UP16DF0401_MultiFactorIdentityAuthentication_RFP.doc

UNIVERSITY OF MASSACHUSETTS

Request for Proposal

UNIVERSITY OF MASSACHUSETTS

Multi-Factor Identity Authentication

RFP # UP16-DF-0401

SUBMITTED BY

THE UNIVERSITY OF MASSACHUSETTS,

PURCHASING DEPARTMENT, SHREWSBURY, MA 01545

SPONSORED BY

THE UNIVERSITY OF MASSACHUSETTS PRESIDENTS’ OFFICE

1.0 GENERAL INFORMATION

1.1 SUMMARY

As part of our Security Review, the University of Massachusetts (UMass) would like to strengthen the protection of its IT resources by adding challenges to its current access procedures.

The awardee of the RFP will design, develop and deploy a multi-factor authentication solution built upon the Oracle IAM 11gR2 Suite of products, which is already in place. The system will support the UMass environment described in Section 1.2.

1.2 UNIVERSITY SYSTEM

The University is composed of six (6) distinct operating units, and each of their associated entities and off-site affiliates including:

· Amherst Campus

· Boston Campus

· Dartmouth Campus

· Lowell Campus

· President’s Office – Central Administration

· Worcester Campus

The University’s five campuses and President’s Office are geographically dispersed throughout the state. Each campus possesses a unique and complementary mission. A single Board of Trustees composed of 19 voting members and 3 non-voting members governs the University. The President of the University oversees the five-campus system, and each campus has its own Chancellor.

Additional information about the University of Massachusetts System is available through the University’s web site at http://www.massachusetts.edu/index.html.

2.0 INSTRUCTIONS TO BIDDERS

2.1 RFP SCHEDULE

The University may change these dates at its sole discretion.

2.2 BID RESPONSE DEADLINE

Proposals must be received via email only to procurement@umassp.edu on or before 2:00pm EST, on May 5, 2016.

The email subject line must read: “UP16-DF-0401 Proposal” and must have attached files, which contains the bidder’s response including completed forms.

The University recommends sending the email with acknowledged receipt. It is the bidder’s responsibility to insure that its proposal is received in its entirety and without exception by the proposal closing date and time. Any proposal received after the date and time specified will not be accepted, read, or evaluated.

The University will not be responsible for computer, server, internet or any technical problems, errors, delivery delays, or failures beyond its physical control. Bidders are advised to send their proposal responses prior to the proposal deadline to compensate for potential Internet routing delays in email transmission.

2.2.1 EMAIL RESPONSE – FILE SIZE LIMITATIONS

The procurement@umassp.edu mailbox is capable of receiving emails up to 25 MB in size. If your response is larger than 25 MB, please split your response and send in 2 or more separate emails and indicated in the subject line that you are sending multiple emails, e.g. PROPOSAL, 1 of 2. All emails containing your proposal response must be received prior to the proposal deadline.

2.3 QUESTIONS

Bidders may submit written questions via e-mail to procurement@umassp.edu on or before 4pm EST, on April 15, 2016. The email subject line must read: “UP16-DF-0401 QUESTIONS”. The University will compile all questions and email responses to all known bidders by end of day on April 22, 2016. Response to questions will also be posted on the University’s website at the following location: http://www.massachusetts.edu/purchasing/openbids.html.

No telephone calls will be entertained. Prospective bidders are prohibited from obtaining information about this proposal from any University personnel. Inquiries received after the specified date and time will not be accepted.

2.4 AMENDMENTS TO REQUEST FOR PROPOSAL

Answers to bidder questions and other changes to the RFP document will be emailed to all known bidders and posted on the University’s website at the following location: http://www.massachusetts.edu/purchasing/openbids.html.

2.5 CONTACT INFORMATION

Except as may be noted otherwise herein, the issuing office and sole contact for the coordination and dissemination of all information regarding this RFP is:

Deborah Fisher, Procurement Services Manager University of Massachusetts President’s Office

333 South Street, Suite 450

Shrewsbury, MA 01545 Email: dfisher@umassp.edu

2.6 ACCEPT/REJECT PROPOSAL

The University reserves the right to reject any or all proposals, wholly or in part; to waive technicalities, irregularities, and omissions; to make the award in a manner deemed to be in the best interest of the University; and to correct any award erroneously made as a result of a clerical error on the part of the University.

2.7 WITHDRAWAL OF PROPOSAL

Proposal offers may be withdrawn at any time prior to the proposal receipt deadline date and time. Once the proposal receipt deadline has passed all proposals become the property of the University.

2.8 PROPOSAL RESULTS

Complete records of all proposals and awards are maintained in the University of Massachusetts President’s Office Purchasing Department. All proposal documents will be made available for public examination after the bid evaluation committee has completed its bid review, selection and award.

