MFA-RFI_draft_3.docx

1. SUBJECT:

This is a Request for Information (RFI) for USDA to obtain information on the solutions that are available for strong multi-factor identity authentication. The USDA Identity, Credential, & Access Management (ICAM) Program is seeking information on a solution to provide multi-factor authentication that can be integrated with an existing on premise web access management platform. The solution is targeted primarily towards public citizens accessing government services online but also to some federal employees and contractors. USDA is interested in both on premise and cloud-based solutions.

2. DESCRIPTION

The USDA eAuthentication Service serves as a single, centralized credential issuance and authentication service for web-based applications throughout the Department, which relieves applications of the need to build and maintain their own credential issuance, authentication, and to a limited extent, authorization services. eAuthentication provides a unified credential that can be used to provide single sign-on capability, allowing an authenticated user to move seamlessly across all participating web applications. Thus, the eAuthentication service reduces the burden on customers (public citizens) to register for, and maintain, separate online accounts with each of the numerous online systems.

eAuthentication requires customers to self-register online through the eAuthentication application, create a customer account, and then either complete an online identity verification process, or visit a Local Registration Authority in person at a USDA Service Center and present a government issued photo ID. When the identity verification is complete, the user can log in to applications that are integrated with eAuthentication using a User ID and Password.

To improve the security of consumer transactions, and to ensure that sensitive data is shared only with the appropriate person or people, the USDA is looking to add capabilities to the eAuthentication service to support multiple factors of authentication.

3. REQUESTED INFORMATION

USDA OCIO Client Technology Services (CTS) is seeking information on available multi-factor authentication solutions that meet Authenticator Assurance Level 2 (AAL2), in accordance with the National Institute of Standards and Technology (NIST), Special Publication (SP) 800-63, Rev. 3 (https://www.nist.gov/itl/tig/special-publication-800-63-3). The information provided in vendor responses will assist USDA in understanding the solutions and technologies that are available, and how they can be integrated with the USDA eAuthentication Service.

Vendors should respond to the following questions:

1. What types of MFA credentials are offered as part of the solution? Please be sure to include supported devices types and any software/version requirements.

1. Describe the credential issuance process for each credential type, including how authorized users are initially provisioned into the system.

1. Describe the lifecycle management functions for each credential type, including token refresh, revocation, and any other necessary credential management actions.

1. Describe the authentication process for each credential type.

1. Describe how the solution addresses or reduces user friction during the issuance and login processes.

1. Describe how the solution complies with NIST 800-63, Rev. 3 in terms of the authentication process that meets the requirements for Authentication Assurance Level 2.

1. Has the solution been FIDO Certified, and does it follow FIDO UAF and U2F standards?

1. Describe how the solution is compliant with Section 508 of the Rehabilitation Act?

1. When a user has issues obtaining or using a credential, what support options are available to them via the solution?

1. Describe the process in which the solution can issue a token to someone who no longer has access to the previously issued token.

1. Describe the cost model associated with your solution (perpetual vs. subscription, per user, device, token, transaction, etc.) and provide pricing estimates for the following quantities of users.

10. 2,000

10. 5,000

10. 50,000

10. 100,0000

1. Describe how the solution can be integrated with an existing on-premise CA Single Sign-On (formerly CA SiteMinder) environment.

1. Are there options for integrating with Microsoft Active Directory, for Windows desktop and server authentication?

1. What are the supported interfaces into the solution? (Web Services, SAML, Radius, etc.)

1. Is the solution available on-premise, in the cloud, or hybrid/both? If cloud, is the solution Fed Ramp certified?

1. For cloud based solutions, describe the system availability of the production and non-production environments, and how system availability is maintained.

1. For on-premise solutions, describe how high availability can be achieved as an active-active configuration across multiple data centers.

1. What support services options are available to assist with the integration and rollout processes? Include any options for professional services and/or consulting.

1. What reporting and monitoring functions are available?

1. Describe any Risk Based Authentication capabilities that are include with or integrated with the solution.

4. RESPONSES

Vendor responses shall not exceed 15 pages and should be submitted in PDF or Microsoft Word format. The response shall include a cover page (not included in 15-page limit) that contains (1) Company name, (2) Primary Point of Contact, (3) Phone Number and Email Address, (4) Cage Code, (5) NAICS Code, (6) Business Size, and any applicable Federal Supply Schedule (FSS) or Government-Wide Acquisition Contract (GWAC) Contract Number, under which the vendor solution can be purchased.

Responses shall include each of the questions from Section 3 above with the necessary response immediately after each question. In addition to the questions to be addressed, vendor response shall include a brief description of existing capability to provide a solution meeting the USDA multi-factor authentication needs. Vendors shall provide information on their ability to use existing assets or procure, customize/configure, maintain, and/or provide technical support for the resources needed to provide required solution. Vendors shall also describe technical benefits of their proposed solution in terms of existing technologies or resources, improvements/enhancements, cost efficiencies of their specific approach, and any other support capabilities that provide service and/or product excellence or uniqueness.

Questions to this RFI shall be emailed to the contact identified in Section 6 below. Questionas and answers will end on August 11th, 2017 at 5:00 PM MST. Responses to this RFI shall be e-mailed to the contact identified in Section 6 below, and shall be received no later than August 18th, 2017 at 5:00 PM MST.

5. DISCLAIMER

This RFI is issued solely for information and planning purposes. In accordance with FAR 15.201(e), responses to this notice are not offers and cannot be accepted by the Government to form a binding contract. This is not a Request for Proposals. It does not constitute a solicitation and shall not be construed as a commitment by the Government. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received in response to this RFI that is marked Proprietary will be handled accordingly. Please be advised that all submissions become Government property and will not be returned. Vendors are solely responsible for all expenses associated with responding to this RFI. The Government will not reimburse any costs associated with providing information or responding to this RFI.

6. CONTACT INFORMATION

James B. Edington Contracting Officer Email: james.edington@ftc.usda.gov