Sources Sought Notice SSN - RFI- NIH ICAM Modernization posted 2-21-2023.pdf

SOURCES SOUGHT NOTICE/REQUEST FOR INFORMATION

NATIONAL INSTITUTES OF HEALTH (NIH)

NATIONAL LIBRARY OF MEDICINE (NLM)

CENTER FOR INFORMATION TECHNOLOGY (CIT)

TITLE: NIH Identity, Credential, and Access Management (ICAM) Modernization

This announcement constitutes a Sources Sought Notice (SSN)/Request for Information (RFI) (market survey). This is NOT a Request for Quote (RFQ) or a Request for Proposal (RFP). This announcement is for information and planning purposes only and is not to be construed as a commitment by the Government, implied or otherwise, to issue a solicitation or award a contract.

Purpose of Sources Sought/Request for Information:

The National Institutes of Health (NIH), National Library of Medicine (NLM), Center for Information Technology (CIT) is requesting information from qualified vendors to determine whether capability exists to provide the following capabilities through a software as a service (SaaS) offering:

1. Web Authentication: Allows users to verify their identity, and access NIH –managed web resources

2. Directory Services: Allows NIH to store and maintain information about NIH users and resources

3. Secure Access Service Edge (SASE): Allows NIH to facilitate secure access to cloud and on-premises NIH resources by bundling network and security-as-a-service functions.

This Sources Sought Notice/Request for Information is intended to inform the NIH on the current status of industry sources that can provide the desired capabilities. Your responses to the information requested will assist the Government in determining the appropriate acquisition method.

This is NOT a solicitation for proposals, proposal abstracts, or quotations.

This notice is issued to help determine the availability of qualified companies technically capable of meeting the Government requirement and to determine the method of acquisition. It is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will not be considered as proposals or quotes. No award will be made as a result of this notice. The Government will NOT be responsible for any costs incurred by the respondents to this notice. This notice is strictly for research and information purposes only.

Background: The National Institutes of Health, commonly referred to as NIH, is the primary agency of the United States government responsible for biomedical and public health research.

The Center for Information Technology (CIT) is one of NIH’s 27 institutes and centers (ICs) focusing in the areas of computational bioscience, engineering, informatics, and statistics to help make biomedical discoveries that protect and improve our nation’s health. CIT serves 50,000 users daily in more than 400 buildings and facilities and hosts a 225,000-user grantee population.

NIH also provides services to 1.2 million federated users domestically and internationally.

Currently, the Identity, Credential, and Access Management (ICAM) infrastructure at NIH primarily resides on-premises. This includes LDAP directory services such as Active Directory (AD) and VDS (Virtual Directory Services) where users, objects, and entities are stored. Some of the NIH applications rely on AD domain controllers. The enterprise Identity and Access Management (IAM) solution provides authentication services for internal and external users with Single Sign-On (SSO) access to NIH managed resources and applications. Also, the NIH currently utilizes Azure AD authentication for access to the NIH Microsoft 365 (M365) and Azure cloud resources. The majority of legacy applications use web agents for authentications.

Challenges:

The COVID-19 pandemic introduced new challenges and, in many ways, exacerbated existing challenges NIH has with its on-prem ICAM infrastructure. Some high-level, current state challenges are summarized below:

Time-to-deliver not optimal. There is a lack of automation during the application integration process, making application onboarding arduous and time-consuming.

High operational costs. NIH’s portfolio includes legacy applications that rely on overly-customized web-agents that require significant staff hours and level of effort to operate and maintain.

Lack of real-time visibility. Operational metrics such as user activity, IAM service status, and platform/service availability are difficult to monitor across the ICs and reporting capabilities between ICs vary.

Performance issues impacting users. With the significant, rapid increase in NIH’s remote workforce, VPN scalability proved insufficient to accommodate remote users’ need to access NIH managed resources efficiently.

NIH is looking to resolve most, if not all, of these challenges via the modernization effort.

