MOJ Staff Account Management (Joiners, Movers, Leavers) Security-focused Discovery

Tender description

Why the Work is Being Done The Ministry of Justice (MOJ) has a diverse and sizeable technology estate, where many systems operate independent authentication/authorisation systems. Different user management approaches in use, which means account management when staff/contractors join, change role, or leave the organisation is inherently a manual and duplicate activity, and thus prone to delay or error. Problem to Be Solved The MOJ are seeking to meaningfully understand (map, analyse) this account management estate in order to generate a prioritised cost and time estimated list of cost-effective, tactical/strategic improvements to technology systems and/or processes that drive joiners, movers and leavers activities to make them more accurate, resilient, automated and otherwise efficient. Who Are the Users As a security manager, I need confidence that we have appropriate account/permission management, so information/system access is managed. As an information asset owner, I need confidence that only-authorised-users can access information, so I can assure stakeholders such obligations are met. As a system owner/administrator, I need to ensure accounts are created, managed and revoked, so I deliver a good service. As a line manager, I need to have accounts created, modified and closed to so that my team can work efficiently and safely. As a user, I need an account with suitable access, so that I can do my job. Early Market Engagement None conducted Work Already Done Unique system-specific / user groups discoveries and limited pilot works for pointed account management improvements have previously been conducted. Existing documentation/information can be made available to shortlisted bidders on request. The MOJ is currently investigating a federated account overlay solution for one main technology area (productivity suites). This information will be made available to the successful bidder(s) through project life. Existing Team MOJ Digital & Technology - Security & Privacy Team Current Phase Discovery Work Location Supplier location(s); Petty France (London, SW1H 9AJ); 10 South Colonade (Canary Wharf, London); and various other UK MoJ sites as agreed as required. Working Arrangments - On site for face-to-face meetings and discovery work with user groups - Use agile working methods - At least bi-weekly progress reports - Use of digital collaboration tools such as Slack and Skype for remote working where possible - Use of MoJ digital work planning tools (Jira, Confluence and Trello) where mutually agreeable - The Security & Privacy Team Project Manager to provide reviews, direction and clarification on progress on a required (but at least bi-weekly) basis Security Clearance Baseline Personnel Security Check (BPSS, https://www.gov.uk/government/publications/government-baseline-personnel-security-standard) as a minimum for any persons interacting with, or receiving information directly relating to, MoJ data/systems Additional T&Cs - Standard Digital Outcomes and Specialist framework & call-off contract (https://www.gov.uk/government/publications/digital-outcomes-and-specialists-2-call-off-contract) - MoJ's Travel and Subsistence policy Skills & Experience Recent experience (within the last 3 years) conducting user-led research for enterprise IT solution design/assessment Recent experience (within the last 3 years) of enterprise account/identity and account managmenet within large-scale hybrid enterprise IT environments Recent experience (within the last 3 years) of identifying and mapping existing user and technology processes Recent experience (within the last 3 years) in implementing/configuring technologies such as Active Directory, Okta, Oracle IAM, Amazon Web Services IAM, Azure Active Directory and other modern identity management technologies Recent experience (within the last 1 year) with external NCSC, CIS, NIST (etc) standards in relation to auditing/implementing account and account permission management Nice to Haves Recent experience (within the last 3 years) in implementing retrospective account management process and technology changes Recent experience (within the last 3 years) in conducting automated account and/or account permission audits using technical tooling No. of Suppliers to Evaluate 3 Proposal Criteria Methodology/approach to understanding and mapping existing MOJ user and technology processes, dependancies and interconnections in relation to user account management Methodology/approach to generating and prioritising recommendations for change/improvement in relation to processes and technology-driven account management Methodology/approach to ensuring any recommendations are aligned with wider generally accepted good practices and external standards/guidance (where they are applicable) References from UK public sector organisations for comparable work from within the last 5 years Cultural Fit Criteria Recent (within the last 3 years) experience working in the public sector or other highly regulated sector Agile principles and ways of working Quality assurance processes Payment Approach Capped time and materials Assessment Method Written proposal Evaluation Weighting Technical competence 65% Cultural fit 10% Price 25% Questions from Suppliers Budget range capped time and materials (ctm) up to £80,000 (exc vat)