IdAM Development and Implementation Partner (ASDT0093) - Re-issue

Tender description

Why the Work is Being Done The Ministry of Defence (MOD) needs an Enterprise Identity and Access Management (IDAM) service for its IT & Digital services; this delivers part of MOD’s 2010 IDAM strategy (available on gov.uk). This service is to provide: 1. Improved compliance with HMG’s Technology Code of Practice, by providing a reusable service and will simplify maintaining compliance with the General Data Protection Regulation (GDPR). 2. A migration path from current IDAM arrangements. 3. Identity related services that meet the Digital Service Standard, particularly for our partner organisations and external users. It is an essential prerequisite for new IT services from Q2 2019. Problem to Be Solved The Development & Implementation Partner will develop, configure and deliver Defence IdAM, including: • IdAM services (e.g. single-sign-on & authentication) for the defence gateway and Core Network across both OFFICIAL and SECRET domains; • IdAM directly related Directory services and interfacing with the wider directories (e.g. a master Active Directory and corporate directory). The defence product of choice is the NetIQ product. The development focus is on OFFICIAL information in the UK, SECRET. Who Are the Users All MOD Personnel/Partners/Contractors requiring IT application & services access. 1. As an IT user, I want single sign on to seamlessly access IT & digital services. 2. As an App or Service Owner, I want simpler, rule-based access so appropriate users get quicker access to my service and inappropriate ones are refused access. 3. As a systems administrator, I want to maintain trust relationships between systems, so normal IT operations can continue. 4. As a Security Officer, I want a simpler means of securely providing access to IT so access is quicker, more accurate and can be scrutinised Early Market Engagement Work Already Done An IdAM alpha was conducted during 2016 using the Authority's product of choice, the MicroFocus NetIQ product suite. This product was selected after a market competition and evaluation. Development work commenced in Sept 2018 with the existing Development Partner who is working in an Agile manner to deliver incremental releases of the configured IdAM solution including identity log-in for defence gateway and the core network at OFFICIAL. Existing Team A project manager to oversee this activity is currently in place. The incoming team will receive support from the wider team working on identity and directories challenges including tree Architects, an Engineering Lead and a Senior project manager. They will provide guidance and ensure coherence across this and related work (but not detailed/solutions architecture). Around 20 people are currently engaged on the IdAM project. Collaborative working is essential between contracted parties across the directories and IdAM teams following SAFe delivery principles. Current Phase Beta Work Location The Project Delivery Team is located at MOD Corsham in Wiltshire (SN13 9NR). Occasional travel to Customers may be required dependent on the need, however this will be kept to a minimum. Working Arrangments The Partner will be expected to work full time (220 days per year). The IdAM delivery team works in an Agile Scrum environment under the direction of a Scrum Master and Project Manager. Current expectations are that the Development Implementation Partner will be at Corsham at least 4 days per week. Travel and subsistence expenses to attend other sites will be payable from Corsham using current Civil Service T&S practices. Locations such as but not limited to: Andover, Farnborough & Gosport. Security Clearance Potential suppliers will be expected to hold or be in the process of obtaining SC Clearance. The Authority WILL NOT sponsor SC clearance, it must be in place and remain valid for the duration of the contract. Additional T&Cs Additional information will be provided for successful Suppliers following the short-list stage. The successful Supplier must request a Security Aspects Letter and provide a Cyber Essentials Certificate. T&S will be paid on receipted actuals in compliance with MoD policy , no other expenses are permitted. Suppliers must use the Authorities Purchase to Payment Tool called CP&F or be prepared to sign up the tool. Suppliers must adhere to the MOD Corsham working policies. The following Quality Assurance standards will be applicable: Concessions Def Stan 05-61 Part 1 Issue 6 Contractor Working Parties Def Stan 05-61 Part 4 Issue 3 Skills & Experience Experience of successfully delivering an IdAM service through a full project or development lifecycle in a large or complex organisation (including testing and deployment). Experience of creating services built around the NetIQ products: Identity manager, Sentinel, Advanced Authentication, Access manager; including design, test, configuration and deployment of those products. Experience developing large digital services that meet the Digital Service Standard for a growing community of users applying appropriate digital (Agile and user centric) methods, techniques and skills. Experience obtaining and merging information from a range of sources/systems and addressing data quality issues to provide identity, role and security attribute data supporting attribute based access control. Experience of building and testing an end-to-end digital service demonstrating