Attachment L8 - Revised Service Category 8 Response.docx

Digital Security Solutions RFP No. 24-43230000-RFP Revised Attachment L8 – Service Category 8: Identity and Access Management (IAM)

Respondent Name: Respondent Name Goes Here Solution Name: Solution Name Goes Here

Respondent Instructions:

· Respondents shall use this Attachment as provided to respond. Altering character count limits or any other restriction or control may result in a Respondent being found non-responsive.

· Names. Respondents must provide their name and the proposed Solution name in the spaces above.

· Section 1 Prompts. Section 1 of this attachment provides prompts. The Respondent shall provide a response to prompt 1 and should provide responses to prompts 2 through 8. Prompts are indicated by red text followed by a response block.

Prompt 1 has a maximum of 3000 characters. Prompts 2 through 8 have a maximum character limit of 500. Respondents who submit responses outside of the maximum character limit may be deemed non-responsive. Any additional files, links, or other information provided outside the response block will not be considered for evaluation.

Scores will be assigned by each individual evaluator in accordance with Attachment C, Evaluation Criteria. Prompt 1 is worth a total of 5 points. Prompts 2 through 8 are worth a maximum of 4 points total. An individual Evaluator’s score of the technical response for a proposed Solution will be calculated by the following:

Evaluator’s Prompt 1 score + (Sum of the Evaluator’s Score for Prompts 2-8 / 7) = Evaluator’s Technical Response Score

· Section 2 Terms and Conditions. Section 2 of this attachment provides a space for the Respondent to include any Service Level Agreements (SLA) or additional terms and conditions that apply to the proposed Solution. Neither the SLAs nor the additional terms and conditions will be considered for evaluation.

· Definitions. Definitions contained in Attachment A, Statement of Work, are incorporated by reference.

Section 1. Prompts.

Prompt 1: IAM Solutions must provide centralized management for digital identities and control access to systems and data based on organizational policies. The Solution should manage the full lifecycle of user identities, from onboarding to de-provisioning, and enforce access control through role-based (RBAC) and attribute-based (ABAC) mechanisms.

Please describe how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 1 Response Goes Here

For the prompts below (indicated by red text followed by a response block), the Respondent should provide details on if and how the Solution meets the identified technical capabilities and features.

Prompt 2: Single Sign-On (SSO) – Solution should be compatible across on-premise and cloud based applications, reducing password fatigue and ensuring a seamless login experience for users.

Please describe if and how Respondent’s proposed Solution meets this above prompt in the field below.

Prompt 2 Response Goes Here

Prompt 3: Multi-Factor Authentication (MFA) – Solution should provide enforcement, supporting various authentication methods (e.g., Time-based one-time Password (TOTP), Short Message Service (SMS), biometrics) to add an extra layer of security.

Please describe if and how Respondent’s proposed Solution meets this above prompt in the field below.

Prompt 3 Response Goes Here

Prompt 4: Role-Based Access Control (RBAC) and Attribute-Based Control (ABAC) – Solution should include mechanisms, enabling fine-grained access permissions based on user roles or attributes such as location, department, or security clearance.

Please describe if and how Respondent’s proposed Solution meets this above prompt in the field below.

Prompt 4 Response Goes Here

Prompt 5: Federated Identity Management – Solution should allow cross-domain authentication using standard protocols like SAML, OAuth, and OpenID Connect.

Please describe if and how Respondent’s proposed Solution meets this above prompt in the field below.

Prompt 5 Response Goes Here

Prompt 6: Privileged Access Management (PAM) – Solution should provide capabilities to control and monitor the use of administrative or high-privilege accounts, ensuring that elevated access is limited and auditable.

Please describe if and how Respondent’s proposed Solution meets this above prompt in the field below.

Prompt 6 Response Goes Here

Prompt 7: Self-Service Functionality – Solution should allow users to manage their own passwords, request access to systems, and track the status of access requests through an approval workflow.

Please describe if and how Respondent’s proposed Solution meets this above prompt in the field below.

Prompt 7 Response Goes Here

Prompt 8: Integration of CTI Data Feeds – Solution should allow the IAM system to detect compromised credentials, suspicious login attempts, or help identify identity-related threat actor activities in real-time.

Please describe if and how Respondent’s proposed Solution meets this above prompt in the field below.

Prompt 8 Response Goes Here

Section 2. Service Level Agreement or Additional Terms and Conditions.

Respondent shall include any Service Level Agreements (SLAs) or additional terms and conditions that apply to the proposed Solution in the following text boxes. The text boxes below have a maximum character limit of 32,672 characters each. The information provided in the text boxes below will not be scored but will be incorporated into the final Term Contract documents as an exhibit.

Any Applicable SLA Goes Here Any applicable Addtional Terms and Conditons Goes Here