Identity and Access Management (IAM) Solution

The City of Lakeland is issuing this Request for Proposal (RFP) to solicit proposals from qualified vendors for an enterprise Identity and Access Management (IAM) solution.

The City is seeking a solution that can support centralized identity management, authentication, access control, lifecycle management, governance, application integration, and related security capabilities across the organization. The solution should support approximately 2,500 workforce identities and provide a scalable platform that can meet current operational needs while supporting future growth and evolving security requirements.

The budgetary estimate for this project is **$150,000**. Vendors should provide clearly itemized first-year implementation and licensing costs, annual recurring licensing and support costs, and any additional or optional fees.

Vendors must explicitly indicate Yes or No for each requirement in Sections 2.1 through 2.5. Any "No" response must include an explanation of limitations or alternative solutions. For "Yes" responses, vendors must identify any additional products, licensing, third-party integrations, or custom development required to meet the requirement.

Vendors must clearly distinguish between capabilities included in the proposed solution and those requiring additional costs or services.

**Identity and Access Management.** At a minimum, the proposed solution must:

• Support approximately 2,500 workforce identities.
• Provide Single Sign-On for in-scope applications and support SAML 2.0 and OIDC.
• Support Single Sign-On (SSO) and Multi-Factor Authentication (MFA) for legacy on-premises Oracle PeopleSoft and eBusiness Suite applications that do not natively support modern federation protocols such as SAML 2.0 or OIDC.
• Support adaptive/risk-based multifactor authentication and phishing-resistant authentication using standards such as FIDO2/WebAuthn.
• Provide centralized directory services capable of synchronizing with the City's on-premises Active Directory environment.
• Integrate with the City's HR system of record to automate Joiner-Mover-Leaver processes, including provisioning, modification, and deprovisioning of access.
• Support role-based and delegated administration.

**Integrations and Technical Requirements.** At a minimum, the proposed solution must:

• Provide supported integration with Oracle PeopleSoft HRMS for identity lifecycle events, including provisioning, deprovisioning, and attribute synchronization.
• Integrate with Active Directory, Microsoft 365, endpoint/device management platforms, and the City's SIEM as applicable.
• Provide documented REST APIs for user, group, and identity-event management.

**Security and Compliance.** At a minimum, the proposed solution must:

• Support Conditional Access and access decisions based on identity, device state, location, and risk.
• Provide comprehensive audit logging for administrative and authentication activity with a minimum 12-month retention capability.
• Provide the technical identity, authentication, access-control, auditing, encryption, and integration capabilities necessary to support applicable CJIS Security Policy requirements for Public Safety and Criminal Justice Information use cases.

**Implementation, Migration, Training, and Support.** At a minimum, the vendor must:

• Provide a phased, application-by-application migration approach that allows systems to transition incrementally rather than requiring a single cutover.
• Provide hands-on implementation assistance, including project management, solution configuration, integration, testing, deployment, and coordination with City staff and applicable third parties to support successful setup and go-live.
• Provide documented 24x7 support for critical production incidents with a P1 response time of no more than one hour.

**Submission:** Proposals are **required** to be submitted electronically through the Portal (OpenGov, the City's e-Procurement Portal) until **3:30 pm, Monday, November 16, 2026**. Proposals received after this specified time and date will not be considered.

Questions must be in writing and submitted electronically via the Portal through the Question and Answer tab before **5:00 pm on Monday, November 9, 2026**.

**Required uploads:** *W-9*, Florida Division of Corporations (Sunbiz) registration, *Hold Harmless/Indemnification Agreement* (signed and notarized), and *Human Trafficking Affidavit* (signed and notarized).

**Insurance:** The Contractor shall, within ten (10) days of notification of award and prior to commencement of work, take out and maintain in full force and effect minimum insurance coverage as specified in the attached requirements. A certificate of existing insurance coverage should be submitted with the proposal as proof of insurability.

**Selection criteria:** Core IAM Functionality & Lifecycle Management, 25 points; Technical Architecture & Integration, 20 points; Security, Governance & Compliance, 20 points. [...] Depending on the results of the Phase 1 evaluation, the City may invite a limited number of top-ranked vendors to participate in a Phase 2 evaluation.