3469 IT CS 22 - Discovery Engagement - Identity and Access Management

Tender description

Summary of the work Review of the University's Identity and Access Management (IAM) provision to produce the following: Updated Strategy for IAM (v2.0) – Existing strategy to be reviewed, updated and aligned to the University's Technology Strategy. Target Operating Model (TOM). Programme Overview – defining incremental delivery, prioritising foundational work to simplify current architecture. Expected Contract Length 4-6 months Latest start date Monday 23 January 2023 Budget Range £80,000 - £120,000 Payment will be upon approval of each deliverable as follows: Updated strategy - 30% TOM - 30% Programme of work (reflecting iterative delivery and including migration approach) - 40% Why the Work is Being Done The University has an aged inhouse developed account provisioning system called CRIS. This has been built organically over time, (primarily by one individual), with multiple connectors to different systems, (also developed inhouse). CRIS works, but is a complex, highly bespoke product that now presents a challenge both in terms of adaptability & ongoing support and maintenance. Business processes surrounding account provision & identity management would also benefit from review and refinement. The University understands that work is required in order to reduce risks to security and to improve the experience of both staff and students. However, a full replacement of CRIS and existing processes is not felt to be practicable in the immediate term. We would therefore like to investigate an iterative approach that will prioritise foundational work and remove complexity, laying the groundwork for later more comprehensive transformational work. The deliverables to be produced as part of this consultancy engagement will be relied upon in or to determine later work packages/procurements potentially with other suppliers with no guarantee that the University will award further work. Problem to Be Solved Challenges include: Account provisioning system (Chris) is complex, highly bespoke and built on unsupported technology, Duplication: Two directories: Active Directory/Open LDAP, Multiple SSO solutions; CAS, Shibboleth, simpleSAML, ADFS. Account provisioning not role based. There is a tendency to replicate access levels of team members, which could lead to additional privileges. People can have multiple identities over time, e.g. prospective student becomes student, then postgrad before leaving to become an alumni and then accepting a staff position. Individuals may have multiple identities at one time, e.g. staff member who is studying, or staff member with multiple jobs. Some downstream systems are designed based on an assumption that people will use different accounts when logging on to perform different duties/roles. Any deviation from this could require significant redevelopment. Overall data quality is considered to be poor with discrepancies between data held in CRIS and downstream systems. There are also many people with multiple accounts but no audit trail as to why these have all been created or which remain pertinent. There are a large number of disabled and/or dormant accounts across systems. Current processes around account provisioning, approvals and access governance require review and more formal documentation. Missed opportunities for improved service. Who Are the Users IDAM users include the following: Applicants, students and alumni, Staff, Externals (contractors, volunteers, external lecturers, visitors, library users). All users have the following common requirements: Simple processes to enable quick, secure and effective interaction with the University, Quick and easy access to required resources so that they can effectively perform their role, Confidence that their data is accurate and held securely - safe from breach and misuse. For further information regarding 1) High-level Technology summary 2) Technology stack Please go to the UoS link below: https://www.sheffield.ac.uk/it-services/iam-tendering-process Work Already Done The University has previously engaged with a third party to address issues within the area of Identity and Access Management, but this engagement was unsuccessful for a number of reasons, primary amongst these being as follow: Too much change being attempted at once, Too heavy reliance on a single contractor within the supplier organisation, Internal resourcing issues/constraints, Heavy focus on technical change, with business change being seen as a secondary priority/project phase, Technical challenges with system integration, (LDAP/CIS/AD), Failure to appreciate full complexity and interactions between systems, Weak project governance, Reluctance to challenge and/or change existing business processes. Existing Team The UoS Project Board for the Identity & Access Management Discovery Engagement will comprise of the following roles: Project Sponsor Programme Manager ITS Project Manager Information Security Lead Authentication Services SME/Architectural Lead Solution Architect It will also be necessary for other key stakeholders to be engaged as part of the discovery engagement. It should be noted by any supplier that the UoS operates within a largely functional org structure with resources controlled within the various departments/functions. As such, the project will not be supported by a dedicated internal team and will not always have free access to internal resources. Current Phase Discovery Skills & Experience • Have proven experience of defining a strategy and delivery plan for a large scale IDAM project within a complex organisational environment (preferably Higher Education) • Have proven experience of delivering a large scale IDAM transformation project from start to finish within a complex organisational environment (preferably Higher Education) • Be able to provide a description of the proposed project team with named resource and details of experience • Be able to provide details of at least 2 x references who can be contacted by the University as part of the supplier selection process • Have proven experience of working with multiple IDAM products and vendors • Have proven experience of mapping existing user journeys, identifying gaps and pain points, suggesting and prioritising remedies • Have proven experience of influencing and driving change within a highly complex organisational environment with multiple stakeholders and decision makers • Be able to demonstrate robust architectural processes to ensure that key project/technical decisions are reviewed and ratified in a robust manner and do not lie with a single expert • Be able to demonstrate that required skills and experience will be spread across the proposed delivery team and that reliance upon any one individual will be minimised Work Location It should be assumed that workshops and stakeholder engagement will predominantly be carried out face to face at one of the University campus buildings in Sheffield City Centre. However, some remote working will also be possible. Working Arrangments Supplier PM and other