Identity and Access Management

ABOUT FCC FCC is Canada’s leading agriculture and food lender, dedicated to the industry that feeds the world. FCC employees are committed to the long-standing success of those who produce and process Canadian food by providing flexible financing, AgExpert business management software, information and knowledge. FCC provides a complement of expertise and services designed to support the complex and evolving needs of food businesses. As a financial Crown corporation, FCC is a stable partner that reinvests profits back into the industry and communities it serves. For more information, visit fcc.ca. RFP CONTACT Ronke Niagwan Procurement Manager Farm Credit Canada procurement@fcc.ca RFP SCOPE FCC is a cloud centric organization that uses a diverse set of systems to support various business initiatives. Secure access to these systems, efficient management of identities’ access, and well-defined governance is critical for continued resiliency. Recognizing that threats are increasingly targeting identities, FCC has strategic objectives to strengthen its identity access management (IAM) posture and has prioritized that initiative. FCC currently uses several IAM products but is looking to streamline, consolidate, and optimize identity access management of its internal personnel by acquiring a holistic solution to manage and govern identities and access. FCC has a dedicated IAM team that manages day-to-day identity and role-based access activities and develops and maintains automations to minimize manual effort. The automations have been developed over several years and span various scripting and automation technologies. The holistic solution will replace the automations that have been developed using its robust automation and workflow capabilities. The IAM team has also developed an extensive, but primitive RBAC database. The solution will replace the primitive artifacts and processes with native and robust RBAC capabilities. FCC currently uses Microsoft products for identity provider (IdP) capabilities and the holistic solution will include various governance and identity access centralization, administration, and automation capabilities, and will include a robust and maintainable integration between the IdP and the novel platform. The novel platform will also integrate with the upstream HR system, which is the identity source of truth, and will efficiently broker identity and access management to downstream target systems. Additionally, the platform will integrate and work with FCC’s privileged access management (PAM) platform to manage and govern privileged access. FCC regularly conducts access reviews of its systems using a legacy identity access governance platform and intends for the holistic solution to replace the system and assume access review responsibilities. The expectation is that the solution will be able to provide access review capabilities for the systems already in scope and expand to more systems in the future. Customer identity and access management (CIAM) and decentralized identity management are not within the targeted scope of this requisition. A successful requisition will result in the implementation of the first phase of an IAM solution (base platform implementation and core integrations) and a strategy for rolling out remaining phases of the solution’s capabilities (subsequent platform enhancements and target system integrations). FCC has roughly 2500 users that operate in a hybrid model of remote work and working at FCC locations across Canada. FCC’s corporate office is in Regina, Saskatchewan, Canada with field offices located across the country. The holistic IAM solution MUST include the following high-level capabilities: Integration with upstream and downstream systems for identity access management Identity data synchronization Identity and access management administration frontend Identity lifecycle management Robust identity-related workflow engine, framework, and templates End user self-service Notifications and alerting Access delegation and proxying Role management, role-based access control, and attribute-based access control Authentication management and governance Access review/certification Segregation of duty management Audit and logging Reporting FCC’s goal is to procure an IAM tool and Implementation services from one proponent; however, FCC may split the award between multiple Proponents. FCC reserves the right to award the RFP scope of services to one or multiple proponents (i.e. FCC may award the IAM tool (Licenses) to one proponent and the Implementation Service, or any additional services and deliverables deemed necessary to ensure the success of this engagement to another proponent). More details of scope included in the RFP document. RFP PARTICULARS All conditions for Proponent participation are included in the RFP documents. Duration of Contract: included in the RFP. Options: Not applicable. Estimated Quantity of Goods or Services: Not applicable. Timeframe of Delivery of Goods or Services: Not applicable. RFP SCHEDULE RFP Release Date: April 8th, 2024 Proponent Questions Accepted Until: April 16th, 2024 at 2:00 PM* FCC Response to Proponent Questions Delivered Before: April 26th, 2024 at 5:00PM* RFP Closing Date/Time: May 10th, 2024 at 2:00PM* NOTE: All times are CST – Saskatchewan. The above dates are subject to change at the sole discretion of FCC. Any changes to the RFP Schedule will be communicated to all Proponents via amendment on MERX. RFP PROCESS CONSIDERATIONS This opportunity is covered under the provisions of Chapter 5 (Government Procurement) of the Canadian Free Trade Agreement (CFTA) and Chapter 19 (Government Procurement) of the Canada-European Union Comprehensive Economic and Trade Agreement (CETA). FCC is subject to the Official Languages Act (Canada). Proponents may choose to respond to this RFP in their official language of choice (English or French). This opportunity notice references a non-binding, competitive RFP, and is not a call for tenders. FCC is not obligated to proceed with the Work described in the RFP Scope and may cancel the RFP at any time. FCC’s procurement process allows for consecutive or concurrent negotiations between FCC and one (1) or multiple Proponents, prior to awarding a Contract. MERX ELECTRONIC BIDDING SYSTEM This Request for Proposals (RFP), including any attachments and amendments to such RFP, is available for download by the Proponent on MERX. MERX is a Canadian Public Tenders electronic bidding system accessible at https://www.merx.com. It is the sole responsibility of the Proponent to ensure its compatibility with MERX. Proponent proposals MUST be submitted electronically through MERX, preferably in a PDF or MS Word file, prior to the RFP Closing Date/Time specified in the RFP. Proposals submitted in other formats, by other methods or through any other means, or after the RFP Closing Date/Time specified in the RFP, may be rejected by FCC. PRIORITY OF DOCUMENTS In the event there are any discrepancies between this opportunity notice and the information on the MERX website proper, this opportunity notice shall take precedence. Bidding and Documents are available on http://www.merx.com. Fees may apply; See https://www.merx.com/public/pricing for more information.