RFP #92337.pdf

UMGC RFP #92337 – Page 1 of 21

REQUEST FOR PROPOSAL #92337

Identity Management, Governance, and RBAC Modernization Services

ISSUE DATE: 10/6/2026

SIGNIFICANT MILESTONES DATE AND TIME

Last Day for Questions 10/14/2026 no later than 10:00 a.m. ET Technical Proposals Due 10/28/2026 no later than 10:00 a.m. ET

NOTICE: Prospective Offerors who have received this document from a source other than the Issuing Office should immediately contact the Primary Procurement Officer and provide their name and email address in order to ensure that amendments to the Request for Proposal or other communications can be sent to them. Any Prospective Offeror who fails to provide the Issuing Office with this information assumes complete responsibility in the event that they do not receive communications from the Issuing Office prior to the closing date. It is the responsibility of the Prospective Offeror to monitor eMMA and Bid Locker for updates to advertised Solicitations.

University of Maryland Global Campus 3501 University Boulevard East Adelphi, Maryland 20783 www.umgc.edu eMaryland Marketplace Advantage (eMMA) https://emma.maryland.gov/

Bid Locker https://bidlocker.us/a/umgc/BidLocker http://www.umgc.edu/ https://emma.maryland.gov/ https://bidlocker.us/a/umgc/BidLocker

UMGC RFP #92337 – Page 2 of 21

SOLICITATION SCHEDULE

Milestone Date and Time

Issue Date 10/6/2026

Last Day for Questions 10/14/2026 no later than 10:00 a.m. ET

Technical Proposal Due Date 10/28/2026 no later than 10:00 a.m ET

Oral Presentation/Discussion Session(s)* Week of 11/16/2026 Price Proposal Due Date*: 12/16/2026 no later than 10:00 a.m. ET Contractor Selection Anticipated to be Finalized* 1/15/2027 Agreement Executed by Selected Contractor* 2/1/2027 Contract Commencement* 2/8/2027

*For Shortlisted Offerors only

UMGC RFP #92337 – Page 3 of 21

TABLE OF CONTENTS

SOLICITATION SCHEDULE

TABLE OF CONTENTS

SECTION I. GENERAL INFORMATION

SECTION II. SCOPE OF WORK

SECTION III. PROCUREMENT PHASES AND EVALUATION PROCESS

ARTICLE 1. TECHNICAL PROPOSAL REQUIREMENTS

ARTICLE 2. TECHNICAL EVALUATION PROCESS

ARTICLE 3. PRICE PROPOSALS

ARTICLE 4. FINAL EVALUATION, RANKING AND SELECTION

APPENDICES

UMGC RFP #92337 – Page 4 of 21

SECTION I. GENERAL INFORMATION

1. Summary.

1.1. Solicitation: The intent of this Request for Proposals (“RFP” or “Solicitation”) is to provide Identity Management, Governance, and RBAC Modernization firms an opportunity to present their qualifications, experience, and conceptual approach to providing the scope of services in relation to the needs of UMGC. Proposals that concisely present the information requested in the order and manner requested will be considered more favorably than a Proposal (“Proposal” or “Offer”) from an Offeror of commensurate qualifications that displays a lack of organization, conciseness, or attention to detail.

1.2. Procurement Regulations: This RFP shall be conducted in accordance with USM Procurement Policies and Procedures. The procurement method is Competitive Sealed Proposals. The text of the Policies and Procedures is available at http://www.usmd.edu/regents/bylaws/SectionVIII/VIII300.html.

1.3. Background: Go to http://www.umgc.edu/visitors/about/ for a profile of the University.

2. Issuing Office.

2.1. Issuing Office:

University of Maryland Global Campus Office of Procurement Services 3501 University Blvd. East Adelphi, MD 20783

Primary Procurement Officer:

Lauren Jaber Senior Buyer, IT 301-985-7415 Lauren.jaber@umgc.edu

Secondary Procurement Officer:

Phan Truong Senior Buyer, IT Phan.truong@umgc.edu

2.2. The Procurement Officer(s) shall be the point(s) of contact with the University for purposes of the preparation and submittal of proposals in response to this solicitation.

http://www.usmd.edu/regents/bylaws/SectionVIII/VIII300.html http://www.umgc.edu/visitors/about/ mailto:Lauren.jaber@umgc.edu mailto:Phan.truong@umgc.edu

UMGC RFP #92337 – Page 5 of 21

3. Questions and Inquiries.

All questions and inquiries regarding this procurement must be directed to the individual(s) referenced with the Issuing Office above. Questions must be submitted in writing via email to lauren.jaber@umgc.edu and phan.truong@umgc.edu. Inquiries will receive a written reply. Copies of replies will be sent to all other Offerors, but without identification of the inquirer. All such questions and inquiries must be received by the date and time as listed on the Cover and the Solicitation Schedule of this RFP.

