Identity and Access Management Request for Proposal (RFP)

Transcription

1 Identity and Access Management Request for Proposal (RFP) Distributed by: Oakland County Purchasing 2100 Pontiac Lake Road, Bldg. 41W Waterford, MI September 19, 2013

2 Table of Contents 1.0 INTRODUCTION BACKGROUND INFORMATION OAKLAND COUNTY OVERVIEW INFORMATION TECHNOLOGY OVERVIEW G2G CLOUD SOLUTIONS OVERVIEW G2G MARKETPLACE OVERVIEW IDENTITY AND ACCESS MANAGEMENT OVERVIEW CURRENT SYSTEMS OVERVIEW IDENTITY AND ACCESS MANAGEMENT REQUIREMENTS GENERAL BUSINESS OBJECTIVES FUNCTIONAL AND TECHNICAL REQUIREMENTS IMPLEMENTATION SERVICES REQUIREMENTS LICENSING AND SYSTEM SUPPORT REQUIREMENTS RESPONSE SUBMISSION REQUIREMENTS PROPOSAL SUBMISSION DEADLINE LATE PROPOSALS, MODIFICATIONS, OR WITHDRAWAL PACKAGING EXCEPTIONS PRICE QUOTATIONS RELIANCE ON RFQ CONTENT ACCEPTANCE OF RFP CONTENT PROPOSALS BINDING DULY AUTHORIZED SIGNATURE PROPOSAL COSTS ECONOMY OF PROPOSALS MULTIPLE PROPOSALS PRIME CONTRACTOR RESPONSIBILITY COMPLETE SERVICES/PRODUCTS PRICE PROPOSAL REQUIREMENTS PRICE PROPOSAL CONTENT i

3 5.2 PER-USER OR PER-LOGIN PRICING PROPOSALS INTENT TO RESPOND FORM REQUESTS FOR CLARIFICATION PROPOSAL FORMAT INTRODUCTION AND EXECUTIVE SUMMARY EXPERIENCE AND QUALIFICATIONS RESPONSE TO COMMERCIAL QUESTIONS RESPONSE TO IAM SOLUTION REQUIREMENTS PRICE PROPOSAL SELECTION CRITERIA ORAL PRESENTATIONS TIMETABLE PROJECT CONTACT OTHER RELATED MATTERS APPENDIX A: INTENT TO RESPOND FORM APPENDIX B REQUIREMENTS RESPONSE TABLES APPENDIX C IMPLEMENTATION SERVICES RESPONSE TABLES APPENDIX D COST RESPONSE TABLES APPENDIX E OAKLAND COUNTY IAM USE CASES ii

4 1.0 INTRODUCTION The Oakland County Purchasing Department is issuing this Request for Proposal (RFP) to obtain SEALED BID proposal responses for an Identity and Access Management solution to facilitate user account management for the County s IT infrastructure, G2G Cloud Solutions, and G2G Marketplace. The objective of this RFP is to provide sufficient information to enable qualified respondents to submit written proposals. This RFP is not a contractual offer or commitment to purchase services. Respondents must be bona fide providers of the products and services requested, using a solution that is currently installed and working at customer sites that may be verified and validated by representatives of Oakland County. To respond to this RFP, proposals must conform to the procedures, format, and content requirements outlined in this document. Significant deviations may be grounds for disqualification. Oakland County reserves the right to waive, at its discretion, any irregularity or informality that Oakland County deems correctable or otherwise not warranting rejection of the RFP. 1

5 2.0 BACKGROUND INFORMATION The following background information has been provided in support of the Identity and Access Management RFP. Additional information regarding this RFQ can be found on the Michigan Inter-governmental Trade Network (MITN) website at Oakland County Overview Oakland County, Michigan is located in southeast Michigan, immediately north of the City of Detroit. The county covers 910 square miles and encompasses 62 cities, villages and townships (CVTs). Located astride the Interstate 75 corridor and at the heart of Automation Alley, Oakland County is a world technology center. Oakland County s population is approximately 1.2 million, encompasses 440,000 parcels of property, and features one of the lowest operating tax rates in the state of Michigan. Oakland County continues to be 1 of the 36 counties in the nation with the coveted AAA bond rating. Additional information can be found on Oakland County s website at Information Technology Overview The Department of Information Technology (IT) is a service bureau that provides Information Technology services to 82 County Divisions, more than 100 local governmental units (assessor s office, treasurer s office, law enforcement, prosecutor s office, etc.). IT is responsible for over 150 major applications consisting of more than 8,000 programs. IT provides systems support, maintenance, enhancements, and new development for all major systems applications. The Department of Information Technology employs 150+ staff, is under the administration of the County Executive, and is comprised of the following organizational divisions: Administration Internal Services Application Services CLEMIS & Public Safety Technical Systems & 2

6 Networking Overall, Information Technology s customer base spans several different disciplines, including: Health & Human Services Equalization & Treasurer Court Services Finance & Human Resources Public Safety (Police, Fire, EMS) Water Resources Commissioner Clerk/Register of Deeds MSU Extension - Oakland Facilities Management Parks & Recreation Sheriff Prosecutor County Executive Board of Commissioners Cities, Villages, & Townships External Customers Oakland County International Airport Community & Economic Development Additional information about the Oakland County Department of Information Technology can be found on the web at G2G Cloud Solutions Overview Enterprise technology solutions save time and money for government and the people it serves. But many governments, particularly smaller municipalities, lack the means to implement the large scale, advanced technology solutions that could relieve pressures on operational budgets. In addition, some governments have concerns about the long-term costs, privacy and security of private-sector technology solutions. Third-party solutions can meet some government technology needs, but these sometimes also include high-cost barriers to entry and other hidden risks. Oakland County formed G2G Cloud Solutions to support technology sharing among governments via the web. G2G Cloud Solutions is based on the idea that governments can work together to create a sustainable model for digital government by sharing and leveraging technology for mutual benefit. Through G2G Cloud Solutions, participating government agencies benefit from the opportunity to use technology that may not otherwise be within reach. The government-managed technology solutions available through G2G Cloud Solutions support reduced operating costs and increased reliability, 3

