RFI_31701-03586_CIAM_System_Vendor_Questions.pdf

Question Vendor Questions State Response

Can you provide an overview of your current identity infrastructure (IDP(s), directories, SSO providers, MFA methods, user stores)?

The State of Tennessee operates a hybrid identity environment managed by

STS. Federation, SSO, and

MFA are standard, aligned to Zero Trust and the OneTN vision. The OneTN program aims to rationalize and unify citizen access while maintaining secure federation.

Do you currently use Microsoft Entra ID, Okta, Ping, or another identity provider?

Please reference response to Question 1

What are your key integration points (VPN, VDI, cloud apps, on-prem systems, custom apps)?

Key integrations include custom and third party apps.

How do you currently handle hybrid/on-prem failover or continuity if your IDP is unavailable?

Vendors should describe their SLAs and failover design.

Are you maintaining any legacy authentication methods or hardware tokens we should plan to support?

The intent is to unify through federation, etc.

Some legacy apps may need modifications on the state side.

Does the system need to integrate with linux, unix, Mac OS and

Windows OS, along with other legacy operating systems? No

7 How many users are in scope?

This will ramp up over time from ~100k users to an estimated 4.5m users at full deployment. The CIAM must elastically scale for peak events and future growth.

Please describe the primary user populations requiring

MFA/CIAM (citizens, employees, contractors, partners, customers, privileged admins).

Populations include citizens, businesses/partners/munici palities, and state workforce. Policies and

MFA/consent vary by persona and risk.

Do external users (customers/partners) require a different authentication experience or self-service flow?

Yes—external users are core to OneTN. The CIAM must streamline registration, identity proofing, and SSO while protecting privacy.

What percentage of your user base requires offline or mobile authentication capability?

~50% mobile

Are there requirements for shared workstations, kiosk access, or air-gapped environments?

Please refer to the RFI for the requirements.

Are there specific mandates around on-prem data residency, logging, or audit retention?

We are looking for the best and most secure solution.

We are not setting expectations in the RFI but want to know your certifications and capabilities.

What are your expectations for FedRAMP, CJIS, SOC 2, ISO

27001, or other certifications?

Please reference response to Question 12.

Does the State require compliance with the new CJIS Security

Policy v6.0 mandate to transition from FIPS 140-2 to FIPS 140-3 by deadline September 21, 2026?

Please reference response to Question 12.

Which SSO or federation protocols are required (SAML, OAuth

2.0, OpenID Connect, RADIUS, FIDO2/WebAuthn)? Please refer to the RFI.

Do you need MFA enforcement at the application layer, network access layer, or both? Please refer to the RFI.

Are you seeking password reset protection or phishing-resistant verification methods for help desk self service authentication — similar to the safeguards recommended after the MGM breach?

Yes

What is your expectation for authentication continuity during cloud outages?

Please reference response to Question 4.

19 Are there requirements for on-premise or hybrid failover?

Please reference response to Question 4.

How do you handle authentication during network segmentation or disaster recovery scenarios?

Please reference response to Question 4.

21 What SLAs or response times are expected for support?

Critical identity services are deployed with geographic redundancy and continuous monitoring. Vendors should describe their SLAs and failover design.

Do you require automated onboarding and lifecycle management to integrate with your existing HR platform and Please refer to the RFI.

Identity Provider (IDP) to provision and deprovision users seamlessly?

Do you require provisioning and deprovisioning into any systems, including but not limited to (standard databases, applications, REST APIs, SOAP APIs, flat files, SCIM, or mainframes etc.?)

We are seeking responses through this RFI to identify the requirements for a CIAM system.

Do you require access certification to support compliance or audit requirements?

If you have certifications please state them.

How will success be measured for this RFP (cost, user experience, compliance alignment, integration depth, vendor stability)?

The State will be evaluating vendor responses based on best value for this Request for Information (RFI); not

RFP.

26 Will pilots or proof-of-concepts be included in the evaluation?

We are seeking recommendations through this RFI. If the vendor is willing to provide a POC, please identify this in your response along with any parameters, eg. no-cost

POC.

