IAM System RFP Template

Introduction: How to Use This Template

A request for proposal (RFP) is a formal invitation issued by a business or agency requesting interested vendors to
submit written proposals meeting a particular set of requirements. If interested in bidding for the project, vendors
respond with a description of the techniques they would employ to meet the requirements, a plan of work, a
detailed budget for the project, any any supporting information. An RFP may form part of the final contract once
negotiations between the enterprise and the vendor are completed.

Delete all information where text is colored grey (such as this paragraph). Fill in or delete all form fields shaded in
grey (such as the “Insert Enterprise Name Here” field below). Form shading is not visible in printouts. Replace Info-
Tech header and footer with that of your own organization.
Be sure to change all necessary text to black before printing or sending.

Insert Enterprise Name Here

Request for Proposal for an Identity and Access Management (IAM) System

Insert Date of Issue Here

1
Info-Tech Research Group
Table of Contents
1 STATEMENT OF WORK.................................................................................................................................. 3
1.1 Purpose.................................................................................................................................................. 3
1.2 Coverage & Participation........................................................................................................................ 3
2 GENERAL INFORMATION................................................................................................................................ 3
2.1 Original RFP Document.......................................................................................................................... 3
2.2 The Enterprise........................................................................................................................................ 3
2.3 Existing Technology Environment.......................................................................................................... 3
2.4 Schedule of Events................................................................................................................................. 4
3 PROPOSAL PREPARATION INSTRUCTIONS....................................................................................................... 5
3.1 Vendor’s Understanding of the RFP....................................................................................................... 5
3.2 Good Faith Statement............................................................................................................................ 5
3.3 Communication....................................................................................................................................... 5
3.4 Proposal Submission.............................................................................................................................. 6
3.5 Method of Award.................................................................................................................................... 7
3.6 Selection and Notification....................................................................................................................... 7
4 SCOPE OF WORK, SPECIFICATIONS & REQUIREMENTS...................................................................................8
4.1 Product Architecture............................................................................................................................... 8
4.2 Product Features.................................................................................................................................... 9
4.3 Product Support.................................................................................................................................... 10
5 VENDOR QUALIFICATIONS & REFERENCES........................................................................................................... 10
6 BUDGET & ESTIMATED PRICING.......................................................................................................................... 11
6.1 Deployment Models.................................................................................................................................... 11
6.2 Price Schedules......................................................................................................................................... 11
7 VENDOR CERTIFICATION..................................................................................................................................... 12

2
Info-Tech Research Group
1 Statement of Work
1.1 Purpose
The purpose of this request for proposal (RFP) is to invite prospective vendors to submit a proposal to supply
an identity and access management (IAM) solution to Insert Enterprise Name Here. The RFP provides vendors
with the relevant operational, performance, application, and architectural requirements of the system.

1.2 Coverage & Participation

The intended coverage of this RFP, and any agreement resulting from this solicitation, shall be for the use of
all departments at Insert Enterprise Name Here along with any satellite offices. Insert Enterprise Name Here
reserves the right to add and/or delete elements, or to change any element of the coverage and participation at
any time without prior notification and without any liability or obligation of any kind or amount.

2 General Information
2.1 Original RFP Document
Insert Enterprise Name Here shall retain the RFP, and all related terms and conditions, exhibits, and other
attachments, in original form as an archival copy. Any modification of these, in the vendor’s submission, is
grounds for immediate disqualification.

2.2 The Enterprise

Describe the enterprise in a few brief paragraphs. Include a description of the business and location, including
any satellite offices that will be involved in the project.

Describe the enterprise’s intended use of the solution to be acquired in a few brief paragraphs. Include the
objectives of the groups who will be using the system, the number of users for the system, expected growth,
and what you hope to achieve with the system.

Insert Enterprise Description Here

Industry:
Products/Services offered:
Customer types (e.g. B2B, B2C, G):
Sector (public, private, NFP):
Major drivers for the IAM system (e.g. compliance, improved operational efficiency, response to existing
threats, etc.):
Relevant compliance regulations (e.g. SEC 17a, Sarbanes-Oxley, HIPAA, etc.):

2.3 Existing Technology Environment

The following is a listing of our current technology environment.

Insert Existing Technology Environment Here

 [Number of sensors that are to be protected by the IAM system]

 Active Directory
 Kerberos
 PKI, 802.1x
 Office 365 (Exchange, SharePoint, OneDrive) using Azure AD

3
Info-Tech Research Group
  Internal ERP using AD auth
 Cloud-based CRM tool, which supports standards-based SSO
 Web-based applications (internal, public-facing, and externally-hosted; both LAMP and MS/IIS-
based)
 Terminal-based applications (Citrix application and desktop virtualization environments)

2.4 Schedule of Events

The following is a tentative schedule that will apply to this RFP, but may change in accordance with the
organization’s needs or unforeseen circumstances.

