REQUEST FOR INFORMATION (RFI) FOR Identity and Access Management Solution

Transcription

1 REQUEST FOR INFORMATION (RFI) FOR Identity and Access Management Solution RFI #: AK1-2018SMU-IAM RFI Date Issued: January 23, 2018 Response Due Date: February 9, 2018 RFI Issued by: Abby Kinney, IT Category Manager SMU Purchasing Department SPECIAL NOTE: This Request for Information (RFI) does not obligate Southern Methodist University or its Board of Trustees to award a contract or complete the proposed project. 1 P age

2 Contents Section 1. Background... 3 Section 2. Statement of Need... 3 Section 3. RFI Process... 4 Section 4. Contacts... 5 Section 5. RFI Schedule... 5 Section 6. Review of Responses Schedule... 5 Section 7. Vendor Profile... 5 Section 8. Product Questions and Requirements P age

3 Section 1. Background Southern Methodist University FORMAL REQUEST FOR INFORMATION (RFI) As a private, tax-exempt university enriched by its United Methodist heritage and partnership with the Dallas-Fort Worth area, SMU seeks to enhance the intellectual, cultural, technological, ethical, and social development of a diverse student body. SMU offers undergraduate programs centered on the liberal arts and excellent graduate, professional, and continuing education programs. The SMU experience also includes accessible faculty in small classes and abundant opportunities for research experience, international study, leadership development, and service and internship opportunities beyond campus all with the goal of preparing students to become contributing citizens and leaders for our state, nation and world. SMU has approximately 11,000 students studying in seven degree-granting schools: Cox School of Business, Dedman College of Humanities and Sciences, Meadows School of the Arts, Bobby B. Lyle School of Engineering, Dedman School of Law, Annette Caldwell Simmons School of Education and Human Development, and Perkins School of Theology. Founded in 1911 by what is now The United Methodist Church, SMU is nonsectarian in its teaching and committed to academic freedom and open inquiry. Owned by the South Central Jurisdiction of the United Methodist Church, SMU is managed by a Board of Trustees that includes civic, business, education, and religious leaders who represent various faiths and geographic areas. Section 2. Statement of Need The Office of Information Technology is in the process of compiling requirements for and exploring the need for Identity and Access Management (IAM) solutions. The team is gathering information to better understand the current and future states of Identity and Access Management solutions specifically targeted for institutions of higher education. Vendors should be prepared to address the needs of the University as a consortium of higher education institutions. NOTE: This RFI does not obligate Southern Methodist University to purchase any goods or services. SMU is seeking the following key attributes. The proposer must: 1. Act as a strategic advisor to help the team define objectives, roadmap, timelines, and implementation strategies for Identity Management and Access Management solutions. The selected advisor will likely be independent from any specific IAM solution provider, although this is not a requirement. The selected advisor is expected to become a strategic partner who will assist the team in identifying one or more IAM solution providers and an implementer. 2. Demonstrate strong familiarity with IAM challenges specific to higher 3 P age

4 educational institutions, and the current marketplace of solutions that may be appropriate for the demands identified. 3. Be familiar with compliance regulations that pertain to data collection, data storage, data governance, and data accessibility regarding students, employees, and non-affiliated users in the University s systems. 4. Be familiar with pertinent technologies in scope for Access Management, such as Oracle PeopleSoft, Microsoft Active Directory, Microsoft Office 365, Microsoft Exchange, Microsoft Skype for Business, Duo Security, as well as physical building access, and many others. 5. Have a minimum of three years experience as a strategic partner for IAM implementations with large institutions and systems of Higher Education. 6. Have a strong familiarity with the Identity Management and Access Management marketplace, including open source products. 7. Demonstrate solid communication and presentation skills appropriate for multiple audiences, varying from executives and data custodians to programmers and IT professionals. 8. Comply with privacy standards regulated by both internal and external auditors. 9. Deliver solid, experience-based and data-based justifications for each strategy, proposal, and recommendation provided. Section 3. RFI Process This section describes the process that respondents to the Request for Information will follow in this solicitation. 1. Issuance The issuance date of this RFI is January 23, Response Submittal Responses should be made for Sections 7 and 8 and should be organized in that specific order. Each responder is requested to submit an electronic response in PDF or MS Word format along with any attachments (no marketing materials) on or before the response due date (see Section 5. RFI Schedule). Responses should be sent to: Abby Kinney at akinney@smu.edu. At the conclusion of this RFI process, SMU expects the following sequence of events: To have selected a consultant to perform an assessment of the current environment and to have them assist in formulating objectives, roadmap, timelines, and implementation strategies. To quickly begin an RFP process to identify and select a strong strategic partner/consulting firm for the duration of the IAM implementation project. (However, selection of the partner may result from this RFI process, allowing the University to move directly to the next step.) To proceed quickly afterward with another RFP to select one or more IAM solution providers. To have gained strong market insights and a clear understanding of the best-of-breed IAM solutions best targeted for our specific environment and objectives. Sequence: RFI for consultant -> RFP for consultant (if needed) -> RFP for solution provider(s) 4 P age

5 NOTE: The University is not liable for any costs incurred by Responders in developing the responses directly or indirectly related to this Request for Information (RFI). Respondent is responsible for all costs associated with creation of a response or any follow-up requests. All responses submitted become the property of the University. Section 4. Contacts Questions and requests for additional information should be directed to Abby Kinney at akinney@smu.edu. Section 5. RFI Schedule Issue RFI: January 23, 2018 RFI Questions: January 29, 2018 by 6PM CST Responses to Questions (If any) will be available February 4, 2018 by 6PM CST RFI response Due: February 9, 2018 by 6PM CST Section 6. Review of Responses Schedule Representatives of the University will review all responses received by the deadline. Because of the nature of an RFI, there will be no response rating or formal determination of solution. Section 7 Vendor Profile 1. Identify the company name, address, city, state, zip code, telephone, and fax numbers. 2. Identify the name, title, address, phone and fax numbers, and address of the primary contact person for this project. 3. Provide a brief overview of the company including number of years in business, number of employees, nature of business, and description of clients. 4. Identify any parent corporation and/or subsidiaries, if appropriate. 5. List any industry awards/recognition that you have received, the awarding party, and the date received. 6. Indicate the total number of installations in the last 3 years by the year of installation and the total number of current users for the proposed system. 7. Provide a summary of the company s short-term and long term-goals, and strategic vision. 8. Provide a list of three references similar in size and scope in higher education. References should be clients who have had a system installed within the past 48 months. (Include name, contact, address, telephone, system(s) installed and date of installation). 5 P age

6 Section 8 Product Questions and Requirements Provide responses to all questions. 1. Which of the following solutions does the company implement or support? Clearly identify experience with all products in each area? a. Identity Management solutions b. Access Management solutions c. IAM Governance solutions 2. What standards must supported products adhere to, including interoperability with other solutions? 3. What skills will be required at SMU to support and grow the solution implementation? 4. Is auditing data included with each solution to know what identity attributes, roles, permissions, and services a given user had at a given point in time? 5. In what ways might your company assist with our implementation strategy, roadmap, testing, and evaluation of proposed solutions? 6. Based on your company s experience, what are the major cost drivers in offering consulting services? 6 P age