Objectives

The primary objective of this tender is to procure a secure, cost-effective, and scalable Privileged Access Management (PAM) solution to replace the existing CyberArk PAM platform. The solution aims to enhance privileged access control, support audit and compliance requirements, and align with industry best practices over a 12-month period.

Scope

The scope includes:

• Supply of the PAM solution, including licenses for 12 months.
• Implementation and configuration of the PAM platform within SACAA’s hybrid ICT environment.
• Support services for the duration of 12 months.
• Transition from the current CyberArk PAM platform to the new solution.

The environment encompasses on-premises infrastructure, cloud-based systems (e.g., Microsoft 365, Azure), network devices, critical servers, and business applications. The solution must safeguard privileged accounts across these systems, support remote access, and ensure compliance with relevant cybersecurity and regulatory standards.

Technical Requirements

The proposed PAM solution must meet the following technical specifications:

• Connectivity & Access: Support remote access via outbound exceptions, Jump Technology for segmented networks, web-based brokered access, secure tunneling with native tools, Jump Clients, Jumpoints, and HTML5 browser access.
• Identity & Authentication: Integration with SAML 2.0 / OIDC, support for Virtual Smart Card authentication, and JIT provisioning.
• Credential Management: Integrated vault for credential storage and rotation, automated credential injection, and automatic rotation post-session.
• Session Control: Application-specific access, command filtering, screen sharing, and instant session termination capabilities.
• Database Security: Protocol proxying for SQL databases, query logging, and data masking during sessions.
• Auditing & Forensics: Tamper-proof session recording, keystroke logging, forensic search, real-time auditing, and file transfer controls with logging.
• Integration & API: Native integration with ITSM platforms (ServiceNow, Jira), real-time SIEM event streaming, and comprehensive REST API for automation.
• Scalability & Deployment: Support for 1,000+ concurrent sessions, deployment of localized Jump Zones, and least privilege permissions based on Jump Items.
• Security & Hardening: Use of a hardened OS, support for "Clean Room" access, third-party vendor invitations, offline access, and licensing for privileged remote access per user.

Skills Requirements

The bidder must demonstrate:

• Experience in implementing Privileged Access Management solutions, specifically with proven expertise in PAM platforms such as CyberArk or equivalent.
• Certified Implementation Engineer credentials for Privileged Remote Access and Password Safe (or equivalent certifications).
• Capability to support the deployment and configuration of the PAM solution in a hybrid ICT environment.
• Ability to provide remote health checks, support, and troubleshooting services.
• Proven track record of supporting large-scale deployments with at least 1,000 concurrent sessions.
• Knowledge of integration with ITSM and SIEM platforms, and experience with REST API automation.
• Understanding of security hardening practices and compliance standards relevant to privileged access management.