4. Pre-Proposal Meeting. A pre-proposal conference will not be held for this procurement.

5. Proposal Closing Date/Due Date and Time.

5.1. Technical Proposal: Technical Proposals must be uploaded electronically at the UMGC Bid

Locker link provided below no later than the date and time indicated in the Solicitation Schedule.

File names for the Technical Proposal documents are to include the RFP number and the Proposer’s name. NO PRICING INFORMATION is to be provided in the Technical Proposal.

Bid Locker link for Technical Proposal upload:

https://bidlocker.us/details/6550

Proposers must be registered on Bid Locker prior to uploading proposals.

To register* for a Bid Locker account, go to:

https://bidlocker.us/Account/Signup/UMGC.

Should you encounter any issues during account set-up or require additional assistance with Bid Locker, please reach out to Bid Locker directly at help@bidlocker.us or 267-225-1407.

(*DO NOT wait until the due date for Proposals to sign up for an account; sign up as soon as possible.)

The University advises Proposers to allocate an adequate amount of time to create a Bid Locker account prior to any submission due date. It is also advisable to familiarize yourself with the Bid Locker site and the upload features and functionality related to uploading documents.

Proposers shall allow sufficient time in uploading the Technical Proposal to ensure timely receipt by the Issuing Office via the Bid Locker site. Upon successful submission, Proposers may download a submission receipt on Bid Locker. Proposers will also receive an email confirmation within a few minutes from Bid Locker. Proposers that do not receive confirmation should immediately notify the Issuing Office, and contact Bid Locker at help@bidlocker.us or 267-225-1407 to confirm that their Proposal has been received. Proposers will not be able to upload Proposals after the due date and time, and late Proposals will not be considered.

mailto:lauren.jaber@umgc.edu mailto:phan.truong@umgc.edu https://bidlocker.us/details/6550 https://bidlocker.us/Account/Signup/UMGC mailto:help@bidlocker.us mailto:help@bidlocker.us

UMGC RFP #92337 – Page 6 of 21

If any pricing information is included in the Technical Proposal, the Proposal may be deemed non-responsive by the Issuing Office. Hyperlinks to software products that indicate that the Technical Proposal is posted by the Proposer on an electronic site may be rejected or be considered non-responsive if a “Click-Through Agreement” is required to be accepted by UMGC in order to download the Technical Proposal.

By providing the Technical Proposal electronically to UMGC, the Proposer grants UMGC an unlimited right to generate additional electronic and/or paper copies for distribution solely for the purpose of evaluation and review.

5.2. Price Proposal: Refer to the Solicitation Schedule for the anticipated due date and time of Price

Proposals. Price Proposals will be requested at the appropriate time via addendum to all applicable shortlisted firms.

5.3. Proposals should be provided in accordance with the Solicitation Schedule. Late Proposal submissions will not be accepted.

5.4. Neither Technical nor Price Proposals will be opened publicly. The identity of Offerors will not be disclosed prior to the Contract Award.

5.5. The Technical Proposal and/or Price Proposal, either individually or collectively, is considered by UMGC to be an Offer.

6. Acceptance of Terms and Conditions. By submitting a Proposal, an Offeror shall be deemed to have accepted the terms, conditions, and requirements set forth in this RFP. The RFP including all addenda in total shall be incorporated into the Contract by reference.

7. Contractual Agreement and Term.

It is intended that 1 (one) contract will result from this Solicitation.

Any Contract arising from this RFP action shall commence on the date the Contract is executed on behalf of UMGC, or such other date as UMGC and the Contractor shall agree. The Contract shall be in effect for one year, with an anticipated start date on or about February 8, 2027 unless otherwise extended, expired, or terminated pursuant to this Contract.

8. Confidentiality of UMGC’s and Offeror’s Information. Refer to Appendix S for the terms of confidentiality of UMGC’s and Offeror’s information.

9. Post-Award Confidentiality. Refer to Appendix C for the confidentiality obligations of awardees and

UMGC.

(End Section I. General Information)

UMGC RFP #92337 – Page 7 of 21

SECTION II. SCOPE OF WORK

1. Purpose / Description. UMGC lacks a modernized originating identity provider (“OIP”) between Workday and Microsoft Entra. Current identity data is not aligned between the two platforms, creating inconsistencies that require evaluation and remediation. Unused or stale identities remain in the environment, increasing risk around identity hygiene, governance, and access. Foundational Role Based Access Controls (“RBAC”) design has not been established across Workday and Entra, limiting the ability to standardize access management across the enterprise.

A formalized Identity Governance Administration (“IGA”) framework is needed to standardize how access, roles, and identity lifecycle processes are governed across the enterprise. This includes developing an Access Governance and Role Management Framework, establishing an IGA governance and operating model, and maturing Identity Lifecycle Management processes. A key focus area is improving Joiner, Mover, and Leaver (“JML”) lifecycle management to ensure identity changes are handled consistently, securely, and with clear ownership across systems and business units.