7 security, and privacy protection for government data. G2G Cloud Solutions enables governments to use enterprise IT applications and services on an asneeded basis, reducing operating costs for participating governments. Oakland County is seeking to make a wide array of solutions available not only to its 62 local municipalities, but also any other government who wishes to use the technology. 2.4 G2G Marketplace Overview The goal of G2G Marketplace is to enable more efficient, cost-effective government operations by sharing Oakland County solutions, as well as those from approved vendors and government partners, with other government agencies. Following the G2G Cloud Solutions model, the G2G Marketplace will provide governments with an easy-to-use, cost-effective way to research, purchase, and provision cloud solutions and other services under pre-negotiated blanket purchase agreements and contracts. The G2G Marketplace will be designed to be a catalog and service bureau. It will be developed as a multimedia-rich information portal where any government agency can research and provision ecommerce, web site hosting, and other government solutions. The G2G Marketplace will be a service that will provide other government agencies access to vendors who provide technology solutions for government. The marketplace will also be a cloud solution open to all governments to participate in, and submit and share their own products and services with other government agencies. G2G Marketplace will provide an application store experience that will allow users to select different cloud and other related solutions from a variety of vendors and government partners. The G2G Marketplace will be available to public bodies such as the governments of states, counties, cities, villages, townships and municipalities, as well as courts, libraries, schools and other agencies chartered by government. The G2G Marketplace will be accessible by desktop, laptop, smartphones, tablets, and other mobile devices. 4

8 2.5 Identity and Access Management Overview Oakland County, like most organizations, is a complex mix of people, processes, and products. In the modern world, utilizing technology in the course of accomplishing an organization s goals and objectives is an absolute necessity. To this end, Oakland County has created an intricate system of computer applications and services that run on servers located in the network to accomplish tasks efficiently and effectively. This data must be kept secure and contained for the sake of employee and customer privacy in a number of contexts (including Public Health, Courts, and other arenas that mandate data security by law). Additionally, as the Internet and cloud-based services play a larger role in governmental business, Oakland County wishes to utilize the cloud and help other governments do the same through G2G Cloud Solutions. Identity and Access Management represents the means by which organizations and applications keep track of users and their authentication and authorization in various contexts. This is best represented in a username and password combination, which serve to authenticate an end user in a system (for example, ) and retrieve authorizations and permissions within the system. Usernames and their corresponding passwords are unique to each user within each mutually exclusive application; thus, each combination represents an identity. Management of these identities in a central database is at the core of IAM. Currently, Oakland County s implementation of IAM exists between a number of services and applications. The purpose of this RFP is to evaluate industry leading IAM vendors that may be able to enhance, unify or replace the current system, resulting in increased security, productivity, and efficiency. Oakland County is also looking to the cloud for possible avenues of service. In order to manage data flow, a centralized system of identifying and provisioning users on Oakland County s network has been established to allow Human Resources and managers to administer individual user s access to particular data and applications. This is to keep data secure both within the organization and outside, as well as to guard against computer hackers on the Internet. This is Oakland County s Identity and Access Management (IAM) solution, which 5

9 facilitates the management of user accounts for all people and technology across the entire organization. 2.6 Current Systems Overview The primary IAM solution utilized by Oakland County is Microsoft Active Directory (AD). Active Directory is Microsoft s implementation of the Lightweight Directory Access Protocol (LDAP) in concert with Kerberos and Domain Name System (DNS). This allows the County s collection of unique identities to be managed from a central location. Users and devices on a network can be categorized and given permissions by administrators. Applications can synchronize identities using Active Directory as the arbiter between the user and the application. Active Directory will allow for a user s Windows login and password to be linked with their Outlook address, removing the necessity for both the user and the organization to juggle multiple identities for the same user. This feature is known as Single Sign-On (SSO). The Active Directory software maintains a database of all users and technology connected to an internal network and maintains the authentication and authorization of that database. When a user logs into a Windows computer on the Oakland County network, they are authenticating against an AD database. Within an AD database, there is considerable granularity regarding a user s permissions within the network. Users can inherit permissions in a hierarchy and they can also be grouped together in relevant contexts. However, many applications currently in use by Oakland County do not have access to the IAM database. These applications maintain their own database of usernames, passwords and permissions that are mutually exclusive from any other application. It may be the case that these applications can be retrofitted to conform to a more standard IAM solution, although if the County determines that the cost of doing so outweighs the benefits, certain applications may need to be grandfathered. In that case, it may be advantageous to utilize a SSO vendor to interface with Active Directory and other IAM databases to facilitate Single Sign- On with a wider variety of applications. The SSO vendor can work with the applications and Software as a Service (SaaS) providers to synchronize an 6

10 Active Directory or other database with their login database. Oakland County is also utilizing CA SiteMinder and IdentityMinder to allow for federated ESSO between county applications. The CA software authenticates against an internal Active Directory, then a legacy Sun LDAP server. Currently, CA is implemented in a limited number of applications at Oakland County. There are also a number of custom legacy applications which contain their own userstore and are thus not integrated into either CA or Active Directory. 7

11 3.0 IDENTITY AND ACCESS MANAGEMENT REQUIREMENTS The requirements set forth in this section of the RFP serve as a minimum guideline for Oakland County s needs in its selection of an IAM solution. The requirements for the IAM solution have been grouped into the following sections: General Business Objectives, Functional and Technical Requirements, Implementation Services Requirements, and Licensing and Software Support Requirements. 3.1 General Business Objectives Oakland County seeks to obtain an IAM solution that satisfies the following business objectives: Intelligence The IAM system must allow for rule-based decisions to be made on policy for the identities that it manages. This includes the collection and analysis of user data on a per-user or per-profile basis. Administration The IAM system must perform identity-related tasks, such as creating and provisioning a user account. The software must handle tasks in an automated fashion using logic and conditionality. Authenticaiton The IAM system must have robust functionality for authenticating a user s identity. This authentication must be federated in some way to facilitate SSO across cloud services. Authorization The IAM system must handle the assignment of roles to users, and the resulting limitations on data access within the system. An employee should only be able to access and modify data that is pertinent to his or her job. Respondents must describe how their system supports these business objectives as well as highlight the realizable tangible and intangible benefits Oakland County could expect to gain from selecting their solution. Respondents must address the general business objectives set forth in the RFP. 8

