15-Specifications.pdf

SPECIFICATIONS

SCOPE

Harris County is seeking proposals from qualified vendor(s) to provide a comprehensive solution for an enterprise identity and access management system as described herein. The term shall begin on or about May 1, 2026 and ending twelve (12) months thereafter or until all services ordered prior to the expiration date have been satisfactorily delivered and accepted or performed satisfactorily for the using department.

It is the responsibility of each vendor to examine the entire RFP package, seek clarification in writing, and review their offer for accuracy before submitting. Questions relating to this RFP must be submitted in writing through Bonfire. The deadline for submission of questions relating to this RFP is listed on the Event schedule within Bonfire of this project. All questions submitted in writing prior to the deadline will be compiled and answered in writing. A copy of all questions and answers will be released as a Public Notice within Bonfire to all firms. The County will not be bound be any information conveyed verbally.

PRE-PROPOSAL CONFERENCE

A pre-proposal conference will be held January 6, 2025 at 10:00am local time, Houston, TX via Microsoft Teams.

Attendance is not mandatory; however, all vendor(s) are encouraged to attend in order to have a better understanding of the requirements of this Request for Proposal (RFP). Persons with disabilities requiring special accommodations should contact Office of the Purchasing Agent at 713-274-4400 at least two (2) days prior to the conference.

Join the meeting now Meeting ID: 211 301 237 029 94

Passcode: Pg9KT9us Dial in by phone +1 281-985-1862,,603703594# United States, Aldine Find a local number Phone conference ID: 603 703 594#

RENEWAL OPTIONS

Harris County may consider four (4) one-year renewal options, renewable one (1) year at a time, based upon the same terms, conditions and pricing as the original year. Renewal is subject to approval by the Harris County Commissioners Court. Once renewal options are exhausted, the contract must be rebid. Harris County reserves the right to rebid at any time as is in its best interest and is not automatically bound to renew.

BACKGROUND

Harris County, Texas is the 3rd most populous county in the nation, ranking behind Los Angeles County, California and Cook County, Illinois. The County seat is Houston, Texas, the 4th largest city in nation. There are thirty-eight

(38) municipalities located within the 1,788 square mile geographical boundary of Harris County. Harris County has a culturally diverse community with a population near 5 million according to the 2020 U.S. Census estimate. The County is governed by a five (5) member Commissioners Court, which is comprised of four County Commissioners (Commissioner Precincts 1 - 4) and the County Judge. Records Management, Property and Housing, Transportation, Health and Medical Services, Education, Family and Social Services, and Parks and Recreation. Many of these services involve the handling of sensitive data such as Personally Identifiable Information (PII), Personal Health Information (PHI), financial records, criminal justice data, and other confidential business information. Ensuring the confidentiality, integrity, and availability of this data is paramount to maintaining public trust and meeting regulatory obligations.

Harris County employs over 18,000 personnel across a diverse range of departments, each with distinct operational requirements and access needs. Accordingly, the proposed solution must be highly scalable and adaptable to support a large, dynamic, and continuously evolving identity ecosystem.

Harris County Universal Services (HCUS) has initiated a comprehensive Enterprise Identity and Access Management

(IAM) modernization effort to proactively address escalating cybersecurity threats, regulatory compliance

Enterprise Identity and Access Management (IAM) System for Harris County Universal Services https://teams.microsoft.com/l/meetup-join/19%3ameeting_MDFkM2ZmYTUtNDgzMy00MjI2LWE1MTMtY2U2Y2Q2Mzg2MGJh%40thread.v2/0?context=%7b%22Tid%22%3a%220d9bc79c-581b-4477-acf7-8d70dd3e555a%22%2c%22Oid%22%3a%22e78dcd2c-7268-4b74-ac8b-a6a6e103294a%22%7d tel:+12819851862,,603703594 https://dialin.teams.microsoft.com/e48917d9-8244-4157-a343-69eb2b79d56b?id=603703594 requirements, and operational inefficiencies. This initiative is designed to unify and enhance identity management capabilities across the enterprise, supporting a scalable, secure, and policy-driven framework that aligns with industry best practices and the County’s long-term strategic goals.