Identity provisioning and management remain dependent on PeopleSoft identity flags and persona configurations embedded across business applications, infrastructure, and technical processes. The lack of clearly defined attribute requirements and a formal migration plan limits the ability to transition provisioning to Workday and Microsoft Entra ID. These dependencies must be identified and decoupled to enable a modern, centralized, and scalable identity management model.

The objective of this RFP is to work with a qualified Offeror to develop a strategic and technical approach for adopting RBAC and IGA capabilities across third-party applications and services by aligning them with centralized identity management systems and authoritative identity sources. This effort will enable consistent role governance, standardized access management, and RBAC continuity across the enterprise application landscape.

2. Scope of Services. The following Scope of Services sets forth UMGC’s requirements and expectations for the Services. The requirements noted herein are not intended to be exhaustive, and UMGC reserves the right to modify or supplement these requirements in accordance with the terms of the resulting Contract.

2.1. Identity Foundation and Data Alignment Support

2.1.1. Scope of Activities:

2.1.1.1. Assess the current originating identity provider model across Workday and Microsoft

Entra ID.

2.1.1.2. Analyze identity data, attributes, identifiers, organization codes, and identity relationships between Workday and Entra.

2.1.1.3. Identify identity data inconsistencies, duplication, missing attributes, and synchronization gaps.

2.1.1.4. Identify unused, stale, orphaned, or improperly maintained identities and recommend remediation actions.

2.1.1.5. Evaluate whether current organization codes support identity governance, reporting, provisioning, and RBAC requirements.

UMGC RFP #92337 – Page 8 of 21

2.1.1.6. Define the authoritative source and ownership requirements for identity data and attributes.

2.1.1.7. Produce an identity hygiene and data remediation plan with priorities, ownership, and recommended timelines.

2.1.1.8. Recommend a future-state originating identity provider architecture that supports centralized and scalable identity management.

2.1.1.9. Workday & Entra Mismatch Identification & Gap Remediation.

2.1.1.10. Unused Identity Clean-Up

2.1.1.11.

2.1.2. Expertise Needed. To perform the activities described in this section, assigned personnel must have demonstrated experience and expertise in:

2.1.2.1. Workday identity data, worker records, organization structures, and business processes.

2.1.2.2. Microsoft Entra ID and Active Directory identity architecture.

2.1.2.3. Identity data modeling, attribute mapping, and source-of-truth design.

2.1.2.4. Identity hygiene, reconciliation, and remediation practices.

2.1.2.5. Just-in-time provisioning and enablement within originating identity providers.

2.1.2.6. RBAC architecture and role engineering.

2.1.2.7. Identity integration, synchronization, and provisioning design.

2.2. IGA Governance and Identity Lifecycle Management Support

2.2.1. Scope of Activities:

2.2.1.1. Assess the current state of identity governance, access governance, role management, and identity lifecycle processes.

2.2.1.2. Define an enterprise Access Governance and Role Management Framework.

2.2.1.3. Define an IGA governance and operating model, including roles, responsibilities, decision rights, and escalation paths.

2.2.1.4. Document ownership and accountability for identity data, access approvals, role design, access reviews, and lifecycle events.

2.2.1.5. Define standardized JML requirements, workflows, control points, service expectations, and exception processes.

2.2.1.6. Establish requirements for access requests, approvals, certifications, role assignments, segregation of duties, and access removal.

2.2.1.7. Develop short-term and long-term recommendations for maturing IGA capabilities.

2.2.1.8. Produce an IGA implementation roadmap with prioritized capabilities, dependencies, ownership, and target outcomes.

2.2.2. Expertise Needed: To perform the activities described in this section, assigned personnel must have demonstrated experience and expertise in:

2.2.2.1. Identity Governance and Administration architecture and operating models.

2.2.2.2. Access governance, access certification, and role management.

2.2.2.3. Joiner, Mover, and Leaver lifecycle management.

2.2.2.4. Security governance, risk management, and access control practices.

UMGC RFP #92337 – Page 9 of 21

2.2.2.5. Business process mapping and workflow design.

2.3. Third-Party Application RBAC and IGA Alignment

2.3.1. Scope of Activities:

2.3.1.1. Identify and prioritize third-party applications and services requiring alignment with centralized identity management.

2.3.1.2. Assess each application’s current authentication, provisioning, role, entitlement, and access governance capabilities.

2.3.1.3. Determine whether applications can integrate with Workday, Microsoft Entra ID, or future IGA capabilities.

2.3.1.4. Document application-specific roles, groups, permissions, entitlements, attributes, and access dependencies.

2.3.1.5. Map application access requirements to standardized enterprise roles and authoritative identity attributes.

2.3.1.6. Identify applications that require role rationalization, entitlement cleanup, or access model redesign.

2.3.1.7. Define technical integration patterns for authentication, provisioning, deprovisioning, role assignment, and access reviews.

2.3.1.8. Define short-term approaches for applications that cannot immediately support centralized RBAC or automated provisioning.

2.3.1.9. Establish onboarding criteria and governance requirements for integrating applications into the enterprise IAM and IGA model.

