SaaS IAM RFI -FINAL.docx

REQUEST FOR INFORMATION

DEPARTMENT OF VETERANS AFFAIRS (VA) SOFTWARE AS A SERVICE (SaaS) IDENTITY ACCESS MANAGEMENT PRODUCT

Introduction:

This is a Request for Information (RFI) only issued for conducting market research. Accordingly, this RFI constitutes neither a Request for Quote (RFQ), Request for Proposal (RFP), nor a guarantee that one will be issued by the Government in the future; furthermore, it does not commit the Government to contract for any services described herein. The Department of Veterans Affairs (VA) is not, at this time, seeking proposals or quotes, and therefore, will not accept, review, or evaluate unsolicited proposals or quotes received in response hereto. This notice is not to be construed as a commitment on the part of the Government to award a contract, nor does the Government intend to pay for any information submitted because of this request. The Government does not reimburse respondents for any costs associated with submission of the information being requested or reimburse expenses incurred for responses to this RFI. The information provided may be used by VA in developing its acquisition strategy and Product Description (PD). Any information submitted by respondents to this RFI is strictly voluntary; however, any information received shall become the property of the Government and will not be returned to the respondent. Interested parties are responsible for adequately marking proprietary, restricted, or competition sensitive information contained in their response. This is a request for information and does not obligate the Government in any way, nor does it commit the Government to any specific course of action. Product information, brochures, part numbers, and/or other description information may be included with the submission.

Requirement:

The Department of Veterans Affairs (VA), Office of Information and Technology (OIT) requires a Software-as-a-Service (SaaS) Identity and Access Management (IAM) product for both internal (workforce) and external users (Veterans, caregivers, etc.) that provides the required capabilities as part of a single product. The solution will provide a single cloud-native, Federal Risk and Authorization Management Program (FedRAMP) High authorized, SaaS IAM product that will meet current and future requirements for a department-wide enterprise Identity Provider (IdP), including authentication, access management, automated administration, and reporting. The product must adhere to federal cybersecurity standards and guidance, ensuring robust authentication protocols, encryption mechanisms, and adherence to security frameworks such as National Institute of Standards and Technology (NIST) Special Publication (SP) 800-63 and Federal Information Processing Standards (FIPS) 140-2. A single integrated SaaS IAM product is required to maximize interoperability across capabilities and features, such as custom workflows and the access management features, and provide a more consistent user experience. VA requires the ability to automate complex workforce and customer identity workflows using a no-code/low-code GUI-based automation platform to streamline administration of the identity solution, eliminate time-consuming tasks and reducing errors due to manual entry. VA also maintains a complex suite of modern and legacy digital products and services, some of which require the capability to support legacy authentication protocols and technologies.

The solution shall include:

· Workforce IAM capabilities to support identity management, authentication, and access management for employees and other internal users accessing internal VA applications and services, including VA-managed computers. These capabilities include provisioning and managing workforce identities in a central user directory, Single Sign-On (SSO) capabilities supporting adaptive Multi-Factor Authentication (MFA), including PIV/CAC cards and other alternative methods, Application Programming Interface (API) access management, and adaptive “real-time” cybersecurity threat monitoring and reporting.

· Customer IAM capabilities to support identity management, authentication, and access management for Veterans, their delegates, and other external users accessing public-facing VA applications and services. These capabilities include inbound federation with third-party Credential Service Providers, API Access management, Adaptive MFA, self-service account management, integration with VA identity data repositories, support for patient access to healthcare-related data following the Fast Healthcare Interoperability Resources (FHIR) standard, and adaptive “real-time” cybersecurity threat monitoring and reporting.

· Custom automation capabilities to automate recurring administrative tasks and workflows as well as customize workforce and external user authentication flows using a no-code/low-code GUI-based automation platform, allowing workflows to be created and managed by authorized users across the VA.

· Legacy application support to allow the SaaS IAM product to integrate with the numerous legacy systems that the VA uses to support its critical operations, including healthcare services, benefits administration, burial, and veteran support programs. While many VA systems support direct integration with a cloud IAM solution over standard protocols, some critical systems are deployed in “on-premises” environments and/or don’t support modern authentication protocols. Until such systems are modernized or replaced, the SaaS IAM product will need to provide a bridge/connector between those legacy systems and the cloud-hosted product.

· General platform capabilities including high (99.99% or greater) availability, conformance to security standards such as NIST SP 800-63 and FIPS 140-2, FedRAMP High authorization, support for multiple deployment environments, including sandbox environments, API-based product configuration and management, custom reporting and alerting. Product support to include dedicated support staff available to address complex technical issues and support incident response and remediation 24x7.

· Professional services to provide technical support and subject matter expertise to support the initial setup, configuration, deployment, and expansion of the SaaS IAM product within the VA as well as the transition from existing VA IAM solutions to the SaaS IAM product, advisory and project support to facilitate the integration of VA systems with the SaaS IAM product, guidance and support enabling and leveraging advanced features and capabilities, and support with security and compliance activities to mitigate risks and maintain the VA Authority to Operate (ATO) for the SaaS IAM product.