12 3.2 Functional and Technical Requirements Appendix B contains an inventory of requirements for proposed Identity and Access Management solutions. Respondents must complete the requirements tables in Appendix B. IAM proposals that do not satisfy the mandatory requirements outlined in Appendix B will be rejected. In addition to completing the requirements tables in Appendix B, respondents must provide responses to the requirements specified in the remainder of this section. 1. Provide detailed answers to the following requirements: a. Centralized Identity Store Explain how your solution provides the ability to centralize users in a single repository or while managing them locally via policy-based access controls, reducing the risk of identity duplication and increasing security for the County. b. Single Sign-On (SSO) Explain how your solution allows the user to login once and have access to all of their essential work applications without repeat logins and differing usernames and passwords. Explain your SSO solution s ability to provide a federated mechanism to extend access control and SSO across cloud services and organizational boundaries. c. Flexible Security Policies Explain how your solution enables security administrators to define flexible security policies and automate their enforcement across a wide variety of content, applications and resources. Also explain how your solution uses global or group policies that allow rule-based, role-based and time-based controls. For example, a policy might require an employee be on the internal county network to use an application within the hours of 8:30a to 5:00p. d. System Accounting, Compliance and Auditing Reporting Explain how your solution records user activity such as data/timestamp of logins, IP address, number of attempts, number of transactions and which resources were accessed. Also explain how your solution 9

13 supports compliance and auditing efforts by documenting that identity controls are in place and working as intended. Finally, explain the extent to which your solution provides audit reports for all user and administrator activity. e. Security Protection Standards Explain how your solution protects County content, applications and data from hackers and external or internal security breaches. Additionally, explain how your system handles multifactor authentication. f. Active Directory Synchronization Explain how your solution integrates with Microsoft s Active Directory database. g. User Self-Service Explain how your solution enables users to manage their own profile, password and entitlements in order to drive down support costs. An example of this functionality is self-serve reset of forgotten passwords. h. Availability Explain how your product will be functional for 24/7 with no downtime except for stated maintenance windows. 2. Respondents must discuss the top five distinguishing features of their IAM service and/or software package. System functionality in Appendix B and outlined above that must be customdeveloped by the respondent must be clearly identified in the response. The respondent is encouraged to include required custom-developed functionality in Appendix B. Respondents shall describe how the additional features and upgraded modules can be incorporated into the basic system used by the County. Value-added functions not listed above as requirements will be considered during the evaluation of all proposals. If a proposed solution contains any other features which are not listed in Appendix B, the respondent is encouraged to include the description of the functionality in their Appendix B response. Respondents should indicate all optional equipment necessary for such value-added functions. Costs for system functionality must be documented in Appendix D Cost Response Tables. 10

14 3.3 Implementation Services Requirements Respondents must provide responses to the implementation services requirements specified in this section of the RFP. 1. Respondents must provide the implementation services described below as part of the IAM system implementation. Respondents should describe the implementation services including assumptions and exclusions, approach and estimated effort for the following services: Server setup Active Directory synchronization and setup Application integration Administration walkthrough Database and log backups Optional: Cloud setup 2. Respondents must provide an implementation plan that clearly indicates the roles and responsibilities of the respondent and those of Oakland County, keeping in mind that the goal of the County is to have the IAM system implemented as soon as possible. The implementation plan shall at a minimum outline tasks, skill types, and estimates by resource provider resulting in a proposed schedule starting from the date of contract execution. Please include definition and expectation of skill level for each skill type used in the implementation plan. In addition, please include a total number of Oakland County staff required by skill type listed. Respondents must use Appendix C Table C-1. Implementation Plan Table as the format for an implementation plan. The implementation plan format contains the following high-level phases of potential work: Project Management contains activities to manage the project. Technical Design and Installation contains activities for server and IAM hardware configuration. Education, Marketing and Standards/Policies contains activities for 11

15 training, promotion, standards and policies. Implementation contains activities for system launch and disaster recovery. Implementation costs should include any travel and personal expense figures if required. Post Implementation Support contains activities for system support. 3. The implementation plan must be supported by a Statement of Work narrative describing the tasks and responsibilities of the respondent and those of Oakland County, and critical risk factors. Respondents must provide a proposed Statement of Work that will, at a minimum, discuss the following activities: Server Setup and Configuration System User Training (if required) Implementation and Launch Support Post Implementation Support Respondents must include professional services required for the IAM system implementation in their RFP response that satisfies the requirements set forth in the RFP. Costs for implementation services must be documented in Appendix D Cost Response Tables. 3.4 Licensing and System Support Requirements Respondents must provide responses to the licensing and system support requirements specified in this section of the RFP /7 support should be provided. 2. All license agreements should be provided. 3. Warranty requirements should be explained. 4. Third party software and/or hardware requirements should be provided. 5. Maintenance issues such as routine server downtime should be provided. 6. System release/patch cycles should be explained. 7. System documentation should be provided. 12

16 Respondents must provide licensing and system support services required for the IAM solution that satisfies the requirements set forth in the RFP. Costs for implementation services must be documented in Appendix D Cost Response Tables. Licensing, if required, must address any service provider licensing necessary to make the solution provided available to other governments through the G2G Marketplace. 1. All license agreements should be provided. 2. Warranty requirements should be explained. 3. Third party software and/or hardware requirements should be provided. 4. Software release/patch cycles should be explained. 5. Software documentation should be provided. 6. Support and SLA agreements should be provided. 7. Vendor has read and understands the Oakland County Professional Services Contract requirements. 13

