IDM Solution for NCL ICB

Description

Summary of the work There is a need to provide a single authentication solution for the associate organisations of the NCL Integrated Care Board Expected Contract Length 6 months Latest start date Sunday 1 January 2023 Why the Work is Being Done There is a need to provide a single authentication solution for the associate organisations of the NCL Integrated Care Board so that cloud data, software and infrastructure can be accessed natively with local user credentials. This is to bring the organisations in-line with the NHS cloud-first principles and improves access to centrally/jointly developed digital systems. Problem to Be Solved Cloud-based data, applications and systems are being developed by NCL ICB and NHS England which require cloud-based identities. Associate organisations in the ICB are at different levels of technical maturity in the process of moving to such identities. An identity orchestration layer that could interface with these organisations is therefore necessary to provide end-users with access to these critical patient information portals. A proof-of-concept is needed to integrate a small set of organisations technically. A plan for wider roll-out to further organisations would be required alongside this which could be implemented by NCL ICB Who Are the Users As a health and social care worker in an associate organisation of NCL ICB, I need to be able to log in to my local system with locally issued credentials. At this point, I should be able to open ICB-developed websites and portals which will use my local credentials to provide authentication in a near-seamless manner with minimal interaction. I should find that this access is removed and have a simple means to request access when I join the organisations. Early Market Engagement Assessment was carried out to evaluate the existing products on the market. There is no single COTS product that provides this functionality and therefore the need for a consultant-led piece of work was agreed. Multiple hosting platforms for this solution exist but given that: - ICB has a strategic relationship with Microsoft - ICB has existing long-term contracts with Microsoft - Technical cloud capability with ICB IT teams is mainly Microsoft-based this solution is necessarily needing to be hosted in Azure. Other solutions would require major investment in training, re-procurement of cloud infrastructure and a strategic IT change. Work Already Done There is no prior work carried out on this project except for to provision an ICB-wide Azure tenancy which would provide the hosting solution for the solution. Existing Team Work would be carried out with the NCL ICB Digital programme team and associate organisation teams including: - Ben Burch, NCL ICB Data Architect - NCL ICB ICT Team - Royal Free London IT Team You will also need to work with a third party platform provider (Cerner) to create this initial product build. Cerner host a cloud application (HealtheIntent) which is the clinical tool in-scope for this project. Current Phase Alpha Skills & Experience • have worked in the NHS previously on similar tasks • have links with NHS organisations providing support on IDM • have expertise in cloud development • have recent DSPT accreditation • be able to work in an agile manner with complex organisations Nice to Haves • engage with a London-based trust to work through the specific solution • work both remotely and in person where needed for stakeholder meetings Work Location The address where this work shall nominally take place is: North Central London Integrated Care System Laycock PDC Laycock Street London N1 1TH Working Arrangments Given current working arrangements, it is not expected that there will be a need for regular on-site meetings as part of this deliverable. There will be a need for regular project meetings which may take place on MS Teams or in person between the project manager and NCL digital teams. Security Clearance All companies (contracted or subcontracted) working on this project must be subject to BPSS as a minimum and be able to evidence such screening has been carried out in line with the government vetting guidance as per https://www.gov.uk/guidance/united-kingdom-security-vettingreferees-hiring-managers-contractors-and-consultants and any other relevant areas. No. of Suppliers to Evaluate 3 Proposal Criteria • Provide an IDM solution interfacing with Client AAD • Provide an IDM solution able to interface with Federated Active directories on client sites • Provide a solution with a management console • Provide a solution that minimises end-user interaction to sign-in • Require only limited admin access to systems • develop product in line with all relevant ITIL and Project Management principles • deliver product in less than 3 months • ensure product is extensible Cultural Fit Criteria • Work with the NHS understanding current pressures • Share knowledge of the development so client can extend existing work • work with teams that may not have a high level of technical maturity • work as a team with our development leads and IT support leads Payment Approach Fixed price Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers 1. What do you expect the budget to be for this work? circa £70k 2. Can you provide an example of some of the use cases that illustrate that there is no single COTS product that provides the required functionality? This solution should be hosted on our organisational Azure active directory for security and management purposesThis solution should be extensible by us and not limited to specific software vendor lifecycles/developmentThis solution should be developed using standard Azure components as part of the 'Cloud First' drive 3. Would any potential license/subscription fees have a separate budget? What is the estimated number of end users in the associate organisations? License and subscription fees on Azure would not be included as part of the budget of this work. We would pay the hosting fees as part of an existing Microsoft contractEstimated number of users for the proof of concept is in the low hundreds but the solution should be able to extend out to thousands of users where needed 4. Would the ICB consider a SaaS based solution? We would prefer a service hosted on our infrastructure for Information Governance purposes but a strong bid with good controls would be considered 5. (a) Please can you explain the reasons why the requirements specify Azure?(b) Will the authority consider alternative solutions to Azure? How does align with Public Contracts Regulations? (a) We currently have an Azure infrastructure in place with relevant internal/external support capability. Cloud hosting proliferation would increase costs, resource requirements, support need and setup time. (b) We may consider alternatives as long as they provide good value for money and appropriate functionality as specified in the requirements