The IAM platform shall be the foundational infrastructure for managing identity governance and access control across all departments. The centralized platform shall streamline user lifecycle management, strengthen security protocols, and ensure consistent access policies across the County’s diverse systems and services.

Current Environment

Harris County’s IAM processes are currently fragmented and distributed across multiple teams, including Human Resources, PeopleSoft, IAM, Infrastructure (Active Directory), and Helpdesk. This decentralized structure has resulted in operational inefficiencies, compliance gaps, and heightened security risks.

The County’s existing IAM infrastructure relies on a combination of disconnected tools, including the One Identity suite—Identity Manager (HCAM), Safeguard Privileged Access Management (PAM), and Password Manager—as well as various Microsoft products such as Active Directory (AD), Active Directory Federation Services (ADFS), Microsoft Identity Manager (MIM), Entra ID, Azure Self-Service Password Reset (SSPR), and PowerShell scripts.

These systems lack the necessary automation, integration, and scalability to support enterprise-wide identity lifecycle management for approximately 22,000 active users.

Historically, IAM solutions were deployed in an ad-hoc manner to address specific departmental needs. Over time, this approach led to siloed systems, broken workflows, inconsistent practices, and the absence of a unified strategy.

As a result, the County faces challenges including unmanaged privileged accounts, orphaned user identities, and non-compliance with regulatory standards and operational efficiencies.

Identified Gaps

• Decentralized Privileged Access Management (PAM): Limited visibility and oversight of administrative access have led to unmonitored and unauthorized privileged accounts, violating principles of least privilege and segregation of duties, thereby increasing compliance and security risks.

• Fragmented Identity Management: Disconnected user repositories have resulted in orphaned and unmanaged accounts across platforms:

o ~30,867 on-premise active user licenses in HCAM o ~75,225 on-premise active user licenses in Microsoft AD o ~51,914 cloud active user licenses in Microsoft Entra ID, registered across 2,667 cloud applications

• Insufficient PAM Controls: Lack of full session monitoring, detailed audit logging, and Just-In-Time (JIT) access for root, global, domain, cloud, local admin, and vendor accounts.

• Limited Password Self-Service: Inadequate self-service capabilities have led to increased password-reset requests, placing a significant burden on Helpdesk operations.

• Missing Core IAM Features: Absence of integrated Multi-Factor Authentication (MFA), Single Sign-On (SSO), Identity Governance Management (IGM), and System for Cross-domain Identity Management (SCIM) capabilities.

• Deficient Analytics and Monitoring: Limited audit logging and lack of integration with Security Information and

Event Management (SIEM), Security Operations Center (SOC), and Network Operations Center (NOC) tools hinder continuous threat detection and vulnerability monitoring and escalation.

• Weak Compliance Reporting and Governance: Inadequate reporting capabilities contribute to operational inefficiencies and increased exposure to regulatory violations.

• Manual and Disconnected Workflows: Heavy reliance on manual processes and scripting impedes scalability and consistency.

• Lack of Key Management Infrastructure: Absence of token and key vaults, along with delayed rotation and recycling of service accounts, poses additional security risks.

• Multi-cloud platforms and hybrid applications used to manage disaster recovery (DR) and various other SaaS applications/solutions as part of IT modernizations require consistent identity, access, and policy controls across new environments. The absence of unified governance can lead to inconsistent and unmanaged privileges, as well as delayed threat responses across different environments.

Current Challenges

The County’s hybrid and multi-cloud infrastructure, spanning on-premises, hybrid, Azure, AWS, and OCI, and other SaaS applications creates additional complexity in enforcing consistent identity, access, and policy controls across.

Without centralized orchestration and integration across these platforms, visibility, automation, and compliance remain fragmented. This lack of unified governance increases the risk of inconsistent configurations, unmanaged privileges, and delayed threat response across environments.

Key Objectives for this RFP include, but are not limited to:

• Centralized IAM Platform: Unified identity and access management across cloud, hybrid, and on-premise environments, integrated with internal and external applications.