17 4.0 RESPONSE SUBMISSION REQUIREMENTS The administrative rules and procedures that guide the proposal process are described in this section. Failure of the respondent to adhere to them may result in elimination of the respondent from further consideration in the proposal selection process. 4.1 Proposal Submission Deadline Three (3) hardcopies and one (1) CD with proposals in Adobe Reader PDF format of your proposal, clearly marked Oakland County IAM Proposal Bid Response Event must be received and stamped by the Oakland County Purchasing Division no later than October 24, 2:00 PM. Mailing label is provided in Purchasing document SOL. Proposals may be either mailed or hand-delivered. If the proposal is sent by mail or commercial express service, the respondent shall be responsible for actual delivery of the proposal to the proper Oakland County office before the deadline. All proposals become the property of Oakland County. The content of all proposals shall be held confidential and sealed until after the submission deadline. 4.2 Late Proposals, Modifications, or Withdrawal Proposals received after the date and time indicated will not be considered and will be returned unopened if the respondent is identified on the proposal envelope. Proposals may be withdrawn or modified in writing prior to the proposal submission deadline. Proposals that are resubmitted or modified shall be resealed and submitted to the previously identified Oakland County Purchasing Division prior to the proposal submission deadline. 14

18 4.3 Packaging Each proposal must be sealed to provide confidentiality of the information prior to the submission date and time. Oakland County will not be responsible for premature opening of proposals not properly labeled. Clearly mark one proposal copy as the Master Proposal and enclose originals of the required forms. Each proposal set shall be accompanied by a transmittal letter signed in ink by an authorized company representative, empowered with the right to bind the respondent. 4.4 Exceptions Any exceptions to the attached specifications or RFP objectives must be clearly stated in the formal quote letter under a separate section entitled Exceptions. If any exceptions are taken, an explanation must be made giving in detail the extent of the exception and the reason for it. Failure on the part of the respondent to list exceptions as instructed above will be interpreted that the respondent has taken no exceptions and that the offering is in complete conformance to the specifications and RFP objectives contained herein. Any exceptions or deviations discovered after the closing date will be to the Vendor s account and, consequently, will not be negotiated. 4.5 Price Quotations All prices shall be quoted in U.S. dollars. Fixed prices for software, services, and hardware should be quoted, wherever possible. Where uncertainty exists, quote estimated costs or a range of costs. Unless respondents specifically note otherwise, prices quoted will be considered firm. If any additional purchases are required through one year from award date of the contract, they shall be at the contract unit price. In case of error in the extension of prices in the proposal, the unit prices shall govern. 4.6 Reliance on RFQ Content The County shall be entitled to rely on the proposal for future possible contract 15

19 negotiations. 4.7 Acceptance of RFP Content Provisions of the RFP and the contents of the successful response will be used for establishment of the final contractual obligations. Oakland County retains the option of canceling the award if the selected respondent fails to accept such obligations. Oakland County and the selected respondent shall enter into a written contract for the work to be performed. It is expressly understood that this RFP and the respondent s proposal may be attached and included in an agreement signed by Oakland County and the selected respondent. 4.8 Proposals Binding All proposals submitted shall be binding upon the respondent, if accepted by Oakland County, for 180 calendar days from the proposal submission deadline. No proposals may be withdrawn during this 180-day period. Negligence upon the part of the respondent in preparing the proposal confers no right of withdrawal after the time fixed for the submission of proposals. 4.9 Duly Authorized Signature The proposal must contain the signature of a duly authorized officer of the respondent empowered with the right to bind the respondent Proposal Costs The respondent shall be responsible for all costs incurred in the development and submission of this proposal. Oakland County assumes no contractual obligation as a result of the issuance of the RFP, the preparation or submission of a proposal by a respondent, the evaluation of an accepted proposal, or the selection of finalists. Oakland County shall not be contractually bound until Oakland County and the selected respondent have executed a written contract for performance of work. 16

20 4.11 Economy of Proposals Proposals and presentations should be prepared simply and economically, providing a straightforward and concise description of the respondent s capabilities to satisfy the requirements of the RFP. Special bindings, colored displays, etc. are not necessary. Emphasis should be placed on completeness and clarity of content Multiple Proposals Multiple proposals or substitutions will be considered and are defined as the submission by the same respondent of two or more responsive proposals offering variations in the hardware and software configurations each of which meet the requirements of the RFP. Multiple proposals shall be submitted separately, clearly noted as alternatives and will be evaluated as independent proposals Prime Contractor Responsibility Respondents have an option of subcontracting for products and services they propose. If any products or services are to be subcontracted, the respondent shall provide, within the proposal, a description of the subcontracting organization and the contractual arrangements made therewith. All subcontractors will be subject to approval by Oakland County. The selected respondent will also furnish the corporate or company name and the names of officers or principals of said companies proposed as subcontractors. Oakland County will consider the prime contractor to be solely responsible in all contractual matters, including payment of any and all charges resulting from such subcontractor arrangements. The selected respondent shall cause appropriate provisions of its proposal to be inserted in all subcontracts ensuing to insure fulfillment of all contractual provisions by subcontractors Complete Services/Products The selected respondent shall be required to (1) furnish all tools, equipment, 17

21 supplies, supervision, transportation, and other accessories, services, and facilities necessary to complete the work (2) furnish all materials, supplies, and equipment specified and required to be incorporated in and form a permanent part of the completed work (3) provide and perform all necessary labor; and (4) perform and complete the work in accordance with good technical practice, with due diligence, and in accordance with the requirements, stipulations, provisions, and conditions of this RFP and the resultant agreement. 18

22 5.0 PRICE PROPOSAL REQUIREMENTS Respondents are required to submit separate and distinct price information for their primary system proposal and any alternatives in a separate section. All price quotations shall be valid for 180 days from the proposal due date. The respondent will be responsible for achieving an operational configuration for the cost quoted. The cost of any items determined to be missing from the quote but essential to fulfilling the configuration shall be borne by the respondent. 5.1 Price Proposal Content Every respondent shall provide an itemized Price Proposal including Appendix D Cost Response Tables. Quote costs for all software and services described in Section 3, Appendix B, and Appendix C of this RFP. Each major component, including integrated software and hardware elements, shall be identified by both common names. Both unit prices and extensions (if applicable) shall be quoted for each component or basic subsystem. Any and all items (such as software interfaces, cables, connectors etc.) needed to achieve the proposed configuration shall be identified and priced. Any and all additional charges (i.e., shipping, installation, insurance etc.) shall be quoted. In addition: 1. The cost of system documentation must be included in the total solution costs. 2. Quote annual costs for the proposed maintenance agreement where applicable. In addition, list cost of training increments included with the system purchase. Quote the cost of additional training increments along with any conditions attached to their purchase. 3. Quote a lump sum and hourly rates for implementation services and consulting services that could be enlisted for the implementation of the IAM solution. 4. List separately any optional features price, but do not include these optional features in the total system price. 19

