baselineRFIWhich identity domains does the platform cover natively — workforce SSO/MFA, customer IAM (CIAM), privileged access (PAM), identity governance (IGA), and machine/non-human identity — and which require separate products?weight 3
Answer key — what a strong answer shows
Strong answers map each domain to native vs a separate SKU and clarify whether it is one platform or a suite of acquired products sharing a brand. Probe where breadth comes at the cost of depth.
Sources: okta.com · cyberark.com · sailpoint.com
baselineRFIWhat authentication methods are supported (passwordless, passkeys/FIDO2, adaptive/risk-based MFA, biometrics), and how is phishing-resistant authentication enforced?weight 3
Answer key — what a strong answer shows
Look for passkeys/FIDO2 and adaptive MFA with explicit phishing-resistance, plus policy controls. Distinguish supported-but-optional from enforced-by-policy.
Sources: okta.com · pingidentity.com · transmitsecurity.com
baselineRFPDescribe automated joiner-mover-leaver lifecycle and provisioning/deprovisioning across applications: how many connectors, and which standards (SCIM, SAML, OIDC) are supported?weight 3
Answer key — what a strong answer shows
Evidence-backed answers quantify connector coverage, state SCIM/SAML/OIDC support, and show real deprovisioning (not just create). Probe handling of apps without standard connectors.
Sources: sailpoint.com · okta.com · saviynt.com
baselineRFIWhat identity governance capabilities are included (access certifications, separation-of-duties policy, access requests, risk analytics), and are they native or add-on?weight 3
Answer key — what a strong answer shows
Strong answers detail certification campaigns, SoD/policy enforcement, self-service requests, and risk analytics, and state clearly which are native vs licensed add-ons.
Sources: sailpoint.com · saviynt.com
baselineRFIHow does the platform secure privileged access — credential vaulting, session management/recording, just-in-time access, and secrets — and across which target systems?weight 3
Answer key — what a strong answer shows
Look for vaulting, session isolation/recording, JIT elevation, and secrets management, with explicit target coverage (servers, cloud, DBs, SaaS). Note what is agent-based vs agentless.
Sources: cyberark.com · saviynt.com
baselineRFIDoes the platform detect identity threats and excessive entitlements (ITDR, CIEM, identity security posture), and is that detection native or delivered via integration?weight 3
Answer key — what a strong answer shows
Strong answers clarify whether ITDR/CIEM/ISPM are native modules or integrations, what signals they use, and how findings drive remediation.
Sources: cyberark.com · sailpoint.com · saviynt.com
baselineRFPDetail deployment options (SaaS / self-hosted), standards support (SAML/OIDC/SCIM/FIDO2), directory integrations, and API extensibility, with reference architectures.weight 3
Answer key — what a strong answer shows
Prefer answers with concrete deployment models, a standards matrix, directory integrations (AD/LDAP/cloud), and documented APIs/SDKs — not just 'standards-based' claims.
Sources: pingidentity.com · okta.com · transmitsecurity.com
baselineRFPProvide availability SLAs, scale figures, and migration tooling/effort from an incumbent identity provider, citing customer-validated references.weight 3
Answer key — what a strong answer shows
Prefer published SLAs, real scale numbers, and concrete migration tooling with customer references over marketing claims. Probe coexistence during phased migration.
Sources: okta.com · pingidentity.com · cyberark.com
baselineRFIHow does the platform discover and govern machine/non-human identities (service accounts, API keys, workload identities) separately from human users, and what proportion of a typical customer's identity estate turns out to be non-human?weight 3
Answer key — what a strong answer shows
Strong answers show dedicated non-human identity discovery/governance and cite a real proportion figure from customer data — machine identities are frequently the larger, under-governed population.
baselineRFPDescribe session security beyond initial authentication — continuous/risk-based re-authentication, session hijacking detection, and automatic session revocation on anomalous behavior — and quantify detection latency with a customer reference.weight 3
Answer key — what a strong answer shows
Look for continuous post-login risk evaluation (not just MFA at sign-in) and a real detection-latency figure, not a marketing claim of 'real-time.'
baselineRFIWhat is the incident response process and SLA if the identity platform itself has an outage or is compromised, given that an IdP failure can lock out an entire workforce — is there a documented break-glass procedure?weight 3
Answer key — what a strong answer shows
A vendor without a clear, tested break-glass/emergency-access procedure is a serious operational risk, since IdP downtime is total-lockout-severity, not a minor outage.
baselineRFPDetail support for B2B/partner identity federation — external partner access without provisioning full accounts, cross-organization SSO, and how partner access is time-bounded or automatically expired.weight 3
Answer key — what a strong answer shows
Strong answers describe genuine federation (not just guest accounts in the primary directory) with automatic expiry, reducing stale partner-access risk.