• Environment Provisioning: Support for Development, QA/Test, and Production environments, including Disaster Recovery (DR) capabilities for non-SaaS solutions.

• Process Consolidation: Elimination of fragmented workflows and manual interventions across HR, PeopleSoft, IAM, Infrastructure, and Helpdesk teams.

• Automation and Policy Enforcement: Implementation of automated, policy-driven workflows to streamline identity lifecycle management.

• Security Enhancements: Implementation of Zero Trust Network Access (ZTNA), Single Sign-On (SSO), and Multi-Factor Authentication (MFA) with minimal privileged security access policies.

• Regulatory Compliance: Continuous alignment with federal, state, and local compliance frameworks and standards.

• Advanced Analytics and Monitoring: Integration of threat intelligence, auditing, logging, and real-time analytics powered by AI/ML for proactive anomaly detection and intelligent access decisions.

This initiative reflects Harris County’s commitment to modernizing its IT infrastructure, enhancing cybersecurity posture, and delivering secure, efficient services to its residents and workforce.

SPECIFICATIONS

Harris County Universal Services (HCUS) is soliciting proposals from qualified firms to conduct a comprehensive assessment of its current identity and access management tools and processes. The objective is to identify opportunities for modernization, streamline workflows, and implement technologies that align with industry’s best practices.

The envisioned future-state IAM system will serve as a centralized, scalable framework for managing the complete identity lifecycle, enforcing privileged access controls, and maintaining continuous compliance. It must seamlessly integrate across HCUS’s hybrid and multi-cloud environments, while also supporting interoperability with external agency systems, customer platforms, and vendor solutions. This approach will ensure secure, cohesive, and efficient identity governance throughout the enterprise.

To ensure data security, compliance with applicable laws, and operational oversight, offshore services are strictly prohibited under this contract. All work, including data processing, system development, support, and hosting, must be performed within the United States.

The County reserves the right to determine the appropriateness of online and remote work arrangements on a case-by-case basis. Any remote or virtual service delivery must be pre-approved by the County and meet all security, performance, and accessibility standards outlined in this RFP.

Vendor shall demonstrate their experience and expertise in relation to the scope of services defined in Section 1:

Functional Requirements and Section 4: Technical Requirements.

Information regarding proposed methodology, approach, and deliverables, shall be included in Section II of vendor’s response.

Section 1: General Requirements

At a minimum, the proposed solution must meet the following general requirements:

1.1. End-to-End Identity Lifecycle Automation: Automate access requests, onboarding, offboarding, internal transfers, and terminations, incorporating approval workflows to ensure policy compliance and operational efficiency.

1.2. Comprehensive Compliance Framework: Support prebuilt templates and controls aligned with regulatory standards including CJIS, HIPAA, PCI-DSS, GDPR, NIST, FedRAMP, TX-RAMP, SOC 2, and ISO 27001.

1.3. Scalable Architecture: Deliver a robust, centralized IAM solution capable of supporting Harris County’s complex and dynamic operational environment.

1.4. Effective Adoption Strategy: Employ a “train-the-trainer” model to facilitate scalable knowledge transfer and ensure successful deployment and user adoption across departments.

1.5. Project Timeline: The County anticipates awarding the contract in Quarter One (Q1) 2026, with implementation scheduled to begin in Quarter Two (Q2) 2026.

1.6. Prefer Commercial Off-The-Shelf (COTS) solution over custom solution to ensure scalability, adaptability, integration, automation, vendor support, and faster implementation/upgrades.

Section 2: Functional Requirements

This section outlines detailed requirements necessary to streamline application processes through automated notifications, intuitive self-serve portal for users, eliminating redundant efforts, improving productivity by providing system generated calculations, and reducing paper-based processes. The proposed solution must, at a minimum, support the following functional requirements to ensure comprehensive, secure, and scalable IAM solution:

2.1. Identity Management

2.1.1. User Lifecycle Management

2.1.1.1. Create, update, deactivate user accounts to include joiners of the organization, movers, and termination/leaver processes.