23 5. Specify any discount options associated with the proposal(s). If applicable, State Bulletin prices should be included for reference. 5.2 Per-User or Per-Login Pricing There will be two different types of users for any IAM solution chosen by Oakland County or G2G Cloud Solutions. These two types of users will be divided based on the frequency with which they will utilize their accounts within the IAM solution. The first type of user will be an enterprise customer who will log into the system multiple times per day on a regular and ongoing basis. The second type of user will typically be a member of the public who will log into the system very infrequently on an irregular basis. The number of users in this second category may be several orders of magnitude more than the first category for example, the first group could contain 3,000 users while the second could contain 3,000,000 users. Oakland County and G2G Cloud Solutions are interested in exploring various licensing models which allow for either per-user or per-login pricing models, or ideally a combination of the two. In the first instance, a user or group of users is licensed with the allowance of an unlimited number of logins between them. In the second instance, a pool of logins is licensed with the allowance of an unlimited number of users between them. These two pricing models align with the aforementioned two categories of users. If the vendor is able to provide these pricing models, or another pricing model not specified here that will accommodate the groups of users listed above, make note of it in Appendix D Table D-3. 20

24 6.0 PROPOSALS To expedite and simplify proposal evaluation and to assure that each proposal receives the same orderly review; all proposals must comply with Section 4 Response Submission Requirements of the RFP and adhere to the format described in this section. Proposals must contain the elements of information specified. Proposal sections and pages should be appropriately numbered. Any variances from specifications, which may be proposed, must be specifically noted. 6.1 Intent to Respond Form Respondents that intend to respond to the Identity and Access Management RFP must scan and return via the Intent to Respond Form (Appendix A) to [email protected] and [email protected] with the subject titled Event Intent to Respond no later than October 3, 2013 at 5:00pm EST. Potential partners must provide their contact information on the Intent to Respond Form. If for any reason, the Intent to Respond Form cannot be returned by the above date, the Respondent must notify the Project Contact listed above immediately and demonstrate cause and extent of delay. 6.2 Requests for Clarification Requests for Clarification must be submitted to the Project Contact no later than October 10, 2013 at 5:00pm EST. Questions will not be entertained after this date. Any requests for clarification or additional information regarding the RFQ shall be directed via to [email protected] and [email protected] the subject title of the must contain Identity and Access Management RFP Questions. The must include the specific section(s) of the RFQ in question. Questions, requests for clarification and/or additional information regarding this RFQ will be publicly available and not kept confidential. Responses to vendor questions will be published on MITN at and vendors are encouraged to register on MITN. This bid and any addendums to this bid will also be published on MITN. Response to questions, this bid or any addendums will not be sent directly to vendors. For you convience any 21

25 addendums to this RFQ will also be posted on MITN. 6.3 Proposal Format Proposals must include a table of contents listing all sections, figures, and tables. Major sections and appendices should be separated by labeled ring binder index tabs. Pages may be double-sided, and must be numbered. The respondent must include a copy of their organization s standard Software Licensing and/or Services Agreement(s) as an Appendix to the Proposal. This agreement shall cover the licensing details for all aspects of proposed system. Proposals must address the requirements completely and accurately using the required format. The proposals shall be organized according to the following outline: Transmittal Letter Division 1: Division 2: Division 3: Division 4: Division 5: Division 6: Appendix: Introduction and Executive Summary Experience Response to Commercial Questions Response to IAM Solution Requirements Price Proposal Technical Proposal Software Licensing and Services Agreements Introduction and Executive Summary 1. Submit a brief executive summary of the major facts or features of the proposal, including any conclusions, assumptions, and recommendations the respondent desires to make. The executive summary should be designed specifically for review by a non-technical audience and senior management. 2. Submit the following information relative to the respondent. If a joint venture, similar information must be provided for each member of the joint venture. 22

26 Company name and business address, including telephone number, fax number and Internet address. Year established (include former firm names and year established, if applicable). Type of ownership and parent company if any. Respondent s contact name, address, and phone number, if different than Item 1. Brief statement of the firm s background demonstrating longevity and financial stability. 3. Review Oakland County Professional Services Contract. Acknowledge review and submit itemized descriptions of exceptions with response to RFP. 4. Submit a brief description of respondent s corporate and other organizational history and experience in developing, installing, and supporting IAM solutions for governments of comparable or larger sizes. 5. Include discussion of respondent s corporate vision and strategy for addressing the needs of the IAM market. 6. Include a discussion of the respondent s corporate vision and strategy related to its IAM solution addressing the needs of the IAM market Experience and Qualifications 1. Submit a description of at least three relevant IAM installations. Relevant is defined as installations using the hardware and software products similar to those proposed for the Oakland County IAM solution and installations exhibiting the functional and integration components set forth in the RFP. 23

27 The description must provide the following information at minimum: Organization Name, Contact Person with Address, Telephone Number and Address, Participating Organization, Hardware and Software Environment, Date of Installation, Status of Implementation and Discussion of activities and applications. The respondent agrees that Oakland County may contact the references given if desired. 2. Submit job descriptions and qualifications for each team member that will be assigned to the Oakland County IAM project. Vendor staff qualifications must include longevity with firm, relevant certifications, brief project/assignment history with your company, educational background, and employment history Response to Commercial Questions Please answer the following questions directly and specifically, and cite the question before each answer. 1. Provide insurance information for Worker s Compensation, Comprehensive General Liability. Contact Oakland County s Purchasing Department with questions in this regard. 2. Who will be the respondent s authorized negotiator? (Provide name, title, address, telephone number, and address. The person identified shall be empowered to make binding commitments for the respondent). 3. What is the current financial status and conditions of the respondent? (Provide a copy of the respondent s most current financial annual report and statement of financial condition, or equivalent). 4. Is the respondent an equal opportunity employer? 5. Will the respondent contractually agree to the following: a. Provide onsite (e.g., at Oakland County) staff for training? 24