2.3.1.10. Produce a prioritized application alignment roadmap based on risk, criticality, technical readiness, and integration complexity.

2.3.2. Expertise Needed. To perform the activities described in this section, assigned personnel must have demonstrated experience and expertise in:

2.3.2.1. Enterprise IAM, RBAC, and IGA architecture.

2.3.2.2. Third-party application identity integration.

2.3.2.3. Microsoft Entra ID enterprise applications, groups, roles, and provisioning capabilities.

2.3.2.4. Federation, single sign-on, APIs, SCIM, and directory integration.

2.3.2.5. Application role and entitlement analysis.

2.3.2.6. Security governance, application risk assessment, and access control design.

2.4. PeopleSoft Dependency and Provisioning Migration Support

2.4.1. Scope of Activities:

2.4.1.1. Identify PeopleSoft identity flags, persona configurations, attributes, and processes currently used to support identity provisioning and management.

2.4.1.2. Trace PeopleSoft dependencies across business applications, infrastructure platforms, integrations, scripts, and operational processes.

2.4.1.3. Document how PeopleSoft identity flags and personas influence account creation, access assignment, role mapping, and lifecycle events.

UMGC RFP #92337 – Page 10 of 21

2.4.1.4. Identify the identity attributes required to transition provisioning to Workday and Microsoft Entra ID.

2.4.1.5. Determine the authoritative source, business owner, technical owner, format, and validation requirements for each identity attribute.

2.4.1.6. Identify gaps where required identity attributes are unavailable, inconsistent, or not maintained in the intended authoritative source.

2.4.1.7. Define a future-state provisioning architecture using Workday and Entra as centralized identity management components.

2.4.1.8. Develop a migration plan for decoupling applications and technical processes from PeopleSoft identity dependencies.

2.4.1.9. Define transition, testing, validation, rollback, and operational support requirements.

2.4.1.10. Establish migration sequencing based on application criticality, technical dependencies, identity risk, and implementation readiness.

2.4.1.11. Produce a decommissioning plan for obsolete PeopleSoft identity flags, personas, integrations, and related technical processes.

2.4.2. Expertise Needed. To perform the activities described in this section, assigned personnel must have demonstrated experience and expertise in:

2.4.2.1. PeopleSoft identity configurations, personas, integrations, and business processes.

2.4.2.2. Workday-driven identity provisioning.

2.4.2.3. Microsoft Entra ID provisioning and identity lifecycle management.

2.4.2.4. Identity attribute analysis and dependency mapping.

2.4.2.5. Application and infrastructure integration architecture.

2.5. Key Personnel Requirements: The Key Personnel for this project are the Project Manager and the

Technical Lead. The Key Personnel are responsible for providing the following:

2.5.1. Scope of Activities:

2.5.1.1. Produce weekly status documentation covering progress across project deliverables.

2.5.1.2. Maintain and present project RAID items, including risks, actions, issues, decisions, assumptions, and technical dependencies.

2.5.1.3. Track identity data alignment, identity hygiene, organization code assessment, RBAC design, IGA framework development, and provisioning migration activities.

2.5.1.4. Provide visibility into progress, blockers, decisions, and dependencies across identity platforms, business applications, infrastructure, and business units.

2.5.1.5. Coordinate escalation of unresolved identity data, governance, provisioning, integration, and stakeholder issues.

2.5.1.6. Coordinate escalation of unresolved identity data, governance, provisioning, integration, and stakeholder issues.

2.5.2. Key Personnel Expertise Needed. To perform the activities described in this section, the assigned Key Personnel must have demonstrated experience and expertise in:

2.5.2.1. Project management reporting and PMO practices.

2.5.2.2. IAM program and workstream coordination.

UMGC RFP #92337 – Page 11 of 21

2.5.2.3. Technical documentation and executive communication.

2.5.2.4. Risk, issue, dependency, and escalation management.

2.5.2.5. Coordination of cross-functional technical and business stakeholders.

2.6. Performance Criteria:

2.6.1. Quality Standards:

2.6.1.1. All RBAC documentation, IAM maturity assessments, and IGA roadmap materials must achieve confirmed accuracy against stakeholder requirements and technical findings.

2.6.1.2. Guidance must be assessed in and in alignment with NIST CSF IAM Governance controls.

2.6.1.3. Documentation (RBAC plans, roadmaps, RAID logs) must be clear, actionable, and consumable by both business and technical stakeholders.

2.6.1.4. All participating business units must confirm deliverables reflect their input (validated via sign-off or feedback sessions).

2.6.1.5. 100% of role-based requirements captured, documented, and categorized (critical, high, medium, low).

2.6.1.6. Strategic IAM/IGA roadmap delivered on time with 100% coverage of identified short-term and long-term initiatives.

2.6.1.7. 90% or higher of workshop action items tracked and completed within agreed timelines.

2.6.2. Service Levels:

2.6.2.1. Weekly Reporting: Status report including RAID log delivered every Thursday by 5

PM ET.