27 What is your anticipated rollout timeline and scale phase?

We are seeking recommendations through this RFI. Refer to Section 6:

Informational Forms, Question #28.

Are there other identity initiatives (IGA, MFA, PAM, IAM modernization) that should be considered in parallel?

There may be related projects but this should not consider dependency on any other effort.

What is the expected initial contract term (e.g., 1 year, 3 years, or multi-year)?

The State would negotiate contract terms should a future procurement strategy be developed from this RFI.

30 What is the estimated vendor selection date?

The State is seeking information through this RFI and a vendor selection date has not been established.

31 What is the targeted purchasing date?

The State is seeking information through this RFI and a targeted purchasing date has not yet been established.

32 What other companies are submitting questions to the RFI?

Please refer to Section 5.2 of this RFI.

Please provide all questions and answers provided by other companies?

Please refer to Amendment

1, Section 4: Schedule of

Events.

What kind of legacy systems are expected to integrate with

OneTN as part of the “legacy and modern authentication systems” mentioned?

Please reference response to Questions 3 and 5.

What are the minimum fraud prevention capabilities expected

(e.g., liveness detection, deep-fake detection, IP reputation, or risk scoring)?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

What is the estimated total number of citizen identities expected to be managed by OneTN at full rollout?

Please reference response to Question 7.

What is the anticipated number of applications that will consume the OneTN identity proofing and authentication services during the first rollout phase and at full scale?

Not estimated at this time

Will OneTN require periodic or event-based re-verification (e.g., address change, name change, high-risk transaction)?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

Will OneTN be required to support federated login for external

IDPs?

Please reference response to Question 9 and 60.

Are there requirements for archival, retention, or reactivation of inactive or deprovisioned citizen accounts, and how long should archived accounts be retained?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

What would the State define as non-standard IDs — e.g., foreign passports — and what proofing standards should apply to them?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

Are there defined role-based access tiers for Helpdesk and administrative personnel (e.g., Tier 1 resets, Tier 2 overrides, Tier 3 system config)?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

What type of account management workflows are expected — for example:

• Self-registration and verification

• Self-service profile updates

• Account suspension or archival

• Consent management and revocation

• Re-verification and recovery processes

These are good examples.

Also find them in the RFI use cases, items 31-35 in RFI.

We are seeking responses through this RFI to identify the requirements for a CIAM system.

Will the State require that all audit data and identity-proofing evidence (e.g., transaction logs, verification outcomes, document metadata, or captured images) be transmitted from the vendor’s platform to individual State agencies to support fraud, theft, or identity-misuse investigations?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

For progressive user profiling, how does the State define its scope — should OneTN support dynamic enrichment of profiles with optional or inferred attributes over time?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

Are there expected automated workflows for onboarding new agency applications into OneTN—for example, pre-defined templates, APIs, or self-service integration paths that allow agencies to register and federate their applications without manual configuration?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

How often are citizens expected to re-verify their identity (e.g., annually, on major profile change, or per high-risk transaction)?

Please reference response to Question 38.

Will OneTN collect behavioral or contextual data (e.g., preferences, access patterns) as part of progressive profiling, and what privacy constraints will apply?

Please reference response to Question 45.

How should failed or disputed proofing attempts be handled — through automated reattempts, manual review, or escalation to human verification?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

Will each agency have delegated administrative control within

OneTN, or will all user management be centralized?

It is anticipated that there will be delegated user management with limitations that are configurable and a central super admin function.

Are there any mainframe or agency-specific systems currently managing citizen access that OneTN must federate with rather than replace?

Possibly.

Is there an expectation to combine passkey-based authentication (WebAuthn/FIDO2) with identity proofing flows ?

Please reference response to Question 16.

Regarding “non-unique usernames,” what defines uniqueness in the State’s context — is it limited to directory-level (LDAP) uniqueness?

Yes, the new OneTN username will be unique

What level of real-time synchronization is expected between

OneTN and connected agency systems — near real-time event streaming or periodic batch updates?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

Are there requirements for automated deactivation of dormant accounts ?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

Does the State plan to issue or support a digital reusable credential (OneTN Digital ID) that can be presented across agencies or for third-party verification?

