Identity & Access Management

Tender description

Summary of the work This contract is for the provision of Identity and Access Management (IAM) services and consultancy to assist the University in architecting and implementing a full life cycle IAM solution. This includes the provision of a toolset to manage the full life cycle including workflow, self-service, auditing, reporting and analytics capabilities. Latest start date 01/09/2017 Why the Work is Being Done To remove obsolete IT infrastructure, increase productivity & flexibility, future proof our identity and access management solutions and reduce costs. Problem to Be Solved - reduce complexity of current identity & access management solution - increase productivity & security - enable application access security - remove / reduce the number of identities for each user Who Are the Users As an IT Engineer, I need to create and manage a single identity for each user across the IT estate, so that I protect access to applications and resources ensuring it is safe yet accessible. Early Market Engagement None Work Already Done In-house business analysis to identify current account creation processes and identity management access methods. Existing Team The team will be drawn from the IT department at the University and consist engineers covering all areas including: - servers & storage engineers - database engineers - business analysts - subject matter experts Current Phase Discovery Skills & Experience • Demonstrable experience of designing / implementing / improving / managing / governing user access and identity management service • Experience of working with managed suppliers to provide effective User Access and Identity Management services and solutions that have delivered a positive step change in security compliance • Very strong technical understanding of User Access and Identity Management solutions, processes and systems • Demonstrable experience of continuous improvement of IAM services • Capable of producing high quality output with a strong focus on attention to detail following design and delivery methods, tools and standards Work Location University of Derby, Kedleston Road Derby Working Arrangments Onsite and offsite working Quotes must include all costs including expenses Security Clearance N/A No. of Suppliers to Evaluate 5 Proposal Criteria • Technical solution • Approach and methodology • How the approach or solution meets user needs • How the approach or solution meets the University's goal • Estimated timeframes for the work • How they’ve identified risks and dependencies and offered approaches to manage them • Value for money Cultural Fit Criteria • Work as a team with our organisation and other suppliers • Be transparent and collaborative when making decisions • Share knowledge and experience with other team members • Take responsibility for their work Payment Approach Capped time and materials Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers 1. Have you got an IAM product of choice? We currently use Microsoft Forefront Identity Manager (FIM) and would welcome solutions that work with Microsoft Active Directory and Azure 2. What is the duration of the role and can you give guidance on budget? We would ideally have the solution in place before September 2017. Flexible funding has been agreed but the budget will not be set until solutions have identified - this is to avoid eliminating potential solutions 3. Would you be looking for a managed service as part of this project? We are open to a managed service 4. Is there a preference for a cloud or on-premise solution? We are open to all solutions, whether they are on-premise or in the cloud. 5. Is access governance required as part of the solution? Could you please define what you mean by access governance - do you mean role based access? 6. What different types of systems require integration? Systems include University HR, Finance, Student records, CRM, library and Student Course Resource systems. 7. In response to question 5: Yes role based access but also reporting on who has access to what. Role-based access and access reporting are required.