2.1.1.2. Temporary assignments of access.

2.1.2. Directory Integration

2.1.2.1. Provide synchronization services with Active Directory, Lightweight Directory Access Protocol (LDAP), HR systems, PeopleSoft (i.e. Human Capital management (HCM) and Financial and Supply Chain Management (FSCM), or cloud directories (Microsoft Entra ID).

2.1.2.2. Existing Synchronization Tools or Middleware:

2.1.2.2.1. Microsoft Identity Manager (MIM)

2.1.2.2.2. Microsoft Active Directory (AD)

2.1.2.2.3. PowerShell (automation)

2.1.2.2.4. Microsoft Active Directory Federation Services (ADFS)

2.1.2.2.5. PKI Services (native MS Consoles) within Microsoft Management Console

(MMC)

2.1.2.2.6. Native tools of One identity Quest solutions (i.e. Identity manager, Safeguard PAM, & Password Manager)

2.1.3. Self-Service

2.1.3.1. User self-service portals shall be available for password resets.

2.1.4. Identity Proofing

2.1.4.1. Verify identities at registration or onboarding (e.g., document uploads, biometrics).

2.1.4.2. Tools currently used for provisioning, de-provisioning, or attribute synchronization:

2.1.4.2.1. One Identity Quest Solutions:

2.1.4.2.1.1. Identity Manager

2.1.4.2.1.2. Password Manager self-service portal

2.1.4.2.1.3. Safeguard for Privileged Access Management (PAM)

2.1.4.2.1.3.1. Safeguard for Privileged Passwords (SPP)

2.1.4.2.1.3.2. Safeguard for Privileged Sessions (SPS)

2.2. Access Management

2.2.1. Authentication

2.2.1.1. Single Sign-On (SSO)

2.2.1.2. Multi-Factor Authentication (MFA)

2.2.1.3. Authentication (e.g., password less, biometrics, certificates).

2.2.2. Authorization

2.2.2.1. Role-Based Access Control (RBAC)

2.2.2.2. Attribute-Based Access Control (ABAC)

2.2.2.3. Policy-Based Access Control (PBAC)

2.3. Privileged Access Management

2.3.1. Secure and monitor access to sensitive systems by administrators and privileged users.

2.3.2. Vaulting and rotating privileged credentials.

2.3.3. Just-In-Time (JIT) access provisioning.

2.4. Access Governance

2.4.1. Access Reviews Certifications

2.4.1.1. Periodic review and revalidation of user access.

2.4.2. Separation of Duties (SoD)

2.4.2.1. Detect and prevent conflicts in assigned roles.

2.4.3. Auditing and Reporting

2.4.3.1. Track and log user activities, login attempts, access changes, etc.

2.4.4. Compliance

2.4.4.1. Support for Sarbanes-Oxley Act (SOX), Health Insurance Portability and Accountability Act

(HIPAA), Criminal Justice Information Services (CJIS), Payment Card Industry Data Security Standard (PCI-DSS), National Institute of Standards and Technology (NIST), General Data Protection Regulation (GDPR), etc.

2.5. Federation And Integration

2.5.1. Support for standards like Security Assertion Markup Language (SAML), OpenID Connect (OIDC), Open Authorization 2.0 (OAuth2), Web Services Federation (WS-Fed), System for Cross-domain Identity Management (SCIM) for integrating third-party apps.