2.6.2.2. Workshops: Workshop materials distributed to stakeholders 5 business days before sessions; notes and follow-up actions shared within 2 business days after.

2.7. Project Deliverables. The awarded Contractor will provide the following Deliverables:

2.7.1. Originating Identity Provider (OIP) Modernization including:

2.7.1.1. Organization Code Modernization Plan

2.7.1.2. Foundational Design Build Framework/Plan of RBAC within Workday & Entra

2.7.2. Identity Governance Administration (IGA) Framework including:

2.7.2.1. Production of Access Governance and Role Management Framework

2.7.2.2. Production of IGA Governance and Operating Model

2.7.2.3. Development of implementation processes for Business Unit and Technical team alignment.

2.7.2.4. Production of Identity Lifecycle Management Framework including: Joiner, Mover, Leaver (JML) Lifecycle Maturation

2.7.3. Third Party & Critical Application RBAC Alignment including:

2.7.3.1. Assessment of the current-state readiness of Microsoft Entra ID to support RBAC adoption and alignment across third-party and critical applications.

2.7.4. Inbound Provisioning Plan of Action including:

UMGC RFP #92337 – Page 12 of 21

2.7.4.1. Migration plan to utilize Workday + Entra for Identity Provisioning and Identity Management

2.7.4.2. Analysis of PeopleSoft Identity Flags & Persona utilization across infrastructure to gather and define attribute requirements within core business and technical processes.

2.7.4.3. Development of a technical plan to decouple PeopleSoft identity flag requirements from business and technical processes, enabling the removal of PeopleSoft dependencies from provisioning and identity management.

3. Data and Security Requirements. The Contractor shall adhere to UMGC’s Information Governance, Security, and Technology policies outlined in this link: https://www.umgc.edu/administration/policies-and-reporting/policies/info-governance-security-technology/information-security.

4. Resulting Contract. All documents, diagrams, materials provided in connection with this engagement are the sole and exclusive property of University of Maryland, Global Campus and are proprietary and confidential. All documents, diagrams, and other materials provided by University of Maryland, Global Campus must be returned to the institution at the conclusion of this agreement. All Deliverables are considered to be “Works for Hire” and will be the sole and exclusive property of the University of Maryland Global Campus and will be proprietary and confidential to University of Maryland Global Campus.

5. UMGC Responsibilities.

5.1. UMGC is responsible for procuring all required software products and licenses needed to deliver the functionality contained herein.

5.2. UMGC will provide the proper credentials to the awarded vendor for the originating identity providers (Workday, Microsoft Azure) and other critical platforms.

6. Service Hours.

6.1. The Contractor will provide services for this project during UMGC’s standard business hours (Monday – Friday, 8am – 5pm EST). All project activities will be conducted remotely using virtual meeting platforms. Onsite presence at UMGC's offices is not required for this engagement.

(End Section II. Scope of Work) https://www.umgc.edu/administration/policies-and-reporting/policies/info-governance-security-technology/information-security https://www.umgc.edu/administration/policies-and-reporting/policies/info-governance-security-technology/information-security

UMGC RFP #92337 – Page 13 of 21

SECTION III. PROCUREMENT PHASES AND EVALUATION PROCESS

ARTICLE 1. TECHNICAL PROPOSAL REQUIREMENTS

1. General Requirements.

1.1. Transmittal Letter: A transmittal letter from the Offeror must accompany the Technical Proposal.

The letter should be an executive summary that clearly and concisely summarizes the content of the Technical Proposal. The letter must be signed by an individual who is authorized to bind the firm to all statements, including services and financial statements, contained in the Proposal. (See 1.2 below.) Include the Offeror’s official business address and state in which it is incorporated or organized (if Offeror is not an individual). An appropriate contact name, title, phone number, and email address should also be provided for UMGC’s use during the procurement process. Do not include price information in the transmittal letter.

1.2. Signing of Forms: A Proposal, if submitted by an individual, shall be signed by the individual. If submitted by a partnership, a Proposal shall be signed by such member(s) of the partnership with authority to bind the partnership. If submitted by a corporation, a Proposal shall be signed by an officer, and attested by the corporate secretary or an assistant corporate secretary; if not signed by an officer, there must be attached a copy of a board resolution or that portion of the by-laws, duly certified by the corporate secretary, showing the authority of the person so signing on behalf of the corporation.

2. Initial Technical Criteria. Clear, concise, yet detailed responses to the technical criteria below are to be provided in the Technical Proposal. In addition, the Bid/Proposal Affidavit and Acknowledgement of Receipt of Addenda (if applicable) must be included. Standard sales material may be provided but must be attached as an appendix rather than included within the body of the Proposal. Offerors must paginate the Technical Proposal and are requested to separate their responses to each of the technical criteria. The following information must be furnished in the Technical Proposal per this solicitation, as more fully described below in items 2.1 through 2.9. Failure to include any of the items listed below may disqualify your firm’s response. The Technical Criteria, items 2.1 through 2.9 are listed below in order of importance. Offerors are requested to compile their Proposals in the same order. It is the Offeror’s responsibility to tailor its response to demonstrate its qualifications to perform the scope of work specifically for UMGC.