28 b. Knowledge transfer to Oakland County staff regarding implementation, integration, etc. c. Guarantee 1-2 hour response time for critical situations reported to your service desk? d. Non-performance holdbacks? e. Source code provided to Oakland County? To escrow? f. Allow Oakland County to approve vendor staff assigned to project? g. Provide a Statement of Work that includes, in detail, all deliverables, costs, change control and project management procedures, etc.? h. Provide Oakland County with system documentation for all application modules, including custom modifications and interfaces? i. Indemnify Oakland County for claims asserted by third parties alleged to have been caused by the acts, errors or omissions of your employees. 6. If selected as a short-list finalist, respondent must agree to conduct a demonstration and bid response discussion with staff that will be assigned to the Oakland County project. The sessions will be conducted after proposal review at Oakland County s Department of Information Technology Response to IAM Solution Requirements The purpose of this section is to describe the proposed IAM solution and give the respondent the opportunity to describe how their proposed solution will support the current and future requirements of Oakland County. Section 3 of this RFP provides a detailed description of system requirements and identifies questions and/or issues that must be addressed by the respondent. The respondent is requested, where appropriate, to include supporting literature describing the details of system capabilities, commands, and utilities. If included, this supporting literature must be referenced in the response to the specification 25

29 and included in an appendix to the respondent s proposal. The inclusion of supporting literature or standard software alone will not satisfy the terms of this RFP. 1. Describe how the respondent s solution helps Oakland County meet its general business objectives as set forth in Section 3.1 of this RFP. 2. Describe the proposed functionality as set forth in Section 3.2 of this RFP. Include details of the end-user experience. 3. Describe the proposed technical solution as set forth in Section 3.2 of this RFP. 4. Describe the implementation services as set forth in Section 3.3 of this RFP. 5. Describe the licensing and support services as set forth in Section 3.4 of this RFP. Include prices for these services in your Price Proposal, (Section 5, Section 6.4.5, and Appendix D Cost Response Tables). Oakland County reserves the right to negotiate all system acceptance testing procedures, warranties, and terms of software maintenance Price Proposal Respondents must complete and include Appendix D Cost Response Tables in their Price Proposal. All prices shall be quoted in U.S. dollars. Where possible, quote a fixed price for the software, services, and extended warranty described in this RFP. Where uncertainty exists, quote estimated costs or a range of costs. The Price Proposal shall include the price for shipping, crating, insurance, duties, and other costs related to the delivery and installation of the proposed hardware and software. 26

30 The Price Proposal shall include the price for software updates including enhancements and Oakland County customizations, training programs and materials, and onsite application development support. Respondents are cautioned to avoid placing components in an optional category. Only components which provide an enhancement over and above that required to meet the detailed specifications may be included as optional. Oakland County reserves the right to selectively choose items that the respondents propose. Oakland County intends to make use of the existing infrastructure insofar as they meet the proposed specifications of the vendor. During the process of negotiations, Oakland County reserves the right to exercise this privilege in determining the final amount and type of hardware, software, and services intended for purchase Selection Criteria In order to be considered, bidding respondents must complete the following minimum requirements: Return the Proposal Form, enclosed with respondent s proposal, signed by a legal representative of respondent s organization. Place this form in the Master Proposal as described in Section 4.3 of RFP. Return the Intent to Respond Form as described in Section 6.1. Complete the information required as described in this RFP. For each proposal, submit one (1) Master Proposal and two (2) printed copies; for a TOTAL of 3 proposals. Also include one (1) CD or Flash drive containing the electronic copies of the proposals. Delivery instructions and mailing label are provided in the document SOL which is part of the bid backage. Proposals may NOT be delivered via facsimile or . 27

31 Oakland County will use the following criteria to evaluate respondents RFP proposal responses meeting the minimum requirements described above. This is not a comprehensive list, nor does the arrangement imply order of importance: Compliance with RFP Instructions: The proposal will be evaluated for compliance with the instructions set forth in Section 4, Section 5 and Section 6.3 of the RFP. Business Requirements: The IAM solution s compliance with the business requirements set forth in Section 3.1 General Business Objectives. System Functionality and Technical Architecture: The proposal will be evaluated for compliance with Section 3.2 Functional and Technical Requirements. Implementation Services: Professional services identified in the proposal will be evaluated for compliance with Section 3.3 Implementation Services Requirements. Licensing and Support Services: Software support, upgrade cycles and warranty services available will be evaluated for compliance with Section 3.4 Licensing and Support Services Requirements. Corporate Viability and Vision: The selected respondent must exhibit the vision and viability to partner with Oakland County in the establishment of an IAM solution. The respondent s IAM solution must have an existing installed user base that can be used to verify system functionality and support. Installed sites of similar size and complexity will be considered in this evaluation. Corporate Viability and Vision identified in the proposal will be evaluated for compliance with Section and Section System Cost: The proposal must be cost-effective to implement and preserve the technical and data resources that already exist in the County. The Price Proposal will be evaluated for compliance with Section 5.1 and Section Oral Presentations 28

32 During the evaluation process, Oakland County may invite a Respondent to give an oral presentation of their proposal. Presentations are at the option of the County and may not be conducted. Therefore, written proposals should be complete. 29

33 7.0 TIMETABLE Activity Date Request for Qualifications Released September 19, 2013 Intent to Respond Form Due Requests for Clarifications Due October 3, 2013 at 5:00pm EST October 10, 2013 at 5:00pm EST Answers to Vendor Questions Released October 14, 2013 Proposals Due Oral Presentations October 24, 2013 at 2:00pm EST TBD Responses to this Request for Proposal are due on October 24, 2013 at 2:00pm EST. 30