baselineRFIWhat is the actual migration path and typical timeline from a legacy on-prem directory (e.g., Active Directory) to this platform, including hybrid coexistence support during the transition, with a customer-validated timeline.weight 3
Answer key — what a strong answer shows
Look for a concrete hybrid-coexistence period and a real customer migration timeline; vendors who describe migration only in the abstract likely underestimate real-world complexity.
baselineRFIHow does the platform detect and respond to credential-stuffing or password-spray attacks in real time, and what automated response (rate-limiting, step-up auth, account lock) triggers without requiring manual SOC intervention?weight 3
Answer key — what a strong answer shows
Strong answers describe automatic, real-time mitigation; a platform requiring a human analyst to notice and respond to a credential-stuffing wave is materially slower than the attack.
baselineRFPExplain the pricing model across identity domains (SSO/MFA, PAM, IGA, CIAM) — are these bundled or does each require a separate SKU/contract, and what does a typical mid-market customer actually pay per user per month all-in?weight 3
Answer key — what a strong answer shows
Look for real all-in per-user economics; a vendor that can only quote the cheapest module's price while other domains are separate expensive add-ons is misleading on total cost.
baselineRFIWhat developer/API experience is offered for building custom authentication flows outside the standard SSO login (e.g., embedding auth in a customer-facing app), and how mature is the SDK/API documentation and support?weight 3
Answer key — what a strong answer shows
Strong answers point to real SDKs, current documentation, and a support channel for developers, not just admin-console configuration with no programmatic access.
baselineRFPMaintain role-based access control for certain systems to ensure that users only have access to the data and resources necessary for their roles.weight 3
baselineRFPSupport hybrid identity federation with Azure AD and Active Directory.weight 3
baselineRFPImplement granular Role-Based Access Control (RBAC) for administrators, analysts, and auditors.weight 3
baselineRFPOperate under least-privilege principles and use role-based access controls (RBAC) within the agency's tenant, with all access auditable and subject to agency approval.weight 3
baselineRFPRequire Contract Staff to use Multifactor Authentication and maintain strict control of access credentials, immediately removing access for persons no longer authorized.weight 3
baselineRFPMust support role-based access control (RBAC) to restrict SIEM access by role.weight 3
baselineRFPBidder shall ensure that only its authorized employees/representatives access the financial institution's Data, Logs and configurations, and shall be responsible for protecting its network and subnetworks from which remote access is performed against unauthorized access, malware and other threats.weight 3
baselineRFPSolution should provide a UBA dashboard highlighting risky users based on objective composite risk scoring, with organization-defined risk thresholds; solution should collect user data from Directory Services, IAM, VPN, Proxy, O365, and incorporate baseline behavioural models covering data exfiltration, malicious users, illicit behaviour, and compromised credentials.weight 3
baselineRFPProposer must define connectivity/access method for MSSP SOC access to the Sentinel environment adhering to least privilege (Azure Lighthouse delegation generally preferred, dedicated VPN also acceptable), with access following agency-approved least-privilege principles.weight 3
baselineRFPZero Trust Phase 1: Contractor shall complete rollout/operationalization of the Microsoft 365 security suite including Microsoft Intune (device health/UEM), Defender for Endpoint (EDR/XDR), Microsoft Purview (DLP and sensitive data risk assessments), Mobile Access (ZTNA + Intune MAM), and Privileged Access Management (PAM) implementation using platforms including CyberArk, Microsoft Entra PIM, or Okta.weight 3
baselineRFPSupport access to both internal and select external users (external contractors with restricted/limited access), supporting a user population of approximately 200 once fully scaled.weight 3
baselineRFPEnable unique role-based permissions controlling access/authorization to both content and tool functionality.weight 3
baselineRFPIntegrate with the organization's OKTA Identity and Access Management/MFA software for user authentication and provisioning, and provide MFA capabilities.weight 3
baselineRFPSupport Single Sign On (SSO) capability through OKTA by using SAML based authentication, and provide create, update, and deactivate capabilities.weight 3
baselineRFPThe vendor shall work with the organization's Identity Access Manager (and identity management engineers) for configuration of OKTA and MFA with the GRC environment, and ensure that GRC functions properly over user VPN.weight 3
baselineRFPContractor shall ensure the ISSM approves user access privileges and that user access is validated periodically (at least quarterly) in coordination with the IAM team, ensure separation of duties is enforced through technical mechanisms, and ensure unused or inactive accounts are reviewed and deactivated monthly.weight 3
baselineRFPDemonstrate strong familiarity with IAM challenges specific to higher education institutions and the current and future technologies that may be appropriate for the demands identified.weight 3
baselineRFPHave strong experience and expertise with cloud-based IAM.weight 3
baselineRFPBe familiar with compliance regulations that pertain to data collection, data storage, data governance, and data accessibility regarding students, employees, and non-affiliated users in the university's systems.weight 3
baselineRFPHave expertise with pertinent technologies in scope for Access Management, such as Oracle, Banner, Microsoft Active Directory, Microsoft Office 365, Microsoft Exchange, Microsoft Teams, Duo Security, Salesforce and ServiceNow.weight 3
