively in cloud-based software environments with 15 company-owned laptops and 15 multifunction printers. Deliverables include managed IT service delivery, transition and implementation services (mobile device management deployment, current environment documentation, and .gov domain migration), and CMMC Level 2 compliance achievement (policy documentation, technical remediation, and support for one C3PAO assessment), with a target objective of achieving compliance readiness within four months of contract execution. Minimum qualifications require vendors to demonstrate a minimum of five years of managed IT services experience and provide certification that support operations comply with NIST SP 800-171 standards. Evaluation criteria are weighted as follows: plan and approach (30 percent), experience and references (20 percent), key personnel and qualifications (10 percent), interviews (10 percent), and cost (30 percent), with proposals required to achieve a minimum technical score of 75 percent to advance to the interview phase estimated for March 13, 2026. Critical deadlines include a Non-Disclosure Acknowledgement due February 17, 2026 at 5:00 pm (MST); a mandatory virtual pre-proposal meeting on February 19, 2026 at 10:00 am (MST); written questions due February 26, 2026 at 5:00 pm (MST); and electronic proposal submission via the Utah Public Procurement Place (U3P) by March 5, 2026 at 5:00 pm (MST), with proposals consisting of separate technical and cost files limited to 1GB per file.

The solicitation permits joint proposals with one subcontractor provided both the lead offeror and partner meet secure support operations requirements and at least one entity possesses the required five-year managed IT services experience; however, no specific set-asides for disadvantaged enterprises, minority-owned businesses, women-owned businesses, or other protected classifications are identified in the available procurement documents. No incumbent vendors or current contractors are referenced in the solicitation materials. The current infrastructure consists exclusively of cloud-based software applications with limited on-premises equipment, requiring vendors to integrate with and manage this existing cloud-centric environment while establishing CMMC Level 2 compliance protocols for an organization that currently does not process classified information but stores sensitive data including employee personally identifiable information, vendor banking information, and certain sales tax records. The cost proposal must itemize one-time project costs for transition, implementation, and CMMC Level 2 compliance separately and provide monthly operational costs calculated either as a fixed flat rate or per-user/per-device basis multiplied by 36 months for the anticipated three-year contract term, though specific budget ranges or award values are not disclosed in the procurement documentation.