2.9 NO UNIVERSITY OBLIGATION

The RFP in no manner obligates the University to the eventual purchase of any products or services described, implied , or which may be proposed, until confirmed by written agreement, and may be terminated by the University without penalty or obligation at any time prior to the signing of an agreement.

2.10 AUTHORIZED SIGNATURE

The proposal offer shall be signed by an officer who is authorized to make such commitments for the bidder.

Please complete bidder information in Section 9.0 – BIDDER INFORMATION AND SIGNATURE.

2.11 EXPENSES

Expenses for developing and presenting proposals shall be the entire responsibility of the Bidder and shall not be chargeable to the University. All supporting documentation and manuals submitted with this proposal will become the property of the University unless requested by the Bidder, in writing, at the time of the submission, and agreed to, in writing, by the University.

3.0 UNIVERSITY TERMS AND CONDITIONS

The terms and conditions that will apply to the submission of proposals, to the University’s evaluation of the proposal offers, and to the award of the contract should be reviewed carefully to ensure full responsiveness to the RFP.

3.1 PROPOSAL FORMAT

All proposals shall be submitted as Best and Final Offers. Bidders will not be allowed to make material alterations to their proposal offers after the proposal opening. Each bidder shall include in their written offer all requirements, terms and conditions they may have, and shall not assume that an opportunity will exist to add such requirements, terms or conditions after the proposal opening. Bidder’s terms or conditions that are deemed unacceptable by the University may be the basis for the University’s rejection of the proposal.

3.2 PROPOSAL MATERIALS

All materials submitted in response to the RFP shall become the property of the University upon submission and will be considered as part of this RFP.

3.3 MASSACHUSETTS PUBLIC RECORDS LAW

Access to University records is made in accordance with the Massachusetts Public Records Law, M.G.L. c. 66, s. 10. All Bid Responses received are subject to M.G.L. c. 4, s. 7, ss. 26, and M.G.L. c. 66, s. 10 regarding public access to such documents. Statements or endorsements inconsistent with those statutes will be disregarded. The University will withhold the Responses or sections of Responses until such time that they have been opened. The University will make available the documents within those Responses only upon the finalization of those records.

3.4 RFP INTERPRETATION

Interpretation of the wording of this document shall be the responsibility of the University and that interpretation shall be final.

3.5 ADDENDUM

Any addendum issued to Bidders prior to the proposal opening date shall include an addendum acknowledgement section. Since all addenda shall become a part of the proposal, all addenda must be signed by an authorized Bidder representative and returned with the proposal. Failure to sign and return any and all addendum acknowledgements will be grounds for rejection of the proposal response.

3.6 PROPOSAL MODIFICATION

Any exceptions/ additions/ alterations to the terms and conditions contained herein must be included in the bidder’s response. Failure to provide the required data to allow for evaluation of the bidder’s response to the RFP, or failure to follow and complete the RFP proposal format and accompanying documents will be grounds for rejecting the proposal offer. The University reserves the right to reject any proposals that alter the terms specified in the RFP.

3.7 CONFIDENTIALITY

From the date of issuance of the RFP until the opening date, the Bidder must not make available or discuss its proposal, or any part thereof, with any employee or agent of the University. The Bidder is hereby warned that any part of its proposal or any other material marked as confidential, proprietary, or trade secret, can only be protected to the extent permitted by Commonwealth of Massachusetts laws.

3.8 PERIOD OF FIRM PROPOSAL

All proposal offers must remain in effect for a minimum period of 180 days following the Proposal due date in order to allow for sufficient time for evaluation, approval, and issuance of award notice. The successful bidder’s offer will remain firm for the duration of any resulting award and extensions.

3.9 PRE-AWARD NEGOTIATIONS

After the proposals are opened, but prior to award, the University may elect to conduct negotiations with the highest ranked proposal respondents for purposes of:

· Resolving minor differences and information

· Clarifying necessary details and responsibilities

· Emphasizing important issues and points

· Receiving assurances from respondents Selection may be made without further discussion, negotiations or bidder’s presentations; therefore, bidder shall offer the most favorable terms in response to this RFP. Bidder must demonstrate an understanding of the scope of service to be provided and the ability to accomplish the tasks set forth. Bidder shall include information that will enable the University to determine the bidder’s overall qualifications. The University reserves the right to request additional information or clarification on any matter included in the proposal response, to enable the University to arrive at the final award decision.

3.10 Vendor Presentations

Some vendors may be invited to the University’s Shrewsbury MA location to give an oral presentation and demonstration of their product.

The presentations are tentatively scheduled for the week of May, 23, 2016 at the following location:

University of Massachusetts President’s Office

333 South Street, Suite 450

Shrewsbury, MA 01545

Conference Room: TBD

If special accommodations are required in order to attend a site visit, please contact Deborah Fisher at dfisher@umassp.edu no later than three (3) days before the event.