a high level of quality. Experience of DevOps Engineering – particularly deploying builds, increments and releases through Continuous Integration and Deployment pipelines, as well as scripting environment builds and changes. Experience of designing and delivering Information Services with a high level of cyber and general security threat and very high criticality and creating documents to achieve accreditation. Experience of providing solution, service and technical architecture and architectural roadmaps in a complex, security critical environment supporting an Agile release cycle and addressing migration considerations. Nice to Haves Experience integrating with wider business functions using NetIQ’s APIs and scripting environment to provide a service that delivers an excellent user experience whilst meeting business policy goals. Experience of creating an IdAM service, based around NetIQ’s products, but incorporating other technologies where appropriate, such that an optimised set of maintainable technology underpins the service. Experience of digitising transactional processes and services internal to a large enterprise by applying good practices for: usability, user research, interaction, user-centric and graphic & content design. Experience of delivery management in Agile teams building digital products according to the Government Service Design Manual, applying a range of Agile techniques and practices. Experience of designing and building assisted digital elements of a service, where it is not practical or desirable to fully digitise aspects of the service. Capability to use test driven development to create software in Java and other languages that bridges gaps in necessary user journeys including creating Web user interfaces, APIs, RESTful architecture Experience of testing iteratively, including test data creation and test automation in the context of a mature DevOps approach. Experience of integration testing in a large enterprise, including with legacy systems, and producing formal test documentation that makes maximum use of the quality assurance provided by the iterative testing. No. of Suppliers to Evaluate 3 Proposal Criteria How you'll provide the Authority with high-quality team that embodies the required skills; particularly, why you believe the team (as a collective) will be high performing (10%) How you'll balance being responsive and flexible to changing work demands (in terms of skills/capacity) as it progresses with the benefits of a stable and consistent team. (9%) Indicative structure (i.e. people/roles in your proposed team and their main interrelationships), indicative profile (how team size and roles might change over time) and start date. (9%) How you will identify and keep the organisation informed of risks, dependencies, issues and other considerations relevant to planning. (9%) Your proposed approach and methodology to the digital service: particularly how the various Digital, Data & Technology Roles will work together and how users will be involved (9%) Proposed approach and methodology for achieving security/information assurance accreditation and maintaining through the Agile development, including identifying threats, putting in place controls and engagement with risk owner(s). (9%) How you will ensure the service can meet the relevant digital service standard at various phases of development (e.g. closed beta, open beta, live). (9%) How you'll ensure the service meets the organisation’s policy goals in terms of providing more secure Identity and Access Management/Directories processes, incorporating existing policy. (9%) Your approach to knowledge management, particularly how the Authority and its partners can support and maintain the IdAM/Directories services after they have been developed. (9%) How you will optimise costs for the Authority and deliver value for money though the development and the lifetime of the service (total cost of ownership of the service.) (9%) Technical proposal for a DevOps pipeline and suitable environments to enable rapid, modern development of the system. (9%) Cultural Fit Criteria Shares knowledge, experience and expertise with the Authority and other team members (13%) Be transparent and collaborative (13%) Evidence of how you foster an inclusive and professional working environment with no place for bullying or discrimination of any form (13%) Evidence that you attract and retain the best talent to create teams that reflect the diversity of the country and can deliver a diversity of thought to the Authority (13%) Evidence of a willingness to take ownership of problems and use initiative to ensure a successful outcome (12%) Evidence of collaborative approach to problem solving with stakeholders from multiple organisations, including Civil Servants, other contractors and vendors (12%) Evidence of working successfully in an Agile manner within an organisation where some units: (particularly in relation to governance and project control processes) retain a big-design-upfront/command-and-control perspective (12%) Evidence of working with organisations and stakeholders with differing levels of technical expertise (12%) Payment Approach Capped time and materials Assessment Method Written proposal Case study Presentation Evaluation Weighting Technical competence 50% Cultural fit 20% Price 30% Questions from Suppliers Budget range £5 - £6 million (ex vat) contract value includes a limit of liability for t&s of £50k.