Identitets- och behörighetshantering

The contract timeline is planned from 2026-10-15 to 2038-10-14, totaling 12 years.

Key milestones and phases include:

• The contract is divided into two main parts.
• First part (Migration): This involves migrating from the current solution to the new one with existing functionalities. This phase must be completed within 12 months from the contract start date.
• Second part (Development): This phase begins after the migration is approved for delivery. The development project concludes when all functionalities, in line with SKR's recommendations for Identity and Access Management, are in live operation and the supplier has received delivery approval.
• The implementation plans are required to have clearly defined milestones linked to a timetable, which will be established in consultation with UM. UM must also provide written approval for the achievement of these milestones.

The core scope of work for this tender encompasses functions for both Identity and Access Management (IAM) and Identity Governance and Administration (IGA) within a single system. The included components are an identity database/catalog for e-identities, lifecycle management of identities and accounts, provisioning and deprovisioning to connected systems, an authorization catalog for ordering, attestation and review of authorizations, as well as reporting, logging, and traceability. The scope also includes the implementation and migration from the existing Microsoft Identity Manager (MIM) solution, along with documentation and knowledge transfer.

The statement of work summary outlines the background, purpose, and goals. The current identity and access management solution is based on Microsoft Identity Manager (MIM). The purpose of this tender is to replace the existing MIM-based solution, ensure that the correct identity has the correct access to the correct resource at the correct time, and automate the lifecycle (onboarding, changes, offboarding) for identities, accounts, and authorizations. It also aims to enable governance, traceability, auditing, and regulatory compliance (e.g., GDPR and security requirements), and to provide an ordering portal (authorization catalog) for managing identities and service accounts. The overall goal is to achieve a cohesive and auditable management of e-identities, accounts, and authorizations in accordance with the "Recommendations-identitets-och-behorighetshantering-version-1.1.pdf" developed by SKR, Adda, and Inera.

Regarding deliverables, the project is divided into two parts:

1. Migration: The first part involves migrating from the current solution to the offered solution, incorporating the functions of the current system. This phase must be completed within 12 months from the contract start.

2. Development: The second part, which begins after the migration is approved, involves development to ensure all functionality aligns with SKR's recommendations for Identity and Access Management and is in live operation, followed by delivery approval.

The deliverables also include updated user and system documentation at the time of delivery, provided in Swedish or English. Training for UM's technicians, who work with identity and access management, is required during system implementation to ensure they are self-sufficient. Additionally, the supplier must offer e-learning/web training/videos for users and system leaders/managers, and provide digital guidance/manuals throughout the contract period.