Basic Information

Reference Number

0000244292

Issuing Organization

Ontario Health

Owner Organization

Ontario Health

Solicitation Type

RFP - Request for Proposal (Formal)

Solicitation Number

RFP2023-004783

Title

Corporate Identity and Access Management Tools

Source ID

PP.HL.CAN.692769.C93114

Details

Location

Canada, Ontario, Toronto

Description

RFP Title - Request for Proposals - Corporate Identity and Access Management Tools
Invitation to Proponents

This Request for Proposals (this "RFP") is issued by Ontario Health as an invitation to prospective proponents to submit proposals for the provision of a Corporate Identity and Access Management solution for employees, temporary staff, contractors and vendors’ personnel working at Ontario Health, collectively referred to as “Users”, who require access to Ontario Health systems and infrastructure. For clarity one (1) User may be assigned multiple accounts. The solution will include the required platform, services and initial configuration (the “Services“), as further described in Part 2 - The Services. This procurement is intended to be a key component of Ontario Health’s Corporate Identity and Access Management strategy, and may become Ontario Health’s information technology (IT) standard for corporate identity and access management.

As part of the Corporate Identity and Access Management Program, Ontario Health seeks an “as a service” solution that will have the capability to implement the following:

IGA: Control over all human and non-human accounts while providing governance over their lifecycle and associated entitlements. The Identity Governance and Administration (IGA) solution should have the capabilities to automate governance and/or operational processes to maintaining user identity and access. Cataloging, mapping, monitoring, reviewing, and improving these processes are critical to the success of IGA initiatives.
PAM: Provide Privileged Access Management (PAM) services for all the data centres, cloud providers, SaaS platforms and environments to afford greater visibility into, and control over, privileged accounts and entitlements. The PAM solution should have the ability to control the use of privileged human and non-human (system, service, shared, application) accounts; to monitor and record privileged sessions; to permit end users and solution administrators granular, context-driven and time-limited use of superuser privileges; and to automatically randomize and manage passwords for privileged human and non-human accounts (system, service, shared, application) and store them in a secure centralized Vault.
An integrated PAM and IGA platform that allows the sharing of entitlement data across systems. The integrated PAM and IGA platform should seamlessly exist and integrate with OH on-prem environments, cloud environments, and SaaS security tooling, services, and applications.

It is the intent of Ontario Health is to select one (1) supplier for either a single platform or a tightly integrated portfolio of platforms capable of supporting multiple functions and capabilities over a multi-phase 3-5 year roadmap.
This will also eventually allow for the replacement and non-renewal of disparate existing legacy IGA & PAM systems, associated contracts, and costs. It must support and be used across on-prem and cloud-based application/ resources.

Mandatory Requirements

Requirement (Yes / No)
M1Proposed Solution, at a minimum, MUST be SaaS and provide, the following mandatory capabilities for all human and non-human accounts at OH:

Identity Lifecycle Management (ILM)
Identity Governance Administration
Authentication and Authorization
Privileged Access Management

M2Proposed Solution must have the capability to create a Global Identity and associate all human user accounts and human privileged accounts to create a consolidated view of user access (OH accounts, legacy accounts, and privileged accounts).
M3Does the solution proposed integrate with and have Single Sign On (SSO) capabilities?
M4The proponent must have provided a minimum of two years of Software as a Service within the IGA and PAM space to at least two medium to large Canadian provincial/federal public sector organizations.
M5Service/solution must be hosted in Canada (Public Cloud provider is acceptable) and all data including Personal Health Information (PHI) and Personal Information (PI), must be processed, handled, accessed and stored within Canada at all times. All data in transit and at rest must be encrypted at all times. Neither the proponent nor any of it’s contracted Third Parties will provide any services from a location outside of Canada.
M6The SaaS solution must support hybrid infrastructure (cloud and on prem).
M7Confirm that all proponent resources will have Criminal Record & Judicial Matters Check (CRJMC) or equivalent.
M8The proponent hosting the solution must comply with a SOC II Type 2 audit.
The proponent must complete a SOC II Type 2 audit, at a minimum biennially. The report scope must cover the services provided within the proponent’s premise and/or cloud environments. A customer facing report, detailed enough for audit and regulator assurance, must be provided to Ontario Health after each audit at no cost to Ontario Health. The first report must be provided no later than the end of the first OH fiscal year in which services are provided.
M9The proposed solution’s environment must be continuously available on a 24 x 7 x 365 basis. Confirmation and summary of high availability design and tested business continuity plans must be provided.
M10Cryptographic hardware devices must meet or exceed the tamper-resistant enclosure requirements specified in the Federal Information Processing Standards (FIPS) 140-2 Level 3 standard.
M11The solution must support database encryption and digital signature capabilities.

Dates

Publication

2023/03/29 04:58:45 PM EDT

Bid Intent

Not Available

Question Acceptance Deadline

2023/04/12 03:00:00 PM EDT

Questions are submitted online

Closing DateA - Previous Amendment

2023/05/08 03:00:00 PM EDT

Bid Submission Process

Bid Submission Type

Electronic Bid Submission

Envelope 1 - Identity & Proposal

Pricing

No pricing in this envelope

Bid Documents List

Item Name	Description	Mandatory	Limited to 1 file
Bid Documents	Documents defining the proposal	Yes	No
No entries

Envelope 2 - Pricing

Pricing

In attached document

Bid Documents List

Item Name	Description	Mandatory	Limited to 1 file
Bid Documents	Documents defining the proposal	Yes	No
No entries

© MERX - All rights reserved. No part of the information on this Web Site may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise without the prior permission of MERX and the Minister of the participating government department (if applicable). MERX, the Minister nor the Contracting Authority will assume responsibility or liability for the accuracy of the information contained in the publication.