34 8.0 PROJECT CONTACT This RFP is being issued by Oakland County, located in Pontiac, Michigan, which shall be the sole point of contact for purposes of information concerning this RFP. Any requests for clarification or additional information regarding the RFP shall be directed via to and the subject title of the must contain Identity and Access Management RFP Questions. All requests for clarification or additional information regarding this RFP are due October 10, 2013 at 5:00pm EST. No questions will be entertained after this date. All questions and requests for clarification or additional information regarding this RFQ will not be considered confidential. These questions and the Oakland County responses shall be shared with all other prospective bidders. Responses to vendor questions will be published on MITN at and vendors are encouraged to register on MITN. This bid and any addendums to this bid will also be published on MITN. Response to questions, this bid or any addendums will not be sent directly to vendors. 31

35 9.0 OTHER RELATED MATTERS Oakland County will entertain any value-added alternative(s) provided by a Respondent. Additions to the proposed solution that would enhance the business objectives proposed by Oakland County are encouraged. 32

36 Appendix A: Intent to Respond Form The completion of this form indicates the Respondent's intent to respond to the Identity and Access Management Request for Proposal. Firm Name: Address: Primary Contact Name: Phone: Secondary Contact Name: Phone: Please return this form to the Project Contact by October 3, 2013 at 5:00pm EST. 33

37 Identity and Access Management RFP Sept. 12, 2013 APPENDIX B REQUIREMENTS RESPONSE TABLES Table B-1 IAM Functional and Technical Requirements Table Priority Existing Planned Future Custom (, Med, Ability Release (Release Modification Number Identity and Access Management Requirements Low) (Yes, No) Number and Date) (Yes, No) 1.0 Implementation The vendor is responsible for the onsite implementation of the IAM solution. Please identify if an affiliate or partner is used. 1.1 Branding The vendor is to provide development services required to integrate the IAM with the County s look and feel. 2.0 Cloud Hosting If cloud provider: The vendor provides a secure and scalable hosting solution. If vendor is not a cloud provider, skip to Availability The IAM system operates 24 hours / 7 days a week / 365 days a year with availability of 99.99%. excluding scheduled maintenance windows 2.2 Support The vendor provides ongoing 24 hour / 7 days a week support. This includes core helpdesk/phone support during business hours Monday through Friday. 2.3 Outages The vendor will notify the County of any planned outages or maintenance issues. The vendor will monitor the system and provide identification, notification and resolution of any unplanned outages. 2.4 System Architecture The vendor will identify the system architecture (type of servers, server locations, load-balancing, etc.). 34

38 Identity and Access Management RFP Sept. 12, Backup The vendor will identify the redundancy and data backup procedures of the IAM solution. 2.6 Continuity Plan The vendor will provide the business continuity plan to ensure recovery of the entire system within 72 hours. 2.7 Third-Party Plugins The vendor must identify any third-party plug-ins that is required for the IAM solution to function properly. 3.0 Server Support If not a cloud provider: Environment must run natively on Windows 2008 R2 operating system and support full integration with VMWare as the hardware host. 3.1 McAfee Support Must support/coexist with McAfee Anti-virus without performance degradation. 3.2 Backup Policy Store & Audit database should be capable of being backed up to external media without stopping product functionality. 3.3 Availability Product must support high availabilty clustering across a geographically diverse environment. 3.4 Network Recovery Product must tolerate and recover from intermittent network connectivity loss between policy server components of at least 24 hours without manual intervention. 3.5 Load Balancing The platform must instantiate and tune load balancing dynamically between all available policy servers without external load balancing equipment. 3.6 Clustered App Support Product must support clustered web applications spread across multiple servers. 35

39 Identity and Access Management RFP Sept. 12, Centralized Identity Store Provides the ability to centralize users in a single system (physically or otherwise) while managing them locally via policy-based access controls. Accounts can be created within the store. 4.1 Role-Based Access Each user may have business levels, provisioning levels, and line-of-business levels. This role-based access provides for delegated administration in certain roles. 4.2 Application and Data Entitlements Each user has entitlements assigned via roles, groups, or explicitly. 4.3 Active Directory Synchronization Integrates and synchronizes fully with Microsoft s Active Directory database. 4.4 Separation of Organizations Separates different groups of users between organizations. 4.5 User Lookup Identity information such as name, phone numbers, address, and other pertinent information that is available for fast lookup of everyone in the organization. Limited to based fields (TBD). 4.6 LDAP Support Integrates fully with Lightweight Directory Access Protocol (LDAP) databases. 4.7 Federation Support Supports Federation SSO solutions using SAML 2.0 (e.g., Gmail, Facebook, Yahoo, Open ID, etc.). 4.8 Multiple Authentication Sources Authentication in a hierarchical way between multiple userbases in multiple locations. 4.9 Export Ability to backup and export userstore for mobility between solutions. Medium Med 36

40 Identity and Access Management RFP Sept. 12, User Self-Service Allows for users to manage their own profile, password and entitlements. Provides security questions and answers. 5.0 Single Sign On (SSO) Provides mechanism for internal users to automatically be authenticated into applications after one initial sign on into the IAM system. In addition, federates single sign-on functionality. Office 365 integration preferred. 5.1 Identity-Centric Model One login correlates with one identity within the system. 5.2 Legacy App Support API that allows for easy implementation into a custom application. Must use an API that supports multiple programming languages (e.g.,.net, Java, etc.). 6.0 Web Services Dashboard Allows identity management to be deployed Med as a Web site that provides users with a central repository of applications for which they have been granted access. 6.1 User Interface Ability to brand and customize the UI look and feel. 6.2 Smartphone and Tablet Support Supports touch-based interfaces on smartphones and tablet devices running ios, Android, Blackberry, and Windows Phone. 37