2.1. Methodologies/Approach: Provide a narrative of how your firm will provide the requested services in the Scope of Work. Include in this narrative:

2.1.1. Methodology - Describe the proposed methodology for preparing the deliverables outlined in the Scope of Work.

2.1.2. Timeline - Project breakdown and anticipated timeline for the activities required to accomplish the scope of work and deliverables by the project completion date.

Provide a schedule for the project. Include any assumptions for achieving this timeline.

UMGC RFP #92337 – Page 14 of 21

2.1.3. UMGC Staff Resources - Include UMGC staff resource needs and responsibilities. All tasks are to be provided with appropriate resources designated by title and estimated level of effort.

2.1.4. Assumptions - List any assumptions. The assumptions may not modify the terms and conditions of the Master Contract.

2.1.5. Subcontractors- Include subcontractors, if any, that will be used to complete the Scope of Work.

2.2. Staffing Organization, Proposed Key Personnel and Required Project Roles.

2.2.1. Organization Chart of the Project Team. Provide an organization chart of the project team including (i) role title, (ii) summary of responsibilities, and (iii) minimum qualifications, including relevant education, certifications, years of experience, and experience performing similar work. At a minimum, UMGC expects the project team to include the following roles, or equivalent roles, with expertise to perform the Services outlined in the Scope of Work:

2.2.1.1. Solution Architect

2.2.1.2. Identity and Access Management Technical Subject Matter Expert (“SME”)

2.2.1.3. Azure/Entra SME

2.2.1.4. PeopleSoft SME

2.2.1.5. Workday SME

2.2.2. Key Personnel. Provide the names and qualifications (i.e. resumes) of the mandatory

Key Personnel to be assigned to UMGC for the duration of the project. All proposed Key Personnel must attend the Vendor Discussions. The proposed Key Personnel should possess the knowledge, skills, and experience necessary to successfully deliver Identity Management, Governance and RBAC Modernization services. See the definition of Key Personnel in the Contract in Appendix C. The Key Personnel for this project are:

2.2.2.1. Project Manager

2.2.2.2. Technical Architect

2.3. Firm Profile: Offerors must demonstrate that they possess a minimum of five (5) years of experience providing IAM, IGA, and RBAC modernization consulting and implementation services for large enterprise environments similar to UMGC in technical architecture, complexity, and scale.

Experience supporting institutions of higher education is preferred. At a minimum, Offeror shall provide:

2.3.1. A brief history of the firm’s experience providing Identity Management, IGA, and RBAC modernization services;

2.3.2. The number of years the firm has provided Identity Management, IGA, and RBAC modernization services;

2.3.3. The address of the branch office that will serve on the resulting project.

2.3.4. Third Party Reports. Offerors shall disclose whether they possess a current SOC 2 Type II report and identify the audit period covered. Offerors that do not maintain a SOC 2 Type II report shall describe alternative security certifications, attestations, or independent assessments used to demonstrate the effectiveness of their information security controls.

UMGC RFP #92337 – Page 15 of 21

2.3.5. HECVAT. If available, the Offeror shall provide a current Higher Education Community Vendor Assessment Toolkit (“HECVAT”).

2.4. Firm Experience/References: The Offeror shall provide three (3) project examples that demonstrate the firm’s experience performing consulting services similar in scope, complexity, and objectives to those requested under this RFP. Experience supporting institutions of higher education is preferred. These examples will also serve as client references where the firm has provided consulting services of a similar nature to what UMGC is seeking. The examples must be in the following format:

Project Name:

Name of Client:

Name of Client Contact:

Client Address:

Client Contact Phone Number:

Client Contact Email Address:

Dollar Value of Contract:

Start Date:

Completion Date:

Project scope and objectives of the consulting services (include any quantifiable outcomes and metrics):

Firm’s Account Representative for the Client:

NOTE: At its sole discretion, UMGC may, but is not required to, contact any references provided by the Offeror. UMGC also reserves the right to consider information obtained from any available reference source, including the Offeror’s past performance with UMGC, other University System of Maryland (USM) institutions, the State of Maryland, or other relevant sources, regardless of whether such sources were identified by the Offeror as references. Offerors should ensure that all reference contact information is current and accurate, and that designated contacts are knowledgeable and able to speak to the Offeror’s qualifications, capabilities, and performance. The Proposers are to provide this information as part of the Technical Proposal.

2.5. Special/Unique Qualifications: Provide a narrative to elaborate on special/unique qualifications and/or experiences of the Offeror and/or any member of its team, which make it uniquely capable of providing the services to UMGC. Special firm and/or individual expertise is to be included. If applicable, please provide higher education experience.

2.6. Proposal Affidavit: Complete and sign the Proposal Affidavit enclosed in Appendix A and include it with the Technical Proposal.