2.5.2. Federation across multiple identity providers.

2.6. Risk And Threat Detection

2.6.1. Behavior analytics (UEBA) to detect abnormal usage patterns.

2.6.2. Risk-based authentication dynamically adjusts authentication requirements.

2.7. Application Programming Interface (API) Security and Management

2.7.1. Secure access to API with OAuth tokens, scopes, consent management.

2.7.2. API Gateway Security Policy Enforcement.

2.7.3. API Rate limiting and Anomaly Detection.

2.8. Additional Desired Features

2.8.1. Identity Governance and Administration (IGA)

2.8.1.1. Deeper governance functions.

2.8.2. Decentralized Identity Support

2.8.2.1. Verifiable credentials, block-chain-based identities.

2.8.3. Delegated Administration

2.8.3.1. Allowing specific admins to manage users for a subset of the organization.

2.8.4. Entitlement Management

2.8.4.1. Fine-grained control over access rights.

2.8.5. Litigation Account Identification and Management

2.8.6. Product Lifecycle Management (PLM) Integration

Section 3: System Requirements

The proposed solution shall meet the following system requirements, including, but not to, the requirements listed below:

3.1. Identity Management

3.1.1. Support for user provisioning, deprovisioning, updating identities and integrations with critical systems

3.1.2. Integration with HR systems (e.g., PeopleSoft, Workday, SAP SuccessFactors) as authoritative sources

3.1.3. Directory integration and synchronization (Active Directory, LDAP, cloud directories like Azure AD)

3.1.4. Self-service portals: password reset, and account unlock.

3.1.5. Bulk import/export of users via Application Programming Interfaces (APIs), System for Cross-domain

Identity Management (SCIM), or Comma-Separated Values (CSV).

3.1.6. Identity proofing (desired / optional): Know Your Customer (KYC), document verification.

3.2. Authentication And Access Control

3.2.1. Single Sign-On (SSO) using Security Assertion Markup Language (SAML 2.0), OpenID Connect (OIDC), Open Authorization (OAuth 2.x).

3.2.2. Multi-Factor Authentication (MFA): Support for SMS, email OTP, mobile authenticator apps, hardware keys, biometrics, hardware tokens (YubiKey).