Purpose and Objectives: To keep pace with modern market offerings and technology trends, NIH desires to shift to a Software as a Service (SaaS) model to reduce overhead and support the rollout of next-gen ICAM capabilities in alignment with the Zero Trust principle “never trust, always verify”. ICAM services with greater capabilities and expanded functionality are required to enable NIH users to seamlessly access resources they need from anywhere in the world.

The purpose of this request is to identify qualified Software as a Service solution vendor(s) to provide Web Authentication, Directory Services and Secure Access Service Edge (SASE) services at the NIH, transitioning the existing services from being hosted on-premises, to the cloud. If SaaS solutions are not available, please provide alternative options (e.g., hybrid, container-based solutions, etc.). This initiative will establish key pillars of the NIH CIT's Zero Trust Architecture mandated by Executive Order 14028: Improving the Nation's Cybersecurity.

Desired Future State

NIH is undergoing important transformations in when, where, and how the workforce operates.

The ICAM Modernization project will facilitate NIH staff members’ and biomedical research partners’ access to their NIH managed systems and data securely, anytime, from almost anywhere in the world. As NIH looks to the future, it must be more focused and strategic in leveraging technology as a critical resource, adopting new collaborative approaches and agile business models that deliver faster, better, more cost-effective capabilities that benefit all. This project could be called an agent of this future-facing philosophy. NIH anticipates future ICAM solutions delivering faster, more secure and cost-effective services from the cloud.

As depicted by the Conceptual Architecture Diagrams below, the future state solution will establish governance and management of ICAM services to allow a variety of users and devices seamless, secure access to NIH’s resources from on premise and virtual/remote locations. In the target state, anyone who attempts to access NIH managed resources will do so through enterprise-level SASE and Identity as a Services (IDaaS) platforms. The IDaaS architecture diagram below outlines more specifically the capabilities NIH envisions in a future solution. The SASE and IDaaS solutions will provide a diverse set of security and networking capabilities to grant access to NIH’s applications and infrastructure which are both on cloud and on-premises.

These capabilities will enable limited access, allow/block access, require MFA, block legacy authentication and force password reset. NIH will also utilize Continuous Monitoring and Diagnostics tools to ensure the services offered by the future solutions are operational and secure. Though IDaaS/SaaS solutions are desired, NIH is open to considering other cloud-based delivery methods (e.g., hybrid, container-based solutions).

Image Description of NIH ICAM Modernization Conceptual Target State Solution: The above diagram illustrates how National Institutes of Health’s identity and access management services (referred to as Identity as a Service (IDaaS) and Secure Access service edge (SASE) work together to provide these capabilities to the Institutes and Centers.

In the far left hand corner of the diagram is a legend with the following words: CDM-Continuous Diagnostics & Mitigation, IDaaS—Identity as a Service, API—Application Programming Interface, SASE—Secure Access Service Edge.

On the left side of the diagram are potential users of National Institutes of Health (NIH) resources including National Institutes of Health Staff, External Users(There are two type of external users, those who access NIH-managed resources via federated IAM and those whose external identities the NIH needs to manage). Trusted and Compliant Devices, Client Apps, Application Programming Interface (API) Web Services, Physical and Virtual Locations.

These inputs then point (through arrows) to four concentric circles. The outer circle in dark blue is labeled Secure Access Service Edge (SASE). The next inner circle in lighter blue is labeled Identity as a Services (IDaaS). The next lightest blue circle represents Splunk and Continuous Diagnostics & Mitigation.

Inside the three blue circles there is a white space with three arrows. Inside the white space are four areas labeled: Policy Enforcement & Decision Points, Conditional Access & real time evaluation, Identity Governance & Administration, Privileged Access Management.

On the right side of the graphic are desired capabilities from the vendor. They are listed as:

Limited Access, Allow/Block Access, Require Multi Factor Authentication, Block Legacy Authentication, Force password reset.

The concentric circles are linked to two boxes on the right through arrows. The top box has “Cloud Services” as the title and contains the following (in order): Blue cloud with the Microsoft Azure written inside, White cloud with AWS written in it, a multicolored Google logo in red, blue, green and yellow, a computer graphic with the words “National Institutes of Health Apps” in it, a cloud with the words “SaaS” written in it.