41 Identity and Access Management RFP Sept. 12, System Accounting, Compliance and Auditing Reporting System records user activity such as data/timestamp of logins, IP address, number of attempts, number of transactions and what resources were accessed. Supports compliance and auditing efforts by documenting that identity controls are in place and working as intended. Provides audit reports for all user and administrator activity. 7.1 Graphical Snapshot Reporting Friendly user interface allows for analysis of the system at a glance. Allows administrators to drill down with granularity in this graphical view. 7.2 Separation of Duties (SOD) Administration and Reporting Heuristics The ability for the product to detect SOD violations and similar flags within the system using heuristics. 8.0 Security Protection Standards Protects County content, applications and data from hackers, external or internal security breaches. Uses standardized security methodologies. 8.1 Multifactor Authentication Uses Security Tokens, Digital Certificates or Biometric authentication models. 8.2 Cookie Encryption and Session Hijacking Protection Encrypts and protects all session cookie information. Cookies are terminated upon session closeout or timeout to prevent unauthorized access. In the case of ly Secured Applications (such as PeopleSoft), session hijacking is prevented by applications independently validating a user session against the policy store. Medium 38

42 Identity and Access Management RFP Sept. 12, Flexible Security Policies Enables security administrators to flexibly define security policies and automate their enforcement across a wide variety of content, applications and resources. Defines who is allowed to access systems and under what circumstances. The policy server protects data and applications using global or group policies that allow rule-based, role based and time-based controls Licensing Vendor agrees to extend pre-negotiated blanket purchase orders and contract pricing and terms to Oakland County and all G2G Marketplace customers Vendor guarantees the lowest cost/best price solutions for Oakland County and all G2G Marketplace customers Vendor agrees to extend Service Provider licensing to Oakland County/G2G Marketplace Vendor has reviewed Oakland County Professional Services Contract and will submit itemized descriptions of exceptions with response to RFP Vendor provides all applicable contract(s) as Appendix to RFQ response. 39

43 Identity and Access Management RFP Sept. 12, 2013 Table B-2 IAM Hardware, Software, Peripheral Requirements Table Hardware Qty. Manufacturer Part Number Description Equivalent (Y/N) Software Qty. Manufacturer Part Number Description Equivalent (Y/N) Peripheral Devices Qty. Manufacturer Part Number Description Equivalent (Y/N) If equivalent or similar manufacturer and part number will be acceptable, please mark a Y in the Equivalent column. If equivalent or similar manufacturer and part number will not be acceptable, please mark an N in the Equivalent column. 40

44 Identity and Access Management RFP Sept. 12, 2013 APPENDIX C IMPLEMENTATION SERVICES RESPONSE TABLES Table C-1. IAM Implementation Plan Phase/ Dependencies Oakland Activity/ Skill with Other County Respondent Begin Date Task ID Task Description Type Tasks Estimate Estimate End Date Project Management Technical Design and Installation Education, Marketing and Policies Implementation Post Implementation Support 41

45 Identity and Access Management RFP Sept. 12, 2013 APPENDIX D COST RESPONSE TABLES Respondents should identify inapplicable costs with an N/A. Table D-1A. Summary of Mandatory System Costs Table. One-Time Cost Description Cost On-Going Software Licensing Implementation/Professional Services System Support & Maintenance Other Total Mandatory Costs Table D-1B. Summary of Desirable System Costs Table. One-Time Cost Description Cost On-Going Software Licensing Implementation/Professional Services System Support & Maintenance Other Total Desirable Costs 42

46 Identity and Access Management RFP Sept. 12, 2013 Table D-2A. Mandatory Software Licensing Detail Costs Table. Customization Purchase On-Going Software Description (Y/N) Price Support Cost Total Mandatory Software License Total costs listed in Table D-2A. Mandatory Software Licensing Detail Costs Table should be carried over to Table D-1A. Summary of Mandatory System Costs Table for Software Licensing. Table D-2B. Desirable Software Licensing Detail Costs Table. Customization Purchase On-Going Software Description (Y/N) Price Support Cost Total Desirable Software License Total costs listed in Table D-2B. Desirable Software Licensing Detail Costs Table should be carried over to Table D-1B. Summary of Desirable Costs Table for Software Licensing. Please List Software Licensing Cost Assumptions Below: 1. 43

47 Identity and Access Management RFP Sept. 12, 2013 Note: All software (Application, Desktop, or Supporting) that Oakland County will be required to license and implement to achieve the specifications in this RFP must be listed in Table D-2A Recommended Software Licensing Detail Costs Table, Table D-2B Desirable Software Licensing Detail Costs Table, or Table B-2 Hardware, Software, Peripheral Requirements Table. If software that is NOT listed is subsequently determined by Oakland County or vendor to be required, then vendor shall provide such software to Oakland County at no charge beyond annual support fees. Table D-3. Per-User, Per-Login or Other Pricing Model (see Section 5.2) Group of Users Applicable Pricing Model(s) Core group of enterprise users which numbers in the thousands. Large group of public users which may number in the millions. 44

48 Identity and Access Management RFP Sept. 12, 2013 APPENDIX E OAKLAND COUNTY IAM USE CASES Please list the specific name of the product or solution that will fufill each use case and how it will do so. Use N/A if not applicable. Number Use Case Vendor Response 1.0 Oakland County employees, contractors, and CVT (cities, villages and townships) customers are SSO authenticated into internal applications, G2G applications and Microsoft Office 365 using an internal Active Directory server via the IAM solution. This Active Directory server is the one currently maintained by Oakland County. 1.1 Oakland County employees, contractors, and CVT (cities, villages and townships) customers self-register within the IAM solution. They are then authenticated into internal and G2G Cloud applications. 2.0 Employees and contractors of other governments that don t maintain an Active Directory solution authenticate using a SAML 2.0-based federation service such as Google, Facebook, Yahoo, Twitter, or Microsoft Office 365 via the IAM solution for the G2G Marketplace. 2.1 Employees and contractors of other governments 45

49 Identity and Access Management RFP Sept. 12, 2013 maintain their own mutually exclusive Active Directory server which they utilize to authenticate via the IAM solution for the G2G Marketplace. 3.0 Members of the public authenticate into an Oakland County or G2G Marketplace application using the IAM solution. The application would include the ability to self-register. An example of this would be someone registering for a flu vaccination. 3.1 Members of the public authenticate into an Oakland County or G2G Marketplace application using a SAML 2.0-based federation service such as Google, Facebook, Yahoo or Twitter via the IAM solution. 46