3.2.3. Risk-based authentication: Adaptive MFA based on user/device behavior.

3.2.4. Password less authentication: FID02 / Web Authentication (WebAuthn) support.

3.2.5. Role-Based Access Control (RBAC): Assign users to roles, manage access at role level.

3.2.6. Attribute-Based Access Control (ABAC) (desired/optional): Access decisions based on dynamic user attributes.

3.2.7. Policy Based Access Controls (PBAC): Access decisions and risks assessments based on county policies.

3.2.8. Policy-Based Access Control (PBAC): Access defined through explicit security policies (nice to have option).

3.3. Federation and External Identities

3.3.1. Identity federation: Accept users from external Identity Providers (IdPs).

3.3.2. Support for Inbound SAML, Outbound SAML, OIDC federation.

3.3.3. Just-in-Time (JIT) provisioning for federated users.

3.3.4. Delegated authentication to third-party IdPs (Google, Azure, ADFS, etc.).

3.4. Access Governance and Compliance

3.4.1. Access certifications: periodic access review and approval flows.

3.4.2. Separation of Duties (SoD) policies: prevent toxic role combinations.

3.4.3. Audit logging: Capture authentication events, authorization events, provisioning changes.

3.4.4. Compliance reporting: SOX, HIPAA, GDPR, NIST, ISO 27001 ready templates.

3.4.5. Retention policies for logs and audit trails (customizable).

3.5. Privileged Access Management

3.5.1. Secure vault for privileged credentials (passwords, Secure Shell (SSH) keys).

3.5.2. Session management: monitoring and recording of administrative sessions.

3.5.3. Just-In-Time (JIT) privilege elevation and temporary access grants.

3.5.4. Password rotation for privileged accounts.

3.6. Integration And APIs

3.6.1. SCIM 2.0 support for user and group provisioning.

3.6.2. REST APIs for all major functions (provisioning, access requests, authentication).

3.6.3. SDKs for popular programming languages (Java, Python, Node.js, .NET platforms).

3.6.4. Webhooks for real-time event notifications.

3.6.5. Integration with SIEM/SOC systems (Sentinel, Sentinel One, Splunk, QRadar, Elastic) for security monitoring.

3.6.6. Replace and integrate legacy home grown IAM system with centralized, enterprise-grade IAM platform.

3.7. User Experience

3.7.1. Customizable login pages and branding options with mobile-friendly user interfaces and progressive profiling.

3.7.2. Progressive profiling (gather additional user data over time).

3.7.3. Localization: multilingual support (User Interface (UI) labels, notifications).

3.8. Deployment And Scalability

3.8.1. Cloud-native (SaaS) option, on-premises, or hybrid deployment models.

3.8.2. High availability (multi-region support, 99.9%+ SLA).

3.8.3. Scalability: Should handle hundreds of thousands of identities if needed.

3.8.4. Disaster recovery and backup capabilities.

3.9. Security Requirements

3.9.1. End-to-end encryption (TLS 1.3+).

3.9.2. Data-at-rest encryption (AES-256 or higher).

3.9.3. Granular access control for administrative functions (admin RBAC).

3.9.4. Support for Zero Trust Architecture principles.

3.9.5. API security (OAuth2 token validation, rate limiting, API scopes).

3.9.6. Compliance with security standards, System and Organization Controls 2(SOC2), Federal Information

Processing Standards (FIPS), International Organization for Standardization 27001(ISO 27001), Federal Risk and Authorization Management Program (FedRAMP), Texas Risk and Authorization Management Program (TX-RAMP), Health Insurance Portability and Accountability Act (HIPPA), National Institute of Standards and Technology/ Security and Privacy Controls for Information Systems and Organizations (NSIT SP 800-53), etc.

3.10. Administrative Features

3.10.1. Delegated administration for different departments and business units.

3.10.2. Workflow engine for approvals (e.g. manager approval for access requests).

3.10.3. Policy management for UI for defining access control, authentication, governance policies.

3.10.4. Dashboard and analytics: real-time insights into system health, user activity, and compliance status.

3.11. Optional Future-Proofing Requirements

3.11.1. Support for Decentralized Identity (DID) and Verifiable Credentials (VC).

3.11.2. AI/ML-driven risk analysis for user behavior (adaptive access decisions).

3.11.3. Password less-first architecture readiness.

Section 4: Technical Requirements

The technical requirements are constructed to correlate to the Harris County Universal Services Reference

Architecture (USRA) and to determine vendor’s ability to provide technical capabilities. When proposing a response to this RFP, the vendor shall address all subsections of the technical requirements for the proposed solutions and services supporting US needs.

4.1. HCUS Reference Architecture (USRA)

The USRA is a compact, comprehensive, abstract illustration of the technology components and business processes supporting County operations, as illustrated in the attachment titled Harris County Universal Services Reference Architecture (USRA). The USRA has been developed to provide guidance on how solutions shall deploy and operate within the Information Technology (IT) environment. The USRA serves as a reference for the specific architectures that vendors may implement to solve County business objectives.

4.2. The USRA Consist of Six (6) Interrelated Domains:

Vendor shall respond to technical requirements pertaining to the domains of:

4.2.1. Data Services

4.2.2. Digital Services

4.2.3. Enterprise Technology Infrastructure Services

4.2.4. Information Security Services

4.2.5. IT Management

4.2.6. Technology Optimization

4.3. USRA Checklist Questionnaire Q-13LW

Vendors shall complete the questionnaire as part of vendor’s proposal response. "Complete” is defined as responding to all questions. A response is still required for non-applicable questions. The questionnaire will assist the County in understanding the scope, capabilities, technical implementation, and deployment features of the proposed solution.

4.4. Technical Requirements Domain:

4.4.1. Vendors shall respond to technical requirements pertaining to the domains of:

4.4.2. Data Management

4.4.3. Application Management

4.4.4. Infrastructure Management (including Server and Network Services)

4.4.5. Security Management

4.4.6. Service Management

4.4.7. Program Management

4.4.8. Disaster Recovery and Business Continuity Management

4.5. Methods of Delivery

Vendor shall present the County with details on at least one (1) of the following delivery options for the proposed solution, along with any alternative delivery methods that may be available:

4.5.1. Premise-based

Premise-based solution; all servers will be provided by the vendor, installed at County location(s), and maintained as part of the enterprise. The solution (all hardware and software) is owned by County and is often viewed as a capital expense. County maintains control of the servers and maintains their security.