UMGC RFP #92337 – Page 16 of 21

2.7. Insurance Documentation: The Offeror shall provide a current Certificate of Insurance evidencing coverage for Commercial General Liability, Workmen's Compensation, Automobile Liability Insurance, and Professional Liability.

2.8. Acknowledgement of Receipt of Addenda Form: If any addenda to the RFP documents are issued prior to the due date and time for Proposals, this form (found in Appendix A) must be completed, signed, and included in the Offeror's Technical Proposal.

2.9. Acknowledgement of Review of Contract: See Appendix C for UMGC’s Professional Services

Contract and Contract Affidavit. UMGC contracts are subject to the requirements of the University System of Maryland (“USM”) Procurement Policies and Procedures (“PP&P”) and UMGC policy, including the incorporation of specific contractual provisions and clauses. Offerors shall review Appendix C and identify any requested exceptions, deviations, or concerns as part of their Technical Proposal. Failure to identify an exception in the Technical Proposal may be deemed a waiver of that exception during subsequent negotiations. UMGC strongly prefers that Offerors accept the terms and conditions set forth in Appendix C without modification. However, UMGC reserves the right to negotiate contract terms where permissible and consistent with applicable law, USM policy, and the best interests of the University. The University does not have the authority to accept terms and conditions that are inconsistent with Maryland law. Depending on the nature of the proposed solution and associated services, UMGC may require additional contractual provisions prior to contract execution. By submitting a Technical Proposal, the Offeror acknowledges that it has reviewed Appendix C and is willing to enter into contract negotiations based substantially on the terms and conditions contained therein.

3. Modifications of Technical Proposal. Offerors may modify their Technical Proposals and upload them electronically at the UMGC Bid Locker link provided in the solicitation at any time prior to the due date and time indicated in the Solicitation Schedule. Offerors must email written confirmation of the modification, including the signature of the Offeror, to the Procurement Officer prior to the Proposal due date and time. Technical Proposals may not be modified, supplemented, cured, or changed in any way after the due date and time, unless specifically requested by the University.

UMGC RFP #92337 – Page 17 of 21

ARTICLE 2. TECHNICAL EVALUATION PROCESS

1. Qualifying Proposals.

1.1. Procurement Officer Review: he Procurement Officer shall first review each Technical Proposal for compliance with the mandatory requirements of this RFP (i.e., susceptibility of award).

Failure to comply with any mandatory requirement will normally disqualify a Proposal. The University reserves the right to waive a mandatory requirement when it is in its best interest to do so and when permitted by law.

1.2. Evaluation and Selection Committee: All Qualifying Proposals will be reviewed by a UMGC Evaluation and Selection Committee (the “Committee”) established by the Procurement Officer.

As the procurement progresses, the Committee may seek input from other appropriate UMGC staff or request additional technical assistance from any other source.

2. Technical Evaluation of Qualifying Proposals.

2.1. Initial Technical Evaluation: Following the Procurement Officer’s qualifying review, the

Committee shall conduct its evaluation of the technical merit of the Proposals in accordance with the Evaluation Criteria listed in Article 1, § 2, above. Minor irregularities contained in Proposals, which are immaterial or inconsequential in nature, may be waived wherever it is determined to be in the University’s best interest and when permitted by law. The decision for progressing in the procurement process will be made based on the strengths, weaknesses, advantages, and deficiencies that the Technical Proposals represent.

2.2. Shortlisting: In accordance with the Evaluation Criteria set forth in Article 1, § 2, a shortlist may be developed based on the Initial Technical Evaluation results. All Offerors will be notified of the results as they pertain to their respective Technical Proposal.

3. Oral Presentations/Discussion Sessions.

3.1. Purpose: Based on the Evaluation Committee’s Initial Technical Evaluation, the University may invite, without cost to itself, the shortlisted Offerors to an oral presentation/discussion session (“Discussion Session”). The purposes of the Discussion Session are as follows:

3.1.1. To discuss/clarify any and all aspects of the Technical Proposal, in particular the approach/methodologies, staffing of the contract, schedule, and other applicable services;

3.1.2. To allow the University to meet the Offeror's key personnel and for these personnel to directly convey their experience and expertise in the proposed product and its implementation; and

3.1.3. To provide an opportunity to clarify the scope of services for the intended contract and discuss any items addressed in the Technical Proposal that may require additional clarification.

3.1.4. Format: The Discussion Session will be informal, as the University is not interested in a sales presentation by executives and business development staff; rather, the University is requesting an interactive discussion with each of the shortlisted Offerors. It is important that

UMGC RFP #92337 – Page 18 of 21 those personnel who are proposed to be Key Personnel and/or otherwise assigned to the University’s project fully participate in the discussion. Ample time will be available for the University and the Offeror to ask questions and discuss issues and concerns related to the scope of the services, and the Offeror’s capabilities and qualifications. We anticipate that the Discussion Session will be conducted virtually and approximately seventy-five (75) minutes in length. Key Personnel for the contract must attend the Discussion Session. Following the Discussion Session, additional follow-up, clarification documentation may be requested of the Offeror.