· Training materials to provide accessible and comprehensive training materials, including documentation, tutorials, and video guides, to empower users (both end-users and administrators) to understand how to use the SaaS IAM product effectively, as well as interactive training sessions, certification tracks, and periodic refresher courses should be provided to ensure users remain informed about security best practices and the latest features of the SaaS IAM product.

NOTE: Refer to the “SaaS IAM” draft Product Description (PD) document for detailed product requirements.

Responses:

Please submit a capability statement describing your company’s ability to meet the overall requirement described and responses to the questions below. The capability statement shall be limited to ten (10) pages. Responses to this RFI shall be submitted via email to Sean McAvoy at sean.mcavoy1@va.gov and Kathryn Pantages at Kathryn.pantages@va.gov no later than 10:00 AM EST on May 23rd, 2024.

1) Provide a brief summary of your technical approach for meeting the requirements for VA SaaS IAM specific to the following:

a. Demonstrate the approach and projected timeframe to deliver a FedRAMP High-authorized product meeting the above requirements including the projected cost, strategy and timelines for maintaining existing legacy SSO products/solutions during migration.

b. Explain how your product can be used to provide MFA capabilities for users authenticating into Windows 10 and macOS without a PIV card, specifically to provide users with the ability to present two separate authentication factors (e.g. something a user knows, like a password, and something a user has, like possession of a cell phone generating a one-time code) in addition to possession of the computer while supporting phishing resistance. This should support both government-furnished machines for individual use as well as shared machines with greater than 10 users, support machines that do not include any biometric sensors, e.g. fingerprint reader, and support both portable machines such as laptops as well as those that stay in a fixed location onsite.

c. Explain how your product provides integrated adapters to streamline integration of on-premise or mobile applications inclusive of the types and number of applications that are included in your default integration library.

d. Explain how your product provides adaptive MFA to enforce authentication policies based upon factors such as role, context, user behavior, or other risk profiles.

e. Explain how your product provides and manages custom automation and authentication/authorization workflows, e.g. revoke and issue licenses for users based on inactivity, provide automated reporting on a regular schedule, or customize authentication flows and incorporate 3rd-party integrations such as identity verification depending on the context, etc.

2) Have the requirements, identified above, provided sufficient detail to describe the technical and functional requirements that encompass the desired solution?

______ YES ______ NO

a. If “NO”, please provide your technical and functional comments/recommendations on elements of the requirements, identified above, that may contribute to a more accurate quote submission and efficient, cost-effective solution.

3) Are there any specifications that you believe are unachievable by industry? If so, please state why.

4) What additional information would be needed to provide a firm fixed price quote for each item/task?

5) Include the following identification information:

a. Name of Company

b. Address

c. Point of Contact

d. Phone Number

e. Fax Number

f. Email address

g. CAGE code/Unique Entity Identifier

h. Company Business Size and Status for NAICS

i. Any Schedules held on General Services Administration (GSA), Government-Wide Acquisition Contracts (GWAC) held on the National Aeronautics and Space Administration (NASA) Solutions for Enterprise Wide Procurement (SEWP) V, or any other schedule not mentioned above to assist in determining acquisition strategy if you are included in one or more. Please also include Contract Number, expiration date, etc.

j. Socioeconomic data: If a small business, what type of small business are you? Are you able to comply with FAR 52.219-6 and 52.219-14 in execution of this effort? Are you able to comply with VAAR 852.219-10, VA Notice of Total Service-Disabled Veteran-Owned Small Business Set-Aside and with subcontracting limitations in 13 CFR 125.6 in execution of this effort?

6) Is your company currently providing similar services to any government agency or other non-government customers? If so, please identify the agency or non-government customer. If you are unwilling to share your customers' identity, please address whether your company offers the same or similar services, commercially (outside the federal government).

VA is requesting assistance in obtaining rough estimated pricing based on the implementation of a SaaS IAM solution and professional services as identified in the requirements section. The results of the estimated pricing and technical capabilities shall be used to finalize the VAs requirements prior to issuing a solicitation. Please provide a Rough Order of Magnitude (ROM) for the product/solution being proposed if possible.

Post RFI Phase Once RFI responses are reviewed, VA may conduct face-to-face or telephonic briefings with companies to answer additional questions with respect to the response given. VA retains sole discretion of whether any post RFI briefings are warranted, and which industry partners may be invited to provide additional market research information.

Based on market research results, the RFP/RFQ may be made available on GSA eBuy. It is the responsibility of interested parties to regularly monitor the GSA eBuy Website for updates. The government will not provide hard copies of the solicitation once issued. Interested parties are responsible for monitoring the website and downloading the solicitation, its attachments, and any amendments from the internet site identified above when/if issued. All information regarding the procurement is provided herein, and no additional information shall be provided at this time.

OFFERORS ARE ADVISED THAT THIS REQUIREMENT MAY BE DELAYED, CANCELED, OR REVISED AT ANY TIME.