This topic is in discussions.

We are seeking responses through this RFI to identify the requirements for a CIAM system.

Does the State have access to existing citizen images (e.g., DMV driver’s license photos or other agency databases) that could be leveraged to support or satisfy IAL2 identity proofing requirements, reducing verification costs and reliance on third-party document capture?

There is a potential to use existing citizen images.

Will legacy user directories (e.g., Active Directory, LDAP) be migrated, synchronized, or left in place with OneTN acting as a federation broker?

Please reference response to Question 123.

Is the State interested in receiving separate pricing scenarios for solutions that integrate with a FedRAMP-authorized environment versus those that operate in non-FedRAMP deployments supported by equivalent security attestations such as SOC 2 Type II, ISO 27001, or State-approved compliance reports?

Please reference response to Question 74

Will OneTN allow users to reuse an existing verified identity

(once proofed) across multiple agency applications without re-proofing, and how will consent be managed between agencies?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

What is the estimated annual volume of identity-proofing transactions expected across all citizen-facing applications under OneTN?

Please reference response to Question 7.

How many active users per month (logins and authentications) does the State anticipate across all applications excluding identity proofing or verification events?

Please reference response to Question 7.

What is the projected peak concurrent login volume or transactions per second during high-traffic events?

Please reference response to Question 7.

What legacy and custom authentication systems must be integrated with the CIAM solution? Are there specific protocols or proprietary systems to consider?

Please reference response to Questions 1 and 5.

What is the expected volume and diversity of citizen identities

(e.g., minors, non-citizens, users without standard IDs)? Are there special populations or edge cases to address.

Please reference response to Question 8.

What are the requirements for multi-factor authentication

(MFA)? Which authenticators (WebAuthn, FIDO2, passkeys) and fallback methods are acceptable?

Please reference response to Question 16.

What standards and protocols must be supported for federation and API security? (OIDC/OAuth 2.0, SCIM 2.0, OpenID FAPI 2.0, JWT, mTLS, DPoP, etc.)

Please reference response to Question 15.

What are the requirements for integrating with on-premises or cloud-based identity stores (e.g., Active Directory)? Is hybrid identity required?

Please reference response to Question 1

What are the expectations for mobile driver’s license (mDL) integration? Which standards (ISO/IEC 18013-5, NFC, QR code, API-based validation) must be supported?

We are seeking responses through this RFI to identify the requirements for a CIAM system. mDL would be based on ISO/IEC 18013-X.

What are the requirements for user store migration? Is phased migration possible, or must all users migrate at once?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

What are the requirements for event-driven notifi cations and change propagation to agency apps? Are webhooks or event grids required?

We have not specifically set requirements. We wish to evaluate your approach.

What data privacy, consent management, and GDPR compliance requirements must be met? Are there specifi c state or federal regulations beyond those listed (NIST, CJIS, HIPAA)?

Please respond with any security and compliance that your system meets.

What are the requirements for data retention, minimization, and custodial/guardian access management? How should dependent relationships and delegated access be handled?

to Questions 12, 40 and 118.

Are there requirements for FedRAMP certifi cation or hosting in specifi c cloud environments (Azure, AWS GovCloud)? What impact level is required?

We have not set the requirement in the RFI. We have asked if your solution is FedRAMP certified and what level.

What are the expectations for incident response, monitoring, and reporting? What SLAs and resilience measures are required?

Please reference response to Questions 4 and 21.

What is the expected timeline for implementation and migration? Are there critical milestones or deadlines to meet?

Please reference response to Question 27.

What skills and resources will be required from the State of

Tennessee to support and grow the solution? Will training or ongoing support be needed?

We have not determined this. We will partner with the winning vendor to establish the roadmap.

What are the boundaries of the project scope regarding integration with third-party products and services? Are there preferred vendors, existing contracts, or out-of-the-box connectors to leverage?

We have set no boundaries so long as products and services meet the requirments for data security and privacy. We are looking for your ideal solution.

