Conclave - IDAM (CCSO20A10)

Tender description

Why the Work is Being Done The purpose of this piece of work is to provide CCS with an Identification and Access Management (IDAM) system a Single Sign on (SSO) capability which is supported by an automated Identification system. The system is to support both internal CCS need and the wider need of the CCS customer base simplifying usability and accessibility of CCS procurement systems and services. Problem to Be Solved The general problem to be solved is as follows: -Elimination of the need for both internal and external users to hold multiple logins and passwords to access CCS Services. -Provision of an automated/federated identification verification system. -Ability to federate with multiple worldwide identity service providers. -Capability for unlimited -A lasting future proofed system/service -User self management and password reset The Project Scope includes but is not limited to. 1. Support for modern authentication mechanisms, including OIDC, SAML, associated technologies. 2. Designed and implemented to be secure to industry best practice. 3. Self-service password reset capability (for internal IdP users). 4. Bulk data upload facility (for internal IdP users). 5. Unlimited API integration capability. 6. Performing user testing prior to final signoff and product release 7. Integration with Central Identity Index Service (CII) - central index to identify organisations using external registers and indexes 8. Microservices architecture 9. The system shall be capable of internationalisation. Specifically, all front end and public access elements of the system must at a minimum be available in both English and Welsh languages (in compliance with ‘Welsh Language (Wales) Measure 2011’). Further Technical details and information will be provided at the Proposal Stage. Who Are the Users The users of the intended system will be both internal and external users of CCS systems and services. The system must permit users to access CCS systems in an easy and effective manner, enabling users to authenticate and authorise services. The system must support delegation of roles, varying access levels and full usermulti functionality. The following are key User needs: - SSO authentication using OIDC and SAML protocols - Provide full roles & permissions functionality to enable fine-grained access control to CCS services - Posture checking of user connection (Location, device type, Network IP) against security criteria - authenticate via a number of predetermined OIDC authentication providers - authentication via third-party OIDC authentication provider - a CCS IdP for users unable/unwilling to utilise OIDC authentication. - Provision of organisational and user profile services. Further User needs will be provided at the Proposal Stage. Early Market Engagement Work Already Done An element of project discovery work has been conducted. Discovery findings is that there is no currently available market IDAM solution which meets current CCS need. Discovery recommendation which is supported by elements of internal research and validation is that CCS design and build a bespoke IDAM solution to meet the need of CCS and its customer base. Existing Team CCS currently has a dedicated Project_Manager(PM) in place responsible for the management of this project. The PM is supported by a Technical/architectural lead and a Steering Committee providing project guidance and governance. All technical aspects of the project solutions must be agreed and signed off by the Conclave Technical Lead and project Senior responsible Officer (SRO). Current Phase Alpha Work Location Remote working from supplier home offices is acceptable. Supplier must be able to facilitate face to face meetings with the Conclave PM on a minimum of a weekly basis or as otherwise required. A senior organisational Rep must ATTEND the monthly Conclave SteerCo meeting which will take place at the CCS London Offices. Working Arrangments Supplier to facilitate a minimum of 1 face to face meeting per week with the Project Manager (either at supplier offices or CCS London Offices). Supplier to facilitate a further 2 calls/video chats per week to support project activity. Additional meeting to be facilitated as per buyer or supplier request. Supplier Project Manager (or equivalent) togher supplier Technical Lead (or equivalent) to attend monthly Steering Committee meetings to provide project updates and reporting. Security Clearance SC security clearance required. CCS will sponsor required security clearance applications,however, all associated costs are to be met by the supplier and are NOT claimable against CCS as an incurred expense. Additional T&Cs A Non-Disclosure Agreement will need to be signed and agreed to before Contract_Award. Potential Bidders must sign up to the CCS e-Sourcing Suite for the Proposal Stage before the Shortlisting Stage submission deadline. https://crowncommercialservice.bravosolution.co.uk/web/login.html 35% of the aggregate total fixed price will form a Retained Sum. This is subject to payment upon agreed successful on-time delivery. The Following will occur for unsuccessful delivery. 0-7 Days late, no deduction 8-21 days late,7.5% deduction,30% paid. 22-30 Days Late,15% deduction,20% paid. 31-45 days Late,20% deduction,15% paid. 46+ days late, 25% deduction,10% paid.CCS reserves the rights to terminate and seek to recover any losses Skills & Experience Must demonstrate experience of where you have identified continuous improvement possibilities and successfully presented these to stakeholders that then accepted the possibilities. - 1% Must demonstrate a capability to successfully deliver in an agile way -1% Must demonstrate a knowledge and experience of working on and with AWS platforms and services-1% Must demonstrate previous experience of successfully developing IDAM platforms to modern, open standards, including OIDC, OAuth, SAML-1% Must demonstrate a where you have successfully developed a microservices-based architecture in an API-first way.-1% Must demonstrate previous experience in successfully designing and implementing secure RESTful APIs.-1% Must demonstrate previous experience of integrations with external active directories and identity providers.-1% Must demonstrate experience of developing data intensive solutions including data and alignment to data standards and legislation, (GDPR).-1% Must demonstrate a proven minimum of 3 years of experience in successfully providing similar secure security based solutions within the public or private sector. -1% Nice to Haves Should demonstrate knowledge and experience of UK GOV.UK Government Platform as a Service (PaaS) Platform-1% No. of Suppliers to Evaluate 4 Proposal Criteria Demonstrate and detail as to how your proposed solution would ensure the User Needs are successfully met in full. - 30% Demonstrate and detail as to how you will ensure the solution meets all milestones, this should include your process for proactively identifying and resolving potential delays. - 20% Demonstrate and detail as to how your solution is secure by design and will meet all relevant Security Standards. -5% Demonstrate and detail as to how your solution will be built robustly with minimal defects or faults(no Major or Critical faults.)alongside future proofing for emerging technologies. -10% Provide a Case study of where you have successfully implemented a federated SSO and ID&V system with a similar level of complexity in User Needs -15% Demonstrate how you will successfully perform knowledge transfer and handover of completed pieces of work to the Contracting Authority during and at the end of the Contract - 10% Cultural Fit Criteria Please detail and demonstrate as to how your approach will ensure successful engagement and communication with all Stakeholders, including standups,SteerCo Meetings and weekly face to face - 50% Detail how you will identify opportunities to continuously improve the product/service through on-going changes or innovative approaches - 20% Demonstrate your understanding of CCS and it’s unique Customer and User Base alongside how the solution will be built to be fully usable and accessible for all. - 30% Payment Approach Fixed price Assessment Method Case study Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers No questions have been answered yet Budget range not to exceed £1,000,000 exc vat contract value will be set at 15% above the fixed price in the event of scope change or amendment by ccs. changes being cost neutral as a possibility must be explored first before any additional costs can be considered.