List all major dates or milestones including the issuance of the RFP, the technical questions closing dates, the
RFP response closing date (including an exact time and time zone), the end of evaluation date, and the final
award notification date.

Issuance of RFP Insert Date Here

Technical Questions/Inquiries Due Insert Date, Time, Time Zone Here
RFP Closes Insert Date, Time, Time Zone Here
Complete Initial Evaluation Insert Date Here
Final Award Notification Insert Date Here

Example:

Issuance of RFP November 10, 20XX

Technical Questions/Inquiries Due December 8, 20XX 17:00 EST
RFP Closes December 15, 20XX 14:00 EST
Complete Initial Evaluation January 5, 20XX
Final Award Notification January 12, 20XX

4
Info-Tech Research Group
3 Proposal Preparation Instructions
3.1 Vendor’s Understanding of the RFP
In responding to this RFP, the vendor fully accepts the responsibility to understand the RFP in its entirety, and
in detail, including making any inquiries to Insert Enterprise Name Here as necessary to gain such
understanding. Insert Enterprise Name Here reserves the right to disqualify any vendor that demonstrates less
than such understanding. Further, Insert Enterprise Name Here reserves the right to determine, at its sole
discretion, whether the vendor has demonstrated such understanding. That right extends to cancellation of
award if award has been made. Such disqualification and/or cancellation shall be at no fault, cost, or liability
whatsoever to Insert Enterprise Name Here.

3.2 Good Faith Statement

All information provided by Insert Enterprise Name Here in this RFP is offered in good faith. Individual items
are subject to change at any time. Insert Enterprise Name Here makes no certification that any item is without
error. Insert Enterprise Name Here is not responsible or liable for any use of the information or for any claims
asserted therefrom.

3.3 Communication
Verbal communication shall not be effective unless formally confirmed in writing by the specified procurement
official in charge of managing this RFP process. In no case shall verbal communication govern over written
communication.

Vendors’ inquiries, questions, and requests for clarification related to this RFP are to be directed in writing to:

Insert Enterprise Name Here

Insert Department Name Here
Insert Address Here
Insert City, State/Province, ZIP/Postal Code Here

Attention: Insert Contact Name Here

Telephone: Insert (Area Code) Phone Number Here
Fax: Insert (Area Code) Fax Number Here
Email: Insert Contact Email Address Here

Applicable terms and conditions herein shall govern communications and inquiries between Insert Enterprise
Name Here and vendors as they relate to this RFP.

Informal Communications shall include, but are not limited to: requests from/to vendors or vendors’
representatives in any capacity, to/from any Insert Enterprise Name Here employee or representative of any
kind or capacity with the exception of Insert Contact Name Here for information, comments, speculation, etc.

Inquiries for clarifications and information that will not require addenda may be submitted verbally to the party
named above at any time.

Formal Communications shall include, but are not limited to:

 Questions concerning this RFP: Questions must be submitted in writing and be received prior to Insert
Date, Time, Time Zone Here.

5
Info-Tech Research Group
  Errors and omissions in this RFP and enhancements: Vendors shall bring to Insert Enterprise Name
Here any discrepancies, errors, or omissions that may exist within this RFP. With respect to this RFP,
vendors shall recommend to Insert Enterprise Name Here any enhancements that might be in the best
interests of Insert Enterprise Name Here. These recommendations must be submitted in writing and be
received prior to Insert Date, Time, Time Zone Here.

 Inquiries about technical interpretations must be submitted in writing and be received prior to Insert
Date, Time, Time Zone Here.

 Inquiries for clarifications/information that will not require addenda may be submitted verbally to the
buyer named above at any time during this process.

 Verbal and/or written presentations and pre-award negations under this RFP.

 Addenda to this RFP.

Addenda: Insert Enterprise Name Here will make a good-faith effort to provide a written response to each
question or request for clarification that requires addenda within Insert Number of Days (#) Here business
days. Indicate how written responses will be addressed.

Example:

All addenda will be posted to our website only.

Insert Site Address or other Form of Communication Here

Example:
[Link]

Insert Enterprise Name Here will not respond to any questions/requests for clarification that require addenda, if
received by Insert Enterprise Name Here after Insert Date, Time, Time Zone Here.

3.4 Proposal Submission

Proposals must be delivered sealed to:

Insert Contact Name Here

Insert Enterprise Name Here

Insert Department Name Here

Insert Address Here

Insert City, State/Province, ZIP/Postal Code Here

Example:

Enterprise Contact Person

Enterprise Full Name
Department
Street Address
City, State, Zip

on or prior to Insert Date, Time, Time Zone Here. Insert Enterprise Name Here shall not accept proposals
received by fax.

6
Info-Tech Research Group
Vendors are to submit Insert Number of Copies (#) Here original copies of proposal marked “Original” and
Insert Number of Copies (#) Here, marked “Copy.” Each original and copy must be individually bound.