Microsoft and Tennessee signed a Master Services Agreement on June 30, 2023. Can this agreement be used for a direct award to Microsoft, or will the State seek RFP responses from vendors under specific Statewide Contracts? Will the RFP process allow for exceptions or clarifications to standard terms and conditions in the final contract? Are there any anticipated requirements for indemnification beyond standard IP defense? Will the State require Microsoft to provide warranties beyond those in our standard agreements?

The State is conducting market research through this RFI and has not determined a procurement strategy. Terms such as contract use, exceptions, indemnification, and warranties will be addressed if a formal solicitation is issued, in accordance with

State policies.

At this stage, are you looking for software solution vendors responses only or are you also open to receiving solution-agnostic responses from implementation partners?

The State is using this RFI to understand vendor capabilities and implementation approaches and welcomes responses from both software solution vendors and implementation partners.

Does the state intend to select a technology as a result of this

RFI? In other words, will future RFPs seek implementation of a selected CIAM system, or will you open another formal RFP to select a CIAM solution?

The State is using this RFI to gather information that may help guide future planning.

As noted in Section 5, this is not a selection process, and participation is not required for any potential future opportunities.

How is the state currently handle Citizens’ identities? Is there any existing CIAM solutions? If there’s an existing CIAM solution, can you please elaborate on the extent of implementation of the current CIAM solution? If there’s an existing CIAM solution, can you please confirm if there any pain points or gaps you may have experienced with the existing solution?

There is not a current CIAM solution that is central and across the organization.

Does the state have a preference for a cloud or on-prem CIAM solution?

We are looking for the best solution which can be hosted in the State's cloud environment or by a SaaS solution.

Has the state assessed any identity proofing solutions

(standalone identity proofing solutions outside of CIAM)? If yes, can you please confirm which solutions have been considered?

Please reference response to Question 57.

Does the State currently maintain preferred identity proofing vendors or authoritative data sources for integration?

Please reference response to Question 57.

Will the CIAM platform serve as the primary citizen-facing interface, or is it expected to integrate with existing portals and engagement layers?

Please reference response to Question 9.

For mobile driver’s license (mDL) integration, is the State aligned with specific standards (e.g.,ISO/IEC 18013-5), or should vendors propose their own approach?

Please reference response to Question 69.

Are there existing legacy SSO configurations or user store architectures that will be shared to guide integration planning?

Please reference response to Questions 1 and 5.

What are the State’s expectations around audit logging for consent, access history, and attribute changes across federated applications?

Please reference response to Question 12.

Is there a recommended budget ceiling or target range the State would like vendors to consider when proposing implementation and support?

No target budget has been established. Please refer to

Section 6, Cost

Informational Form, for guidance on submitting cost-related information.

91 Who do you use for ID Proofing today? If so, how do you use it?

Please reference response to Question 57.

Do you prefer a SaaS or on-premises solution for this requirement?

Please reference response to Question 83.

93 How many internal and external users do you have today?

Please reference response to Question 7.

How many months per year (1 – 12) are your users active?

Please include internal and external usage.

Please reference response to Question 7.

Do you have any current Identity & Access Management in place today for Access Management, Identity Governance, Privileged Access Management and Risk-Based Authentication?

Please reference response to Question 28 and 82.

Can you confirm whether this environment needs to be air-gapped for any reason?

Please reference response to Question 10.

97 Are you requiring adaptive access or risk scoring?

We are looking for your recommended approach.

Do you currently have or plan to implement a customer/citizen data management platform?

Please reference response to Question 28.

Do you have any system-specific compliance needs, such as a

CJIS requirement for law enforcement?

Please reference response to Question 13.

Usage/Volume: How many users are you looking to proof and at what frequency?

Please reference response to Question 7.

101 What are the use cases for ID proofing, etc?

Please reference response to Question 7.

Is there a definition or reference for the “Privacy Impact

Assessment” mentioned in point 7 of the RFI?

A Privacy Impact

Assessment (PIA) systematically evaluates how your Customer Identity and Access Management

(CIAM) capabilities handle personally identifiable information (PII) to ensure compliance with privacy laws and mitigate privacy risks.

How many distinct user login channels (e.g., web portals, mobile apps, specific partner integrations) are being moved and/or consolidated as part of this CIAM implementation?

to Question 37.