4.5.2. SaaS (Software as a Service)

SaaS, an on-demand, and a hosted model; in this case the provider licenses an application that is hosted at a remote location (i.e., Network Operations Center) to customers through a subscription model, generally a monthly or yearly fee. This approach can also take into consideration a “cloud computing” model where all the technology is in the “cloud” and accessed over the Internet as a service.

4.5.3. Hybrid Model

Hybrid model in which the solution (hardware / software) is hosted at the County location and the provider will perform the day-to-day responsibility of managing (maintain and support) the software/hardware for the County. The management of the solution could be either through onsite presence or remote. The provider’s expertise and experience in this subject area is important for more efficient operations.

The County requires vendors to propose at least one (1) approach that provides an efficient solution while meeting both the County’s functional requirements and its technical standards, including the data-centric architecture approach. At all points, the County will have ownership of its data and shall be able to access or be provided the required data to support the proposed service or other services deemed necessary to access the information. If otherwise, the vendor shall state the reasons (functional and technical), as to why they cannot meet the County’s requirements.

4.6. Platform Administration/ Professional Service

Vendor shall provide the County with platform administration (maintain & run). System administration and maintenance of implemented platform, as well as the addition of new software components if needed, is expected to be provided by the vendor based on the method of delivery (Section 4.5) adopted.

4.7. Data Management

Vendor is expected to provide the County with details on their approach to the following data management areas:

4.7.1. Data Governance

4.7.2. Data Quality

4.7.3. Data Security

4.7.4. Data Operations

Section 5: Acceptance Criteria

Vendor shall comply with the following acceptance criteria:

5.1. Product delivery, configuration, and training, which successfully meet all requirements outlined in the RFP, shall be provided by the specified dates. Any changes to delivery dates must have prior approval (in writing) from the County.

5.2. The County has the sole responsibility of determining the completeness of vendor’s work. The County will complete a review of delivered products, configuration, and training within ten (10) business days from the date of receipt.

5.3. In the event the County does not approve a product or service provided herein, vendor will be notified in writing with specific reasons. Vendor will have fifteen (15) business days to correct the unaccepted product or service.

5.4. Vendor shall correct any latent defects identified after the acceptance of a product or service (where appropriate) at no additional charge to the County.

Section 6: Maintenance/Support/Warranty

Upon Final System Acceptance (FSA) and training, the maintenance/support/warranty of the system shall commence on the first day of the official operation of the system as designated by Harris County. At a minimum, the system shall include twelve (12) months of maintenance/support/warranty to include upgrades, patches, fixes and support via phone, web, and email. Pricing shall also reflect annual renewal, and maintenance or license fees for subsequent and continued use of the system.

Vendor shall describe each SLA associated for each applicable service offering. Vendor shall meet all SLA requirements to include but not be limited to the delivery of service offerings, maintaining service offerings, measuring Key Performance Indicators (KPIs), reporting compliance and issuance of credits when performance fails to meet performance objectives. Vendor shall disclose its methodology for measuring each of its SLAs, including but not limited to the formulas for calculating those measurements. Vendor shall disclose how vendor shall address failures to perform to SLA levels and any billing adjustments, credits or other compensation offered. SLA provided shall not be less than what is commercially available.

Section 7: Training

The County requires comprehensive training for its system administrators and users to support the system after its initial implementation and all future configurations. Training must ensure that the users will be capable of continued operation of the system, and that the systems development staff will be capable of maintaining the software and handling the diagnosis of application problems. Appropriate training, knowledge transfer, and system documentation shall be provided to ensure operations, maintenance, and troubleshooting. Vendor training plan shall include associated training materials, i.e. Reference Guides, User Guides and Online Tutorials, etc.

Vendor shall explain their proposed approach to training, including the nature of training, time allocation recommendations, the number of people the training sessions can accommodate, the number and duration of training, the target audience for each proposed training. Knowledge transfer should include walk through of system design access methods, along with verification of transfer of relevant configuration files, source code, and executable code.