baselineRFPHave a minimum of three years' experience as a strategic partner or Managed Service Provider for IAM implementations with large institutions and systems of Higher Education.weight 3
baselineRFPProvide a resilient, high availability SSO system with little to no on-premise dependencies, with SSO IDP full participation in InCommon/EduGain federations.weight 3
baselineRFPDevelop understanding of the university's current IAM data flows and procedures; develop a migration plan for existing users, connectors and SSO relying parties; migrate existing users and connectors from the existing system with no substantial downtime.weight 3
baselineRFPProvide training for system administration, operation and any maintenance that the university may be required to perform.weight 3
baselineRFPProvide Access Management: SSO (SAML/CAS/Oauth), MFA integration with DUO Security, modern self-service password reset, access auditing and attestation/recertification, and federated identity including native support for InCommon federation.weight 3
baselineRFPProvide Identity Governance and Administration: complete identity lifecycle management, account/service provisioning and deprovisioning occurring in real-time or near real-time, new account claiming, self-service access requests, automated/self-service group management, ability to handle large changes in identity population efficiently, ability to accommodate multiple concurrent user roles/affiliations, and role-based provisioning/entitlement.weight 3
baselineRFPHosted or IAAS solutions shall deliver an SLA of 99.99% uptime.weight 3
baselineRFPProvide free on-demand and customizable training, and 24/7 customer support to the university's IT staff; detail available tiers of support and associated SLAs/costs.weight 3
baselineRFPDescribe the overall architecture of your solution and its ability to support and integrate with our current environment.weight 3
baselineRFPDemonstrate the operation of your solution. Describe how your product/service scales. What is the largest implementation for your product/service? Does your product/service automatically maintain performance with increased workload?weight 3
baselineRFPIn general, what do you consider to be your top three differentiators from competitors?weight 3
baselineRFPDescribe the end user/administrator training courses or options you offer, addressing location/method of delivery (live on-site, live online, on-demand online) and mentoring of individual end users by role.weight 3
baselineRFPProvide a list of any security certifications you offer or support that is related to your product, and list any third parties authorized to administer the certification.weight 3
baselineRFPDescribe your maintenance/update offerings: what services are included, your normal revision cycle for standard releases/updates, the normal distribution path for standard vs. emergency releases/hot fixes, and documentation provided with standard releases.weight 3
baselineRFPDescribe your support offerings: services included, whether a knowledge base is accessible to end users and system administrators, levels of standard service in terms of category of users supported/response time/hours of availability, on-site support availability, and consulting services on process changes needed to adopt your tools.weight 3
baselineRFPDo you provide any supplemental services in addition to your primary product offering, such as availability of a community platform for interaction with your client base?weight 3
baselineRFPProvide overall statement of revenue with breakdown of percent attributable to IAM product(s) vs. percent attributable to IAM services.weight 3
baselineRFPProvide the total number of years in business, with specific detail on the number of years providing IAM product(s) and the number of years providing IAM services.weight 3
baselineRFPDescribe your IAM customer base: number of customers, number of user licenses, and industries served (products); number of customers, number of websites tested via the service, and websites tested per client (services).weight 3
baselineRFPIndicate your industry involvement, including membership(s) in industry organizations, participation in standards bodies and participation in the threat intelligence community, and provide a list of your solution partners.weight 3
baselineRFPDo you work with regional partners/value-added resellers that can provide implementation support for your solution? If so, please provide your list.weight 3
baselineRFPDo you provide a community exchange for your customers? If so, describe your community platform, detailing how customers can interact, with whom, and what content/training materials are available.weight 3
baselineRFPWhat is your perception of market direction, and how does this affect your technology road map? Describe your anticipation of industry/customer trends and your approach to ensure your solution can adapt and improve while continuing to provide value to an existing customer base.weight 3
baselineRFPProvide a catalog of all items, including hardware, software and support services included in your solution, with a description of each item, whether it is optional, and its associated list price.weight 3
baselineRFPDescribe your pricing/licensing model for enterprise solutions, including any discount tiers and limitations to your enterprise pricing; describe how each product is licensed (per user, per application, per authentication, etc.).weight 3
baselineRFPFor SaaS solutions, describe how you price the service — by size of application, contract period, or pricing tiers for lightweight fully automated tests versus more complex testing requiring manual intervention. Do you provide penetration testing (which includes testing outside of the application under test)?weight 3
baselineRFPDescribe any standard discounting that you provide, such as GSA or educational discounts.weight 3