What are the key internal and external applications, services, or systems that will need to integrate with CIAM (e.g., existing

CRM, marketing automation platforms, customer data platforms, backend databases, legacy identity stores, third-party applications)?

Please reference response to Question 3.

105 How many user stores are currently in use?

Please reference response to Question 1.

106 What are the user stores in use?

Please reference response to Question 1.

107 How many users are in need for migration?

Once we select a CIAM solution, it will be a phased rollout of all citizen facing applications. We estimate approximately 4.5 million total users at the end of the statewide rollout.

Are there any requirements for user migration, for example password migration?

Please reference response to Question 70.

Is there a requirement for two CIAM systems (legacy and the new one) to co-exist?

Please reference response to Question 58.

What authentication protocols do department applications support?

Please reference response to Question 15.

What is the total current number of active customer users, and what are the projected user counts over the next 1, 3, and 5 years?

Please reference response to Question 7.

What are the anticipated average and peak Transactions Per

Second (TPS) for authentication and authorization requests?

Please reference response to Question 7.

113 What cloud services would be in scope for integration?

Please reference response to Question 3.

Please confirm all key regulatory requirements that apply to this

CIAM implementation (e.g., NIST frameworks, CJIS, HIPAA (if health-related data is handled), FedRAMP, state-specific data privacy laws, PII protection mandates, ADA accessibility guidelines).

Please reference responses to Questions 12 and 13.

Please confirm the current Federated Identity provider that is used by the state to authenticate their internal users, if this process is centralized. If its de-centralized, can you provide a list of identity platforms that are used across all state departments

(question 20 from RFI)?

We currently do not have a centralized federated identity provider, this RFI is the beginning of establishing

it. For federation, the current systems are using standard OATH2/SAML or custom developed authentication.

What kind of custom legacy applications should we expect this

CIAM solution to integrate with?

Please reference response to Questions 3 and 5.

Please provide the major cloud service providers (IaaS, PaaS, SaaS) used in the state of TN that we need to consider for this

CIAM implementation (e.g. Salesforce).

Please reference response to Question 3.

Is there a current implementation of this whole Custodial and

Guardian Access Management in place? Also, is this a requirement for all state agencies or specific agencies like DHS?

There are some indiviual systems that addresses guardian and custodial access, others do not.

To understand more about the Digital Engagement Platform

(DEP), can the state provide the tech stack/high-level architecture for this platform to ensure the CIAM solution is able to integrate?

The Digital Engagement

Platform is a parallel effort we are working on, the tech stack has not been identifired.

Is the Digital Engagement Platform (DEP) is a home grown solution of State of TN?

Please reference response to Question 119.

Does the State have a defined budget range or an upper cost limit for this implementation that vendors should be aware of when proposing solutions?

Please reference response to Question 90.

How many public citizen users does the State anticipating using the solution? How many currently have existing accounts?

Growth over 5 years?

Please reference response to Question 7.

What is the purpose of the integration with internal department identity stores? Will citizen account info be synchronized (not federated) across multiple systems?

The citizen account will be federated across multiple systems.

124 What types of regular audits will this system have to adhere to?

Please reference response to Question 12.

Does the State have a preference between the use of a single product or multiple products to achieve the solution?

Please reference response to Question 78.

Will the State be providing existing citizen data for pre-population?

As per the RFI we are looking for solutions to federate identities.

What skills does the State currently have in CIAM/IAM (question

14 from RFI)?

Please reference response to Question 77.

128 What are your retention requirements for citizen data?

to Questions 12 and 40.

What is the expected timeline or roadmap for OneTN rollout

(MVP vs. full scope)?

This will be a phased rollout over multiple years.

What citizen use cases or high-traffic applications are envisioned for initial onboarding (e.g., DMV, unemployment, benefits, taxes)?

Please reference response to Question 129.

What are the key success metrics or outcomes for the State

(e.g., % of services federated, user adoption rate, satisfaction, cost savings)?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

How will OneTN coexist with existing agency identity systems during transition?

Please reference response to Question 58.

