FSA_RFI_for_Level_of_Assurance_(LOA)_3_Solution_Capabilities.pdf

A. INTRODUCTION.

THIS IS A REQUEST FOR INFORMATION (RFI) strictly for market research and acquisition planning purposes. This RFI does not constitute a request for proposal, quote or invitation for bid (IFB) or any other type of formal government procurement action, nor does the issuance of this RFI in any way restrict the Government to an acquisition approach.

The solution provider must be listed under the LOA 3 category shown on the IDManagement.gov website or be actively working towards getting on this listing. Providers meeting these criteria are strongly encouraged to respond to this RFI.

RFI responses will be treated as information only. No government contract will be awarded as a result of responses received to this RFI.

B. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY (NIST) REQUIREMENTS.

Statutorily, FSA is subject to the Federal Information Security Modernization Act (FISMA) of 2014 and implementing NIST standards and guidelines. Currently, technical requirements for implementing digital identity services, inclusive of identity proofing, are addressed in version 2 of NIST SP 800-63. However, draft version 3 or NIST SP 800-63-31 is undergoing review and anticipated to be released.

C. STATEMENT OF NEED

Federal Student Aid (FSA), a component of the Department of Education (DoED), intends to use RFI responses to better understand the existing market place for acquiring an effective Level of Authentication (LOA) 3 digital identity solution to enhance identity proofing of users accessing sensitive PII. There will be approximately 50 million postsecondary students, parents, and borrowers impacted, as the projected overall universe of FSA users. Approximately, 20 to 30 million of which will have a need to be authenticated at level 3.

1 Technical guidelines in NIST SP 800-63-3 will supersede those contained versions 1 and 2. These new guidelines will separate individual elements of identity assurance into discrete component parts, for non-federated systems, use Identity and Authenticator Assurance Levels (IAL and AAL) and for federated systems, include use of a Federation Assurance Level (FAL).

Further, NIST SP 800-63-3 will retire the concept of LOAs, in current use, and replace with IAL, AAL and FAL options that consider business, privacy risk management and mission need factors, which could vary by system. (Reference site:

https://www.idmanagement.gov/manage/.)

https://www.idmanagement.gov/manage/

An effective LOA 3 solution must meet the following program objectives:

• reliable and easy to maintain

• a low percentage of false positives (the right individual failing authentication)

• deployed and operated using a collaborative managerial approach

• readily scalable to responsively (within few seconds) serve a very large number of concurrent users

• both cost efficient and provides total benefits exceeding costs

• can quickly adapt to accommodate security advances and related ongoing innovation by a provider that possesses the financial strength, organization, operational capacity, ongoing expertise and intellectual property structure to successfully perpetuate the solution

FSA intends to use information obtained from responses to this RFI to form an acquisition strategy to support FAFSA and potentially all FSA systems supporting the student aid lifecycle.

C. RFI RESPONSE INSTRUCTIONS

All entities responding to this RFI are requested to respond via email, on or before 2:00 PM (noon) Eastern Standard Time (EST) on 26 May 2017, to Kimberly.Hopkins@ed.gov and include Richard.Segich@ed.gov as a ‘cc’. Responses shall be no more than 15-each 8.5 x 11 inch pages, preferably using Times New Roman 12-pt font for any narrative. Respondents may provide links to supporting information contained on websites. Prior to actual submission, please review to ensure the content is clear, concise, accurate and relevant. To further advance this market research, FSA may subsequently contact individual respondents to better understand the respondents’ RFI submission.

Interested LOA 3 solution providers are requested to provide the following information:

1. State whether your company is on the approved listed of LOA 3 providers shown at the

IDManagement.gov website. If not, state whether your company is in the process of working to get on this list or has not yet taken any action to do so.

2. Discuss past or current implementations of the solution provided to either government or non-government customers, to include:

• a brief description and operational models used mailto:Kimberly.Hopkins@ed.gov mailto:Richard.Segich@ed.gov

• whether the solution involved use of any federation2 and what volume of users were served by the solution

• cost or pricing models employed

• percentages of ID proofing users at LOA 3 level

• contact information for any referenced clients and for government clients stating if the work was formally assessed and entered into PPIRS (federal government contracts only)

• any other information deemed relevant to assist in understanding what was delivered

3. Provide a general description about the approach used to integrate the solution with involved system(s), e.g., if that integration entailed integrating APIs (Application Protocol Interfaces) using common standards, describe that setup and how it generally functioned.

Within this discussion explain how legacy application barriers were overcome, or if no barriers were encountered, how such barriers would be overcome and the advantages of using this approach.

4. Provide input on what experience your company has working with NIST, GSA or other government agencies that have led to responsibilities for implementing government digital identity services. Also, specifically describe any involvement your company has had performing collaborative activities with the NIST ITL or as part of other related NIST initiatives, especially in the area of identity proofing.

5. Discuss your overall level of understanding of NIST 800-series standards and guidance related to digital identity services and state whether this knowledge is based solely on general awareness; actually deploying solution(s) aligned with these criteria; and/or engaging in collaborative activities with NIST in this area.

6. Briefly address the other non-price attributes sited above, including maintainability and managerial approach used in deploying and operating LOA 3 solutions and why that approach was used and how it impacted the business relationship. Also, solution scalability.

7. Provide basic company background information including:

• Point of contact information

• Company DUNS number

• Indicate whether the company is a private or public concern; how long it has been in business; and provide insights into company size; e.g., numbers of employees, annual revenues, client base, etc., and indicate, assuming NAICS code 541519 (Other Computer Related Services), whether the company is a small business (SB) concern and if so, if it

2 (Fundamentally, acceptance of another organization’s work based on inter-organization trust. Reference site:

https://www.idmanagement.gov/manage/.)

https://www.idmanagement.gov/manage/ qualifies for other SB sub-classifications such as being a women owned SB (WOSB), service disabled veteran owned SB (SDVOSB), HUBZONE entity, etc.

• State whether the company is registered in the System for Access Management at www.sam.gov

• Provide any other information deemed relevant to provide a clear and accurate picture about the company profile.

8. Discuss typical model(s) the company uses to price its solution offerings. Identify the key components of this pricing, e.g., software, services, infrastructure, licensing, liability management, etc. Provide insights into why this pricing approach is used and identify key advantages and drawbacks of the approach. If solution deployments included use of federation, discuss how that was priced and how this could help a client lower its overall investment, by using existing federation to reduce costs per user or getting reimbursed for making the client solution available to others via federation. Discuss how user volume impacts pricing. To facilitate FSA understanding, please provide examples of how different scenarios would typically be priced.

9. Identify any government contractual arrangements your company already has in place, e.g., GSA schedule(s), government-wide agency contracts (GWACs), other active direct contracts, or similar arrangements with federal government entities that include LOA 3 solution capabilities as part of the scope. Provide contact information for the federal government client(s) and indicate whether any of those arrangements permit use by other federal government entities.

10. Lastly, drawing on actual experiences; awareness of industry best practices and ongoing patterns of identity proofing innovation provide any other input your company believes would benefit the government in this purpose.

http://www.sam.gov/