The second box below has a title of “On-Prem”. Inside the box are the following words:

National Institutes of Health Applications, National Institutes of Health Infrastructure.

Image Description of NIH ICAM Modernization Conceptual Target Architecture Identity as a Service (IDaaS):

All the way in the left corner is a legend with the following: LDAP-Lightweight Directory Access Protocol, API-Application Programming Interface, OIDC-OpenID Connect, PIV- Personal Identity Verification, PKI-Public Key Infrastructure, SAML—Security Assertion Markup Language, SSO—Single Sign-On.

On the left side of the diagram there is a gray cloud with the word “internet” written in it. That cloud is connected to another cloud in light blue with the words “Secure Access Service Edge”.

Beneath those is a box that has a title of “Use Cases”. In that box is written National Institutes of Health Staff, External Users (e.g. InCommon Federated Users), Application Programming Interface (API) Web Services and Devices.

To the right is a diagram with four clouds with the title “CIT ICAM IDaaS”. The first cloud all the way to the left in dark blue is titled “Authentication” and it contains the following words:

PIV, SSO, Risk Based Evaluation, WebAuth/FIDO2, Passwordless Authentication, Step-Up Authentication, Certificate-Based AuthN, OIDC/SAML, Conditional Access, Identity Federation. The next cloud to the right of this one is in light green. Inside is the title “Identity Governance & Administration”. The following words are included: Access Certification, Compliance Controls, Automated Lifecycle Management, cloud Access Governance, Self Service Password Management. Under the first set of clouds is another light blue cloud titled “Directory” and it contains the following words: Virtual Directory Services, LDAP, Identity Repository, Credential Management, Entitlements Repository, Dynamic Group Membership, Replication and Synchronization. The cloud all the way to the right is darker green and titled

“Privileged Access Management”. In the diagram are the following words: Session isolation, Secret Management, Risk Based Credential Security, Credential Theft Protection, Cloud Privilege Security, Secure Digital Vaulting.

All the way to the right is a box that says National Institutes of Health Applications & Infrastructure (ON PREM) as a title. The following words are in the box: IC Applications, IDaaS Sync Agents, AD Domain Controllers.

At the top is a diagram labeled Cloud Services and contains the following: Blue cloud with Microsoft Azure written in it, white cloud with the words AWS in it, a Google cloud with yellow, green, blue and red colors, a cloud with the words IC Apps/ Enterprise Apps in it and a cloud with the word “SaaS applications/services ” in it.

The scope of the ICAM Modernization effort at NIH includes the following ICAM functional capabilities:

Web Authentication:

o Capabilities used to allow users to verify their identity and access to NIH managed resources . Examples of which include but are not limited to: NIH Login Single-Sign-On (SSO), Federation services, Researcher Auth Service (RAS), Active Directory Federation Services (ADFS), Multi-factor Authentication (MFA), use of external Identity Providers (e.g., Login.gov, ID.me, InCommon).

Directory Services:

o Services used to store and maintain information about NIH users and resources.

Examples of which include, but are not limited to: Active Directory, Azure Active Directory (AD) Connect, Virtual Directory Services (VDS).

SASE Services:

o VPN-alternative services to facilitate secure access to cloud and on-premises NIH resources, also referred to as Secure Access Service Edge. Examples of required functions include but are not limited to: Zero Trust Network Access (ZTNA), Firewall as Service (FWaaS), Cloud Access Security Broker (CASB) and Software-Defined Wide Area Network (SD-WAN).

Minimum Vendor Requirements

Please indicate “yes” or “no” to the following questions as part of your response:

1. The vendor solution is Federal Risk and Authorization Management Program

(FedRAMP) Moderate Authorized, or the vendor is in process to attain FedRAMP Moderate Authorization;

2. The vendor has implemented Identity and Access Management Software as a Service (SaaS) solution at other Federal, state, and/or local government agency, or other organizations of similar size and complexity and is capable of supporting the size and transaction volume required by NIH;

a. The NIH Center for Information Technology ICAM services serve 50,000 users in 400 buildings and facilities. The team also supports 1.2 million external users.

