REQ000052 For The Provision of IAM Implementation Partner Services

⁠⁠⁠Overview

The Australian Prudential Regulation Authority (APRA) is seeking responses from suitably qualified and experienced implementation partners to deliver an Identity and Access Management (IAM) solution that supports APRA's identity security, access governance and regulatory compliance objectives.

About

Following a market assessment process, APRA has shortlisted SailPoint Technologies (Identity Security Cloud) and Saviynt Enterprise Identity Management as the candidate platforms for implementation. Suppliers may submit a proposal for one or both platforms; however, APRA intends to appoint a single implementation partner to implement one selected IAM platform.

APRA is conducting a separate RFQ process for the procurement of the IAM software licences, which is currently underway in the market. The outcome of that procurement will determine the IAM platform to be implemented. Accordingly, this RFQ seeks to establish APRA's preferred implementation partner capable of delivering SailPoint, Saviynt, or both shortlisted platforms, with APRA ultimately selecting one platform and one implementation partner to deliver a single end-to-end IAM solution.

In the current state, APRA uses Microsoft Identity Manager (MIM) as its primary identity management platform for user account provisioning and lifecycle management. MIM integrates with several enterprise systems, including Oracle HCM, which serves as the authoritative source of workforce data, and Microsoft Active Directory (AD).

APRA also utilises ServiceNow (internally referred to as SHOP) as its access request and fulfilment platform. Staff submit access requests through SHOP, which initiates the relevant approval workflows. Following approval, access requests are either provisioned automatically or, in most cases, fulfilled manually by APRA's Service Desk team.

Purpose

As part of this project, APRA intends to replace MIM with a modern Identity and Access Management (IAM) platform. The future-state IAM solution is expected to increase automation, streamline access management processes and reduce manual fulfilment activities.

Objectives

APRA is focused on achieving the following key benefits from implementing the IAM solution:

• Enhanced security: reduces unauthorised access by enforcing least-privilege and role-based access controls
• Automated joiner-mover-leaver processes: automatically provisions and removes access as employees join, move or leave the organisation
• Increased operational efficiency: automates access requests, approvals and provisioning workflows, reducing manual effort
• Faster employee onboarding: provides users with timely access to required systems and applications from day one
• Enterprise-wide visibility: delivers a single view of user identities, roles and entitlements across the organisation
• Reduced access risk: detects and remediates orphaned accounts, excessive privileges and SoD violations
• Stronger access governance: enables regular access reviews and certification campaigns to ensure appropriate access
• Improved compliance: supports regulatory and audit requirements through consistent access governance and reporting
• Comprehensive audit trail: maintains complete records of access requests, approvals, changes, and user activities

Scope

The scope includes:

• Solution implementation of the selected IAM platform (SailPoint Identity Security Cloud or Saviynt Enterprise Identity Management)
• Configuration of the IAM platform
• Integration with APRA's existing systems, including Oracle HCM and Microsoft Active Directory (AD)
• Testing of the implemented solution
• Knowledge transfer to APRA
• Transition of the solution to operational support

Contractor Requirements

• Suitably qualified and experienced as an IAM implementation partner
• Capable of delivering SailPoint Identity Security Cloud, Saviynt Enterprise Identity Management, or both shortlisted platforms