3.1.5. Date: The times and dates for the Discussion Session(s) will be set upon completion of the Initial Technical Evaluation; however, it is anticipated that the Discussion Session(s) will be conducted on the times and dates listed per the Solicitation Schedule, as well as on the cover of this RFP. Offerors are therefore advised to set these dates aside in their entirety on the calendars of the appropriate personnel.

4. Second Phase Technical Evaluation.

4.1. Criteria: Following the Discussion Session, a second phase technical evaluation will be conducted. The Committee will re-evaluate all criteria, incorporating assessment of the Discussion Session and, at its sole discretion, outcome of reference checks. The University reserves the right to decide that an Offeror is not shortlisted prior to completing reference checks.

The order of Technical Evaluation Criteria remains the same.

4.2. Process: Further shortlists may result as the procurement progresses. At each phase of the process, those Offerors that do not remain shortlisted will not progress in the procurement. All Offerors will be notified of the results of the Technical Evaluation as they pertain to their respective Technical Proposals. It is UMGC’s intent to incorporate references prior to establishing the final shortlist of proposals. Once a final shortlist of proposals is established, the Committee will rank the remaining Technical Proposals from highest to lowest.

UMGC RFP #92337 – Page 19 of 21

ARTICLE 3. PRICE PROPOSALS

1. Submission. Price Proposals will be requested, via addendum, after the completion of technical evaluation. Price Proposals will only be requested from Offerors who remain shortlisted following the Technical Evaluation. Detailed instructions will be provided in the addendum specifying the Price Proposal requirements, where Price Proposals must be sent, and the date and time when Price Proposals must be received. No pricing is to be provided in the Technical Proposal submittal.

2. Evaluation. Price Proposals will be evaluated based on the Offeror’s total cost to provide the services requested under this RFP. Following the initial evaluation, the University may elect to request Best and Final Price Proposals (“BAFO”). The Committee will establish a financial ranking of the final Price Proposals from lowest to highest total offers.

UMGC RFP #92337 – Page 20 of 21

ARTICLE 4. FINAL EVALUATION, RANKING AND SELECTION

1. Recommendation of Award or Further Discussions. The Committee may recommend an Offeror for contract award(s) based upon the Offeror’s Technical Proposal and Price Proposal without further discussion. However, should the Committee find that further discussion would benefit the University and the State of Maryland, the Committee may recommend such discussions to the Procurement Officer.

Should the Procurement Officer determine that further discussion would be in the best interest of the University and the State, the Procurement Officer shall establish procedures and schedules for conducting discussions and will notify responsible Offerors.

2. Final Ranking and Selection.

2.1. Process: Following evaluation of the Technical Proposals and the Price Proposals (and Best and Final Offers, if applicable), the Evaluation and Selection Committee will make an initial overall ranking of the Proposals and recommend to the Procurement Officer the award of the contract(s) to the Offeror whose Proposal(s) is (are) determined to be the most advantageous to the University and the State of Maryland. The decision of the award(s) of the Contract will be made at the discretion of the Procurement Officer and will depend on the facts and circumstances of the procurement. All Offerors will be notified of the award(s) selection.

2.2. Basis for Award: Technical merit will have a greater weight than cost in the final ranking.

Award may be made to the Offeror with a higher technical ranking even if its Price Proposal is not the lowest. The Procurement Officer retains the discretion to examine all factors to determine the award of the contract. The goal is to contract with the Offeror that would best meet the needs of the University as set forth in the RFP.

2.3. Negotiations: The University may select for award one or more Offeror(s) to negotiate the terms and conditions of the Contract. The University reserves the right to make an award with or without negotiation.

3. Debriefing.

3.1. Request: Unsuccessful Offerors may request a debriefing. A request must be submitted in writing to the Procurement Officer within ten (10) days after the date on which Offeror knows, or should have known, that its Proposal was unsuccessful. Debriefings shall be conducted at the earliest feasible time.

3.2. Discussion: Debriefings shall be limited to discussion of the Offeror’s Proposal only and shall not include a discussion of a competing Offeror’s Proposal. The debriefing may include information on areas in which the unsuccessful Offeror’s Proposal was deemed weak or insufficient. The debriefing may not include discussion or dissemination of the thoughts, notes, or ranking from an individual Evaluation Committee Member. A summary of the Procurement Officer’s rationale for the selection may be given.

(End of Section III. Procurement Phases and Evaluation Process)

UMGC RFP #92337 – Page 21 of 21

APPENDICES

Appendix A – Technical Proposal Forms

A-1. Acknowledgement of Receipt of Addenda Form

A-2. Bid/Proposal Affidavit

Appendix C – Contract

C-1. Professional Services Contract

C-2. Contract Affidavit

Appendix D – Electronic Funds Transfer Schedule

Appendix E – Living Wage Requirements

Appendix S – Solicitation Terms and Conditions

APPENDICES