3. The vendor is on GSA Multiple Award Schedule (MAS), NASA SEWP, NITAAC CIO- SP4 (upon award), CIO-SC or similar Federal government contracting vehicle.

4. The vendor can provide SLAs at 99.999% availability;

5. Solution shall be compliant with NIST SP 80-53 Rev. 5 Security and Privacy control catalog;

6. Solution shall provide real-time metrics for end-user sessions, activity, and history.

7. The vendor should provide a solution in alignment with the Zero Trust principle “never trust, always verify”, that eliminates implicit trust by continuously authenticating and validating digital identities based on a content and context-aware logical access boundary.

Required Capabilities:

The following capabilities are required:

Required Capability 1 - Provide a SaaS Web Authentication solution.

The vendor’ solution shall:

Provide a solution in alignment with the Zero Trust principle “never trust, always verify”, that eliminates implicit trust by continuously authenticating and validating digital identities based on a content and context-aware logical access boundary.

Provide enterprise authentication solution for internal users (e.g.: NIH employees and contractors), external users (e.g., clinicians, researchers, federal agency personnel), and non-human entities.

Provide basic authentication as well as modern authentication methods and standards including Personal Identity Verifications (PIV), certificate-based PKI, token-based, and API-based authentication (examples such as Representational State Transfer [REST], Simple Object Access Protocol [SOAP]).

Provide identity federation using standards and protocols such as SAML, OIDC, OAuth, support for header-based authentication, and Web Service Federation (WS Fed) via multiple Identity Providers (IdPs) such as Login.gov, ID.Me and InCommon.

Provide standards-based methods for network authentication supporting or replacing Kerberos, New Technology LAN Manager (NTLM), and Remote Authentication Dial-In User Service (RADIUS).

Provide enterprise single sign-on (SSO) for on-prem applications, cloud-hosted applications, SaaS tools NIH manages, and applications hosted in hybrid IT environment.

Provide cloud-based authentication via integrations with Azure AD, social login (such as Google, PayPal, Apple, etc.), and external IDPs (Login.gov and ID.me).

Provide authentication options to users for various device types such as mobile devices (smartphones, tablets), workstations, laptops, Personally Owned Equipment (PoE), and medical devices.

Support multi-device and platform usability/functionality: Solution shall be functional via desktops, servers, mobile phones. In addition, solution shall support desktops, workstations, servers, etc. that run Linux, Windows, and MacOS.

Provide authentication support for Derived PIV credentials (DPCs) to authenticate users to NIH sms and applications.

Provide phishing resistant multi-factor authentication (MFA) using various methods such as an Authenticator application, OTP, FIDO 2-compliant Yubikey, PKI certificates.

Provide authentication and authorization of NIH directory objects (users and computers) maintained in the Windows Active Directory (AD) servers and domain controllers.

These are preliminary requirements. What other must-have technical, or business requirements should the government consider in terms of a solution?

Required Capability 2 - Provide a SaaS Directory Services solution.

The vendor’s solution shall:

Provide a solution in alignment with the Zero Trust principle “never trust, always verify”, that eliminates implicit trust by continuously authenticating and validating digital identities based on content and context-aware logical access boundary.

Provide standards-based Lightweight Directory Access Protocol (LDAP)-compliant solution to store hierarchical identity data (e.g.: users, certificate, assets).

Provide directory services to manage users, groups and objects (e.g.: phone number, email address, or group membership) to support authentication and authorization.

Provide capability to replicate and synchronize directory data with on-premises and cloud data sources.

Provide directory server indexing capability to efficient retrieval to perform LDAP searches/lookup. Please describe the retrieval/SLA look up present in your solution.

Provide an enterprise mobility management solution to integrate the Mobile Device Management (MDM), Mobile Endpoint Management (MEM) and Mobile Application Management (MAM) services for conditional access controls and session controls.

Provide capability to integrate cloud service providers (e.g.: Azure AD) to access SaaS applications (e.g.: Office 365, SharePoint, Box) and on-prem applications (e.g.: MS Exchange, AD Domain Controllers).