Section 8: Project Management Plan

Vendor shall provide a comprehensive Project Management Plan (PMP) for USs review and approval within ten (10) days of contract award.

The PMP shall outline the methodology and strategies to implement and roll out an enterprise identity and access management system including, but not limited to, the following:

8.1. Assignment of a dedicated project manager to oversee execution.

8.2. A detailed organization chart defining the structure and roles of the project personnel.

8.3. Development and maintenance of a milestone schedule as part of the project management plan, detailing all tasks and key events.

8.4. Submission of weekly progress reports to ensure transparency and accountability.

8.5. Development of a testing plan with clearly defined acceptance criteria to validate system functionality

8.6. Project start-up, system integration, service transition to go-live training, go-live activities, operations, and end-of-term transition activities.

8.7. Completion of a go-live checklist to confirm readiness for deployment.

8.8. Describe how it proposes transition to go-live and how it will work in parallel with other providers for a period of time if needed.

8.9. Change order requests not relating to the project schedule or monetary changes (may be submitted for review at any time).

8.10. Communications: Define the procedures for controlling all correspondence, submittals and other communication between vendor and Harris County.

8.11. Problems and Resolutions: Identify methodology for identifying problems and the resolution process.

Section 9: Sample Project Management Plan

9.1. A sample project management plan and template of a past enterprise identity and access management system implementation shall be provided with vendor response to this solicitation.

9.2. Provide a comprehensive overview of a previously executed project, detailing the initial context to set the stage for understanding the project's background and its significance.

9.3. The scope shall be clearly defined, outlining the objectives, deliverables, milestone, and the extent of work covered. It shall list the stakeholders, including clients, team members, and any third -party collaborators, highlighting their roles and contributions.

9.4. The document shall also address any time constraints or unique challenges faced during the project, providing insight into the vendor's problem-solving abilities and adaptability.

9.5. The results or outcomes of the project shall be presented, demonstrating the effectiveness of the strategic plan in achieving its goals and the value it delivered to all parties involved.

Section 10: Capacity and Resources

Vendor shall maintain and assign a sufficient number of competent and qualified professionals to meet Harris County requirements. Vendor shall provide Harris County with a staffing plan that identifies the staffing levels, types, and any applicable certifications necessary to meet the requirements of this RFP. Vendor shall also indicate space, technology and telecommunications infrastructure requirements so that Harris County can allocate workspace for the project team to use during the implementation.

10.1. Project Manager (PM)

10.1.1. Vendor shall dedicate a PM for the length of the project to act as the vendor’s representative for all communication and activities with Harris County. The PM shall be the prime point of contact for Harris County for project matters. The PM shall maintain a detailed and accurate project schedule at all times.

10.1.2. The percentage of the PM’s time dedicated to this project shall be defined. The PM shall have overall responsibility for day-to-day project management. Vendor shall submit a resume for the PM candidate for Harris County to review and approve. At a minimum, the PM candidate shall possess the following qualifications:

10.1.2.1. Five (5) years of project management experience with specific experience related to enterprise identity and access management system implementations.

10.1.2.2. Demonstrated experience creating detailed dependency-driven schedules and tasks required to implement recommended changes.

10.1.2.3. Demonstrated experience facilitating and supporting formal review sessions with executive stakeholders.

10.2. Key Staff

10.2.1. Vendor shall provide resumes for all key staff for Harris County to review and approve. Key staff is defined as all Subject Matter Experts (SMEs) to be utilized during the project. The resumes shall indicate the key staff knowledge and experience specific to implementation of an enterprise identity and access management system , background, years of experience and skill sets to ensure project success. Changes to the key staff, anticipated or unforeseen, shall be immediately relayed to Harris County.

11. Optional/Value-Added Services

Vendor may propose optional or value-added products and/or services related to the scope of goods and/or services described in the specifications and/or listed on the Pricing/Delivery Information sheet(s) of this RFP by identifying other items and/or brands not identified by Harris County in this RFP. At a minimum, discuss product/service capabilities and reasons why it would be valuable for this project.