3.5 Method of Award

The evaluation of each response to this RFP will be based on its demonstrated competence, compliance,
format, and enterprise. The purpose of this RFP is to identify those suppliers that have the interest, capability,
and financial strength to supply Insert Enterprise Name Here with an IAM system as identified in the Scope of
Work.

Evaluation Criteria:

1. Insert Criterion Here

2. Insert Criterion Here

3. Insert Criterion Here

4. Insert Criterion Here

5. Insert Criterion Here

Example:

1. Capability of vendor to meet or exceed requirements set forth in Scope of Work.

2. Expressed interest in working with [Insert Enterprise Name Here] and ability of vendor to communicate
its vision and capacity for establishing a relationship that addresses current and future needs and
trends in the industry.

3. Affordability of product(s) and support available from the vendor.

4. Financial stability of vendor.

5. Apparent likelihood and desirability of proposed software.

3.6 Selection and Notification

Vendors determined by Insert Enterprise Name Here to possess the capacity to compete for this contract
will be selected to move into the negotiation phase of this process. Written notification will be sent to these
vendors via mail. Those vendors not selected for the negotiation phase will not be notified.

7
Info-Tech Research Group
4 Scope of Work, Specifications & Requirements
Include a detailed list of the business and system requirements. Include a further description for each requirement
(typically, in order of importance or in logical categories with importance ranked), and ask the vendor to describe
how they will fulfill each requirement. Use the list of potential features listed below as a starting point. Add, expand
upon, modify, or delete requirements as needed.

4.1 Product Architecture

1. Deployment

Indicate which of the following deployment modes your solution supports (e.g. as-a-Service, on-premise,
hybrid)

 If your solution is offered as a managed security service, please clarify the terms and costs
associated with the services provided.

2. Functional Requirements

This section should contain a detailed description of the essential characteristics of the product or service.
Identify special or distinctive requirements that differentiate the organization’s needs from other buyers. Avoid
making the specifications unnecessarily specific as this can eliminate viable suppliers.

Example:

 The specific data to be included in a report should be selectable using a menu system. The
system will reject a report request if the requestor does not have access rights to the data.
 The reporting component should offer unique reports tailored to different reviewers (e.g. C-level,
network admins, etc.).

3. Technical Specifications

This section should describe any technical standards or interconnection requirements that the product must
address or skill requirements for technical staff. Make it clear if some technical standards are preferred but not
compulsory.

Example:

 Solution must integrate with and provide SSO for:

o Active Directory
o Kerberos
o PKI, 802.1x
o Office 365 (Exchange, SharePoint, OneDrive) using Azure AD
o Internal ERP using AD auth
o Cloud-based CRM tool, which supports standards-based SSO
o Web-based applications (internal, public-facing, and externally-hosted; both LAMP and
MS/IIS-based)
o Terminal-based applications (Citrix application and desktop virtualization environments)
 Must be able to authenticate against LDAP directories in a multi-domain AD forest
 Must allow for federation

8
Info-Tech Research Group
  Must include self-service password resets
 Must support user management delegation
 Must support workflows for access requests, approvals, and periodic access reviews
 Must alert and allow automated blocking of IDs following repeated failed login attempts across one
or more systems
 Centrally-managed MFA capabilities for the following use cases:
o Remote LAN access for 500 remote/mobile users (via VPN)
o Cloud service access from off LAN for 500 remote/mobile users
o On-LAN access to sensitive systems by 50 IT staff and 50 power users

4. Engagement Methodology

This section should identify any special requirements for how and where the vendor is to carry out work, key
responsibilities of the vendor, and any special terms and conditions that are to be included in the contract but
are not covered in Section 7, Additional Terms and Conditions.

Example:

 Supplier will provide a business analyst and/or consultants to aid in the requirements gathering
and guide us into the configuration, installation of, and general transfer of knowledge for the
solution.
 The vendor staff will work at our development center at [insert address here]. The purchaser can,
at its convenience, terminate the development contract with one month’s notice.
 All installation work must be conducted after hours or on weekends (specify).

4.2 Product Features

1. Basic Features
 Indicate whether your solution supports the following capabilities and describe your specific capability
in that area:
o Provisioning
o Deprovisioning
o Password Management
o Single Sign-On (SSO)
o User Activity Monitoring & Reporting

2. Additional Features for Consideration

 Indicate whether your solution supports the following capabilities and describe your specific capability
in that area, and whether it is part of the overall IAM product or an additional license/product that
integrates with the main product:

o Advanced password management (e.g. solutions allows for challenge/response as part of self-
service password reset)
o Privileged access management (PAM)
o Multi-factor authentication (MFA)
o Identity governance
o Mobility support
o Web/cloud SSO
o Advanced provisioning (e.g. solution supports role-based access control)
9
Info-Tech Research Group
 4.3 Product Support
Describe how you work with clients to deliver services and/or products.