baselineRFPProvide a copy of your standard contract, together with your typical SLA for availability or quality of customer service, or product capabilities.weight 3
baselineRFPProvide a list of at least five (5) references where the Offeror has provided the services described in the RFP, preferably higher-education institutions of similar size, scope and complexity to the university.weight 3
baselineRFPProvide a brief description of your product or service (Data Security Vendor Questionnaire).weight 3
baselineRFPDescribe your on-line help.weight 3
baselineRFPWhat is the procedure for handling customer requests for application modifications?weight 3
baselineRFPHow often is the application modified and how do you notify your customers of an upcoming modification?weight 3
baselineRFPDoes your application allow the customer to export application data into a standard format such as Excel?weight 3
baselineRFPWhat is your application/service available uptime? What is your scheduled maintenance window?weight 3
baselineRFPHow do you scale your system during peak usage?weight 3
baselineRFPWhat kind of authentication and access control procedures are in place?weight 3
baselineRFPHow do you secure user IDs and access credentials?weight 3
baselineRFPDo you support SSO and if so, which standards?weight 3
baselineRFPDo you have a Voluntary Product Accessibility Template (VPAT) completed? If so, please upload a copy with this questionnaire.weight 3
baselineRFPWhat has your company done to evaluate the accessibility of your product in accordance with either Section 508 of the Rehabilitation Act or WCAG 2.0 accessibility guidelines?weight 3
baselineRFPDo you know of any problems or have you received any complaints regarding the accessibility of your product? Please explain.weight 3
baselineRFPHas your product been evaluated using screen reading or voice recognition technology?weight 3
baselineRFPCan your product be navigated by using the keyboard only?weight 3
baselineRFPIf accessibility for users with disabilities has not been implemented, when is your company planning to incorporate accessibility into the product, and to what extent are you willing to work with the university to improve your product's accessibility?weight 3
baselineRFPHow many years has your firm been continuously active in delivery of IAM solutions?weight 3
baselineRFPHow many Higher Education IAM solutions has your firm delivered? Do you have experience with Higher Education institutions in Canada?weight 3
baselineRFPWill you use 3rd party (external to your firm) resources for development/delivery of your proposed solution?weight 3
baselineRFPHow large is your IAM practice in terms of revenue and FTE? What % of your overall firm's revenue does this represent?weight 3
baselineRFPFor the proposed Project Manager and Technical Lead: total years of experience in the proposed role and in the IAM discipline, how long the individual has been employed at your organization, and how many similar projects the individual has performed.weight 3
baselineRFPThe Offeror must provide their proposed license, maintenance and service agreements that may become part of the contract.weight 3
baselineRFPIdentity and Entitlement Repositories: Design and establish data repositories for identity and entitlements, drawing from each source system to establish a centralized identity repository for the university.weight 3
baselineRFPAccount Administration: Implement account administration services that allow the management of identities, roles, and access within the IAM systems.weight 3
baselineRFPIAM Workflow Management: Implement workflow management that allows the definition and automation of business rules for the approval of requests along with provisioning, change, and deprovisioning of identities, accounts, and access.weight 3
baselineRFPCoarse-Grained Access Management: Provide the ability to manage provisioning, change, and deprovisioning of access to downstream systems by managing accounts and basic privileges in the systems.weight 3
baselineRFPAccess Reviews and Certification (Basic): Provide the ability to generate regularly recurring and on-demand reports to review and certify access, ensuring that only authorized access has been provided.weight 3
baselineRFPRegistration Services: Provide the ability to register and proof new identities within the IAM system.weight 3
baselineRFPSelf-Service: Provide the ability for end users to manage their own identities and access, including claiming accounts, resetting passwords, managing challenge/response questions, requesting new services, and updating select identity attributes.weight 3
baselineRFPTransition Services and Decommission Legacy System: Transition from the current IAM system (Oracle Waveset) to the new IAM system, ensuring continuity of services, and decommission the existing IAM system.weight 3
baselineRFPFederation: Provide internal enterprise single sign-on capabilities, including federated sign-on with third-party systems, and external federation bestowing access to identified users via InCommon, Canadian Access Federation (Canarie), eduGAIN, or another university/government body.weight 3
baselineRFPPhase 2 roadmap: solution should support Role Mining, Fine-Grained Access Control, SIEM/DLP integration, integration with the Cherwell service management tool, Multi-Factor Authentication, advanced Access Review and Certification, and Privileged User Management.weight 3
baselineRFPThe Offeror must identify at least one (1) past or current end user currently using a similar solution/system, willing to conduct a live Client Illustration of installed and operational system functionality (approximately one hour).weight 3
baselineRFPProvide additional information on the configuration/capacity requirements for any major hardware components.weight 3
baselineRFPCentralized identity repository supports multiple concurrent identity-related roles and affiliations and stores both current and historical data.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