Provide enterprise capability to integrate with NIH applications for identity federated services.

Provide enterprise Virtual Directory services (VDS) to create a centralized view of identity data from multiple authoritative sources such as AD, LDAP repository, and other identity repositories/databases(e.g., Oracle Database, SQL server, REST, SOAP and

JDBC).

Provide on-demand and refreshed views of identity data using computed attributes from multiple data sources. Make data available using various protocols (including but not limited to LDAP, REST, SOAP and JDBC).

Provide the capability to aggregate identity data from disparate sources and create customizable queries and views.

Provide Virtual Directory services (VDS) refresh and caching methods through views (joins) to improve user search performance.

Provide a solution in alignment with the enterprise Continuous Diagnostics and Mitigation (CDM) Program implementation.

These are preliminary requirements. What other must-have technical, or business requirements should the government consider in terms of a solution?

Required Capability 3 - Provide a Secure Access Service Edge SaaS solution.

The vendor’s solution shall:

Provide a solution in alignment with the Zero Trust principle “never trust, always verify”, that eliminates implicit trust by continuously authenticating and validating digital identities based on content and context-aware logical access boundary.

Provide VPN alternative with ZTNA services that provides secure access to applications using SASE capabilities.

Provide identity-based and contextual (location, IP address, type of device, and policies) access controls with conditional access capability for NIH managed resources.

Provide public-facing web and mobile application protection, bot management, and attacks against API security using firewall as a service (FWaaS).

Provide URL filtering and malicious content inspection capabilities to protect against unauthorized transfer of data using Secure Web Gateway (SWG).

Provide in-line SaaS application monitoring, application discovery and integration with single sign-on (SSO) identity providers.

All connections between an NIH system with untrusted networks must follow the HHS TIC 3.0 policy and must be secured by the default HHS TIC Policy Enforcement Point (PEPs).

Provide SD-WAN capabilities with a centralized control function to steer traffic securely and intelligently across the WAN and directly to trusted SaaS and IaaS providers to increase application performance and deliver a high-quality user experience.

The solution shall provide real-time user experience and network monitoring capabilities, including automatic event correlation and root cause analysis, to enable NIH staff to proactively identify outages and security incidents, and help trigger appropriate actions and responses.

These are preliminary requirements. What other must-have technical, or business requirements should the government consider in terms of a solution?

Submission Requirements:

Please provide the following in your response. Please ensure your responses do not exceed 5 pages single spaced per Capability Area outlined above. Please ensure your responses do not exceed 10 pages single spaced for the questions below.

1. Name of company with address, point of contact, phone, email, and website address, if applicable.

2. CAGE Code, UEI number from SAM.gov, SAM code.

3. What are your preferred contract vehicles to access you through? Please provide contract vehicle information if you believe the NLM can use a GWAC or GSA Schedule to obtain these services.

4. The Government believes the most appropriate NAICS code for this requirement is 541519 (Other Computer Related Services). Do you believe this is the most appropriate?

If not, please suggest an alternative NAICS code.

5. Size of business and socioeconomic status (i.e., small, small & disadvantaged business, woman owned, etc.) and when, if at all, your firm’s socioeconomic status will expire.

6. Responses (yes or no) to the outlined Minimum Vendor Requirements.

7. Statement of capability demonstrating your firm’s ability to meet one or more of the required capabilities stated above and specify if your firm will meet the requirements as a prime, subcontractor or as part of a team/JV.

8. Initial pricing to deliver capabilities listed herein. Can the vendor provide a Rough Order of Magnitude of –25% to +75% per the Project Management Body of Knowledge?

9. Responses to Vendor Questions outlined below.

Vendor Questions:

Technical

10. How has the vendor deployed this solution to modernize existing systems (with similar capabilities) previously? What challenges should the government anticipate with implementation?

11. Please describe the services you offer during the migration process and what you expect the government's responsibility to be during that process. (Some examples of responsibilities include, but are not limited to, install and provision necessary components, connect and integrate monitoring with backend, backup of integration files, connect and ensure network performance, perform post-installation security and compliance checks, verify remote access control, provide backup sizing needs, etc.)

