Identity and Access Management Solution
I. Introduction
This is a Request for Information (RFI) only. Any and all information requested in response to this RFI is for market research purposes only. In accordance with FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the U.S. Government to form a binding contract. The U.S. Government is under no obligation to issue a solicitation or to award any contract on the basis of this RFI. All costs associated with responding to this RFI will be the sole responsibility of the contractor. All submissions to this RFI will be treated as business materials, become U.S. Government property, and will not be returned.
II. Background
The Library of Congress, an agency of the Legislative Branch of the Federal Government, is the world's largest and most comprehensive library, maintaining a collection of more than 124 million items - many of them unique and irreplaceable - in more than 450 languages. It directly serves not only the Congress, but also the entire nation.
The Library of Congress has recently defined requirements to deploy an Identity and Access Management solution. The objectives of these requirements are to arrive at a solution that provides the following:
(a) Multifactor authentication(MFA).
1) Is vendor agnostic.
2) Allows for different types of authentication factors based on one of several different use cases.
3) Quickly allows for the installation of new types of authentication methods and deactivation outdated or no longer needed authentication methods.
(b) Allows for management of credentials, accounts and MFA for both "on premise" and "cloud-based" applications and systems.
(c) Allows for rapid on and off boarding of users.
(d) Allows for both managed and unmanaged configurations.
(e) Has the ability to link with HR Systems, like Empower HR.
III. Scope
This RFI is intended to assist the Library of Congress in its review of the current solutions being offered in the marketplace for multifactor authentication. The Library of Congress is requesting responses that detail solutions that meet or exceed the identified requirements and provide a full description of services offered, methods of implementation, and scope of the solution.
IV. Requirements
General Solution - The Identity and Access Management solution must:
1. Be a single-vendor solution
2. Provide robust reporting features
3. Provide an informative and intuitive management console
4. Provide support for account life-cycle management
5. Manage accounts on multiple platforms, including cloud-based systems /applications and thick clients
6. Be able to be configured to manage user accounts and passwords or solely user accounts
7. Integrate with HR management systems
8. Provide a highly flexible and customizable policy for various authentication scenarios
Multifactor Support
9. The Identity and Access Management solution must supports the following multifactor types:
• Out of Band Push
• Out of Band SMS
• One Time Password App for Smartphones
• Biometric (Fingerprint and/or Face)
• Voice
Managed Services
10. The Identity and Access Management solution must provide application as an identity and access management as a service (IDaaS)
V. Information Requested
Part 1: Business Information
1. Name of organization
a) Submitter's Name
b) Street Address, City, State, nine-digit Zip Code
c) Point of Contact (POC), if different from Submitter.
d) Telephone and fascimile numbers, email address.
2. Past Federal experience:
- Has the organization implemented this approach at other Federal agencies?
3. Capabilities:
- Describe the capabilities/qualifications/skills the organization possesses to provide the solution as described in the RFI.
Part 2: Recommended Solution
1. Recommend a solution to achieve the objectives of the requirements stated in the RFI.
2. Provide a cost estimate for the recommended solution(s) including the following elements:
a. Solution cost structure.
b. Solution implementation costs.
c. Required hardware and software and associated costs.
d. Proposed hosting models, recommendations, and corresponding costs.
3. Provide an estimated time-line for implementing the proposed solution and provide a list of recommended, corresponding deliverables, along with a justification for each.
4. Provide a set of best practices for successful execution/implementation of the proposed solution.
5. Provide a list of requirements needed from the Library of Congress to ensure successful implementation.
Part 3: Requirements
1. State whether the Library has identified the essential functions required to achieve the objectives set forth in this RFI.
2. Identify requirements/functions specified in Section IV that are not required. Explain why they are not required.
3. Provide a matrix of the requirements set forth in Section IV. Identify which requirements the solution(s) can and cannot meet. Elaborate on requirements that cannot be met through your solution(s) or that need additional clarification.
V. Questions
Questions must be submitted in writing no later than 12 noon EST, March 20, 2017 to apiper@loc.gov. ; Answers to questions will post on FBO no later than Thursday, March 23, 2017.
VI. Submission of Responses
Responses to this RFI should be submitted using MS Word, no later than 2:00 PM EST, Thursday, April 6, 2017 to apiper@loc.gov. ; Responses to all or part of the RFI will be accepted. Proprietary information shall be clearly marked. The Government will NOT be responsible for any proprietary information not clearly marked.
Responses received after Thursday, April 6, 2017 may not be considered in the government's analysis.
The government may elect to contact RFI respondents to get clarification on information submitted.
Ann Piper, Contract Specialist, Phone 202-707-4928, Fax 202-707-0485, Email apiper@loc.gov