1. Customer support
 Do you provide toll-free customer support 24 hours a day, seven days a week? Please specify all
paid and unpaid support options.

2. Geographic and language support

 Do you provide support in specify location (e.g. North America, EMEA, APAC, and Latin America)
and specify language (e.g. English, Spanish, Mandarin)?

3. User manuals
 Do you provide a complete set of user manuals (either in hardcopy, softcopy, or via a searchable
software interface) for all software applications to document and explain system features and
functions?

4. Implementation support
 Do you provide complete turnkey, onsite implementation, and project management support?
Please specify which support will be included and which is provided for an additional fee. Also
specify whether support is available direct from the vendor or provided through a partner.

5. Training
 Describe the type of training provided to administrators. Specify whether training is available direct
from the vendor or provided through a partner.

6. Software updates
 Do you provide future software releases and updates to all applications as part of regular software
maintenance fees?
 For on-premise solutions, please specify the software update process and typical time between
releases.
 For off-premise and appliance solutions, please specify the standard update cycle.

7. Performance monitoring (if applicable)

 Do you provide remote software monitoring to identify anomalies and provide automatic upgrades?

5 Vendor Qualifications & References

All vendors must provide the following information in order for their proposal to be considered:

Example:

1. A brief outline of the vendor company and services offered, including:

 Full legal name of the company.

 Year business was established.
 Number of people currently employed.

10
Info-Tech Research Group
  Income statement and balance sheet for each of the two most recently completed fiscal years
certified by a public accountant.

2. An outline of the product line-up it currently supports.

3. A description of its geographic reach and market penetration.

4. An outline of its partnerships and relationships to date.

5. An outline of its current and future strategies in the marketplace.

6. Information on current software clients, including:

 Total number of current clients.

 A list of clients with similar needs using the same software.
 Evidence of successful completion of a project of a similar size and complexity.

7. References: Contact information for 3 references (if possible) from projects similar in size, application, and
scope, and a brief description of their implementation.

6 Budget & Estimated Pricing

Insert Enterprise Name Here has a total budget of Insert Total Budget Figure & Currency Type Here for this
project.

All vendors must fill out the following cost breakdown for the implementation of the IAM system for Insert
Enterprise Name Here’s project as described in this RFP. Costs should be identified as either capital or non-capital
in nature. The vendor must agree to keep these prices valid for Insert Number of Days (#) Here days as of Insert
Date, Time, and Time Zone Here.

6.1 Deployment Models

The following pricing sheets are to be used as a guide for your response. Please indicate the types of
pricing/installation models offered by your company by placing an “X” under the “Available” column. If a model is
not offered, please indicate this by placing an “X” under the “Not Offered” column.

Deployment Models Available Not Offered

On-Premise Model – Perpetual License
On-Premise Model – Annual License
Software-as-a-Service
Other (please specify)

6.2 Price Schedules

For all deployment models checked above, provide a comprehensive price sheet including maintenance and
support.

11
Info-Tech Research Group
7 Vendor Certification
This certification attests to the vendor’s awareness and agreement to the content of this RFP and all
accompanying calendar schedules and provisions contained herein.

The vendor must ensure that the following certificate is duly completed and correctly executed by an authorized
officer of its company.

This proposal is submitted in response to Request for Proposal for an Identity and Access Management System
issued by Insert Enterprise Name Here. The undersigned is a duly authorized officer, and hereby certifies that:

(Vendor Name)

agrees to be bound by the content of this proposal and agrees to comply with the terms, conditions, and provisions
of the referenced RFP and any addenda thereto in the event of an award. Exceptions are to be noted as stated in
the RFP. The proposal shall remain in effect for a period of Insert Number of Days (#) Here calendar days as of the
Due Date of the RFP.

The undersigned further certify that their firm (check one):

IS

IS NOT

currently debarred, suspended, or proposed for debarment by any federal entity. The undersigned agree to notify
Insert Enterprise Name Here of any change in this status, should one occur, until such time as an award has been
made under this procurement action.

12
Info-Tech Research Group
Person(s) authorized to negotiate on behalf of this firm for the purposes of this RFP are:

Name: Title:

Signature: Date:

Name: Title:

Signature: Date:

Signature of Authorized Officer:

Name: Title:

Signature: Date:

_____________________________________________________

For acceptable use of this template, refer to Info-Tech's Terms of Use. These documents are intended to supply
general information only, not specific professional or personal advice, and are not intended to be used as a
substitute for any kind of professional advice. Use this document either in whole or in part as a basis and guide for
document creation. To customize this document with corporate marks and titles, simply replace the Info-Tech
information in the Header and Footer fields of this document.

13
Info-Tech Research Group