4.0 CONTRACT

4.1 CONTRACT TERM

The contract will become effective on or about July 1, 2016.

4.2 CONTRACT FORMAT

The resulting University Award will incorporate the University of Massachusetts Contract Terms and Conditions, a sample copy of which is enclosed as Appendix A. This RFP, any addendum, and bidder’s response thereto, all additional agreements and stipulations, and the results of any final negotiations will constitute the final contract. The terms and conditions as contained in the Contract for Services shall take precedence over any conflicting terms.

4.3 CONTRACT MODIFICATIONS

Any changes to the contract must be agreed to, in writing, by both parties prior to their execution.

4.4 CONTRACTOR ASSIGNMENT OF SUB-CONTRACT

The Contractor shall not assign or in any way transfer in the Contract without prior written consent of the University, nor there be any subcontract of services without the prior written approval of the University. If subcontractors are used, delineate who the material subcontractors are and the nature of the relationship (e.g., security, courier, and system design).

4.5 CONFLICT OF INTEREST

No officer or employee of the Commonwealth shall participate in any decision relating to the Contract which affects his/her personal interest or the interest of any corporation, partnership or association in which he/she is directly or indirectly interested.

5.0 EVALUATION CRITERIA

The University will use the following criteria to evaluate the vendor's ability to take on a project of this depth and skill:

· 25% - Fees and Costs

· 20% - Ability to bring skilled resources to bear on project. This will be evaluated based on

· The resumes provided on key project resources

· In person meetings with the key project resources

· Availability of key resources for the start and duration of the project

· 20% - Depth of knowledge and abilities in the areas of work being bid on

· Proven and documented methodology for approaching a project(s) such as this

· Past successes in IdM upgrades and experience with utilizing the toolsets being worked on

· 20% - References

· 15% - Project timeline

6.0 PROPOSAL REQUIREMENTS

6.1 QUALIFICATIONS/EXPERIENCE

The Vendor should have extensive experience with the Oracle 11g IAM Suite of products as well as direct experience in designing and deploying multi-factor IAM solutions.

6.2 PROPOSAL DETAILS

A complete Proposal should include the following information for each phase:

· Type of bid – fixed or time & material.

· RFP response including Cost, Project Summary, Time Lines, Resource Estimates and Documents to be provided

· High-level description/diagrams of the proposed solution.

· High-level approach to the project

· Completed Appendix A – Documents Requiring Signature

· Supporting Documentation if Applicable

· Resumes of key personnel that will be primarily engaged on the project. (Multiple positions may be filled by the same individual) Example:

· Project Manager

· Senior Architect

· Senior OAM/OAAM Engineer

· Documentation on Implementation methodology

· Document Samples and Examples The vendor may also provide additional information they deem required with helping the University make an informed decision.

7.0 PROJECT REQUIREMENTS

7.1 EXPECTED PROJECT DELIVERABLES

The awardee is expected to provide, but not be limited to the following deliverables:

· An outline of the approach to be used for implementation

· Requirements: Detailed requirements to be defined by vendor in conjunction with UMass

· An implementation plan

· A review/feedback process of the above documents by UMass

· A system that meets the approved approach and requirements

· The vendor will follow an established SDLC process

· Any requirements detailed in section 7.2

· Training and knowledge transfer to UMass team

7.2 HIGH LEVEL SYSTEM REQUIREMENT

The proposed system should include but not be limited to the following capabilities, unless the vendor suggests a better solution and UMass accepts.

· The system must be implemented within the existing Oracle 11gR2 toolset

· Attachment A, (UMass HR Application Access-Authentication-Auditing) outlines the UMass identity and access management architecture.

· The system should support up to 80,000 users.

· The system must support both central and campus IDPs

· Central IDP must support OAM two factor

· Amherst Campus IDP must support Shibboleth

· The system should be scalable so that it can be rolled out to other applications in the future.

· The system must NOT make use of hard tokens

· The system should allow for multiple methods of challenge distribution

· The system will produce reports, online real-time and/or static documents, showing access activity requested during Requirements gathering

· The system should enable the risk assessment features of OAAM.

· The system should enable soft-token generation as a service

· The solution should not be designed in a way that would limit future versions of software tools, i.e. use standards.

· Any vendor owned SW should be held in escrow.

8.0 REFERENCES

Please provide three client references below (please type or print clearly):

9.0 BIDDER INFORMATION AND SIGNATURE

Please complete the information below (type or print clearly).

BIDDER (BUSINESS) NAME

BIDDER CONTACT PERSON

ADDRESS 1

ADDRESS 2

CITY

STATE

ZIP

TELEPHONE

FAX

EMAIL

Web Address

Authorized Signature: ___________________________________________________________

END OF RFP UP16-DF-0401

Rev. 4/2013