What identity stores, directories, or authentication systems are currently in use across agencies? (Active Directory, ADFS, custom, etc.)

Please reference response to Question 1 and 115

Are there any enterprise SSO or IAM platforms in use today at the state level?

Please reference response to Question 1, 82 and 115.

Is there a central identity broker or API gateway that could serve as an integration point?

No

How many legacy systems are in scope for federation or migration?

Please reference response to Question 3.

Are there known dependencies on existing state cloud environments (e.g., AWS GovCloud, Azure Government)?

Please reference response to Question 3.

Will integration need to include mainframe or on-prem custom applications?

Please reference response to Questions 1, 3 5, and 51.

Is the State already leveraging any identity proofing vendors

(e.g., LexisNexis, ID.me, Experian, Socure)?

Yes

What are the desired assurance levels (IAL/AAL/FAL) for the general citizen population vs. higher-risk services?

Please reference response to Question 57.

How does the State envision equitable identity proofing for residents without standard forms of ID (e.g., underserved or non-citizen populations)?

Please reference response to Questions 8 and 41.

Are there state policies or statutory constraints around data sources or data retention for proofing?

Please reference response to Question 41 and 72.

Does the State prefer to host identity data internally, or is a

SaaS-hosted citizen directory acceptable?

Please reference response to Question 83.

Does the State expect all agencies to use the same IdP, or can agencies bring their own and federate to OneTN?

Please reference response to Question 9 and 60.

What level of MFA adoption is envisioned — will all users be required, or will it be risk/context-driven?

to Question 16.

What are the State’s goals for user experience — minimal friction, or highest assurance?

We are seeking responses through this RFI to identify the requirements for a CIAM system.

Is there an expectation of multi-language or accessibility compliance (WCAG, Section 508)?

Yes for the user experience.

Will OneTN provide a citizen-facing self-service portal for account recovery, consent management, and data review?

Please reference response to Question 9.

Will the CIAM platform need to integrate with state security monitoring or SIEM tools?

Yes

Will the State define standardized data schemas for citizen attributes shared across agencies?

Please reference response to Question 1.

151 Will data residency or storage region requirements apply?

Please reference response to Questions 12 and 40.

Does the State prefer a SaaS, PaaS, or self-hosted solution model?

Please reference response to Question 83.

What are the expected transaction volumes and concurrency requirements (peak citizen logins)?

Please reference response to Question 7.

What operational roles will remain in-house vs. managed by the vendor (admin, support, security monitoring)?

Please reference response to Question 77.

Does the State anticipate a phased rollout (by agency, by use case, or big bang)?

Please reference response to Question 27 and 155.

156 How many citizen accounts are expected to migrate in total?

Please reference response to Question 70 and 123.

Is the State seeking a full user store migration or just real-time federation from existing systems?

Please reference response to Question 58, 70 and 123.

What are known constraints around data synchronization or API access to legacy systems?

This is unknown at this time.

What level of State resources will be available for project management, testing, and training?

Please reference response to Question 77.

160 Is there a desired term length or renewal period?

This is a Request for

Information (RFI). The State has not defined a contract term or renewal period at this stage. Should a formal solicitation be issued, contract terms would be determined as part of that process.

What budget range or funding model has been earmarked for the CIAM initiative?

Please reference response to Question 90.

Does the State expect vendors to include cost models for scalability (per citizen or per transaction)?

Please refer to Section 6:

Cost Informational Form of the RFI for guidance.

Is the State open to multi-phase contracting (e.g., pilot, expand, sustain)?

The State often completes projects in phases or through defined milestones.

While no specific approach has been determined for this initiative, we are open to considering phased methods, including pilot and expansion models, based on the information received through this RFI.

How will success and citizen trust be measured post-deployment?

Please reference response to Question 131.

Are there expectations for continuous improvement or analytics dashboards on user behavior and adoption?

Please reference response to Question 131.

Does the State of TN require or prefer a FedRAMP authorized solution? If so, would the State be willing to consider a solution that inherits its FedRAMP status by being hosted on a

FedRAMP-authorized 3rd party containerized platform?

to Question 13 and 74.