12. Can you provide examples of how long similar implementations took to complete and examples of the clients you’ve completed the implementations for?

13. What additional capabilities does the vendor offer in terms of implementation that may be unique?

14. How has the vendor solution(s) implemented compliance with TIC 3.0?

15. What services does the vendor provide to their customers to onboard current customer applications onto the cloud?

16. What are the types of labor categories required for implementation? How do you allocate resources for implementation-is it based on number of users or something else? Please describe.

17. Can you please outline your client communications plan in an event of a security breach?

Under what conditions are clients notified of security breaches?

SASE Capabilities

18. How do you provide visibility into IaaS / PaaS environments?

19. Do you integrate with threat intel feeds, ie via STIX/TAXI?

20. Can site risk scoring be customized and used within a policy for enforcement?

21. Do you leverage Artificial Intelligence and Machine Learning (AI/ML) algorithms as part of the sensitive data discovery process?

22. Which out of the box Data Loss Prevention (DLP) policies does the product provide?

23. Do you require an agent to perform DLP functions?

24. Does your ZTNA solution support all ports and protocols?

25. If deployed in agentless, what limitations exist?

26. Can your ZTNA solution integrate with unified endpoint management for posture analysis?

27. Can your DLP engine prevent sensitive data exfiltration from an IaaS environment to a

SaaS environment?

Pricing

28. What price models does the vendor(s) offer and which ones should the government consider for the solicitation? What are the pros/cons of each option?

29. What type of licensing do you offer for the proposed solution (e.g., subscription vs perpetuity, user based vs. unlimited license agreement, etc.)?

30. What are your one-time charges for the proposed solution? What are your recurring charges for the proposed solution?

Contracting

31. Have you established commerciality? What’s the ratio of commercial to federal sales?

32. What partnering level does your original equipment manufacturer (OEM) place your firm for the requested product (e.g., gold/silver/bronze/global/elite partner, etc.)? What benefits does this status provide your firm and is it something the government should consider mandating in its requirements? Please provide the name of the product that would be suitable for this solicitation and the associated OEM Designated Level.

How to Respond:

All interested parties should respond with a statement expressing their interest in participating in a competitive process for this opportunity. Interested parties should respond to all parts of the Submission Requirements of the SSN. Vendors may choose to respond to Capability 1, Capability 2, Capability 3 or a combination of those in the Statement of Capability question.

Response Instructions:

NIH is interested in a small business’ ability to participate on their own or understanding if a small business requires participation as part of a large group of Contractors (e.g., Joint Venture).

Where to send responses:

Alice M. Sobsey, Contracting Officer Email: alice.sobsey@NIH.gov

Response deadline: March 7, 12:00 pm EST

Responses shall be in Microsoft Word or Adobe Acrobat format.

Responses shall be in Microsoft Word or Adobe Acrobat format. The email should include the following subject heading, “Response to Request for Information and Sources Sought for Title:

NIH Identity, Credential, and Access Management Modernization”.

All files shall be titled, “<Company Name> CIT ICAM SSN”.

Disclaimers:

Responses to this Sources Sought are not considered offers and cannot be accepted by the Government to form a binding contract. Respondents should not submit any proprietary information when responding to this Sources Sought.

The information provided is for market research purposes pursuant to FAR Part 10 Market Research. Information provided will be used at the government’s discretion to finalize the acquisition strategy in fulfilling the need through an upcoming solicitation.

This notice does not obligate the Government to award a contract or otherwise pay for the information provided in response. The Government reserves the right to use information provided by respondents for any purpose deemed necessary and legally appropriate. Any organization responding to this notice should ensure that its response is complete and sufficiently detailed to allow the Government to determine the organization’s qualifications to perform the work.

Respondents are advised that the Government is under no obligation to acknowledge receipt of the information received or provide feedback to respondents with respect to any information submitted. After a review of the responses received, a pre-solicitation synopsis and solicitation may be published in www.sam.gov. However, responses to this notice will not be considered adequate responses to a solicitation.