key personnel to attend weekly project checkpoint meetings, (and additional meetings/workshops as needed). It should be assumed that at least one day per week will be on Campus to attend face-to-face meetings/workshops. All work to be completed under the guidance of UoS Architectural team. Weekly progress reports to be provided including details of milestone dates, work completed, work planned for the next week, estimates to complete (time/money), any key issues/risks/blockers, UoS dependencies. Weekly finance reporting to be provided, including detailed breakdown of tasks completed the preceding week (by team member) and associated time/costs against each. Security Clearance All staff should be BPSS cleared. Additional T&Cs Please provide a blended Rate Card that includes provisions for expenses. No. of Suppliers to Evaluate 5 Proposal Criteria • Relevant technical skills and experience of the organisation • Delivery approach and methodology • Technical skills and experience of the proposed delivery team • Ability to deliver value to the defined budget • How well risks and dependencies have been identified and the appropriateness of proposed mitigations • Feedback from references • Business analysis and organisational change management experience Cultural Fit Criteria • Ability to work openly, transparently and collaboratively with in-house teams or other suppliers • Have a no-blame culture and encourage people to learn from their mistakes • Share knowledge and experience with other team members • Challenge the status quo and influence/drive change • Can work with clients with low technical expertise • Take responsibility and ownership • Work efficiently and effectively to drive value for money Payment Approach Capped time and materials Assessment Method • Work history • Reference • Presentation Evaluation Weighting Technical competence 60% Cultural fit 20% Price 20% Questions from Suppliers 1. “Be able to provide a description of the proposed project team with named resource and details of experience” - Naming a team starting over 2 months away, with no indication on when contracts will be signed is difficult. Is there specific roles that you want to see as a minimum The University has requested a latest start date of 23rd January and so this can be used as a guide for resource allocation. We would like to understand how each supplier would propose to structure their project team and so a full list of proposed roles would be appreciated. However, if it is not practical to provide names/experience again each and every role then the key positions that the university would be most interested in would include:Project Manager,Solution Architect,Lead Business Analyst,Key roles involved in project governance, (e.g. Programme Manager/Director, any key personnel involved in Architectural governance). 2. Link for 18th November Q&A meeting 10am - 12pm https://meet.google.com/msk-cjoe-xts 3. Will the Q&A on 18th November be recorded and shared? It is confirmed that YES the Q&A session on Friday 18th November will be recorded and shared for all vendors (whether they were present or not) to review post meeting. 4. Does the budget include or exclude VAT? The budget stated as available is inclusive of VAT 5. Is there an incumbent supplier involved in this project, if so can you share who it is? The UoS are not currently engaged with any other supplier with regard to this project, other than standard licensing agreements for the products we are currently using 6. What information are you looking for in the response to ‘Be able to provide details of at least 2 x references who can be contacted by the University as part of the supplier selection process’?Are you looking for actual contact details for 2 x references (name? email? relationship?) or is this detail provided at a later stage. The UoS would like the ability to speak to referees. However, we're happy at this stage for you to confirm that such details can be provided. The contact details can then be shared securely following the initial down selection of suppliers. 7. Q&A session video Regarding todays (18th November) Q&A session, the video for this is now available to be accessed via the following link:https://www.sheffield.ac.uk/it-services/iam-tendering-process 8. How many users does the IDAM system currently support There are currently approximately 230,000 account records in CRIS. (Appox 115,000 of these are student applicant accounts of people who may not join the University.) The system also keeps record of deleted accounts in addition to this. 9. Do you have any existing role or persona definitions? We have very basic role definitions such as "student - ug" (undergraduate) , "student - tpg" (taught postgrauate) , "staff", "staff - causual" etc. but nothing at job function level, other than job title which can vary between departments. 10. Is there a complete application / service catalogue? No. However, information is available for the majority of core systems. 11. What’s the current application spread in terms of cloud/on-premises? In terms of authentication, everything is currently on-premises except for AzureAD and our current MFA provider. AzureAD is reliant on an on-premises federation and is currently only used to support Office 365 licencing. Our MFA has some reliance with on-premises infrastructure. 12. Are you looking for the supplier to provide input and support for Business Change and Adoption services. Yes. This will be key to successful delivery and will become increasingly more important during later phases of the IDAM programme when we look to progress implementation work packages. 13. How many users affected by the change? Potentially all users to some degree depending on the nature of the change implemented. 14. Do you have any existing change management processes? We have an IT services change management process. 15. How does the organisation respond to change? Answer Part A - Although, this initial project covers discovery only, it is expected to lead to a significant programme of work which will involve business change as well as technology. As with most large organisations, some teams and areas within the University will be less receptive to change than others. 16. How does the organisation respond to change? Answer Part B - There are then additional challenges around devolved decision making, where some departments have their own IT provision and enjoy a certain level of autonomy from the central IT function. We are therefore looking to work with a third party who has wide experience of delivering business change in large and complex organisations. Our partner will need to work closely with the internal project team to secure stakeholder buy in and to fully support the University through all transformation activities. 17. Are there any accreditations that the university is trying to attain as part of this work (E.G. CE+, ISO27001, etc)? While the University and departments across the university may have pipeline requirements for accreditations there is no specific identified requirements that are included in the scope of this work