Objectives

The Electoral Commission seeks to acquire an Identity Governance and Administration (IGA) solution to automate end-to-end user access management across its ICT ecosystem. The primary objectives are to enforce strict access controls, ensure compliance with data privacy legislation (including POPIA and GDPR), and generate auditable reports proving controlled access to sensitive voter and employee records. The solution must also address the operational complexities of managing a highly cyclical workforce during major electoral events, ensuring timely provisioning upon hiring and immediate revocation upon departure.

Scope

The procurement covers the supply, implementation, and three-year support and maintenance of an IGA platform. Professional services required include policy definition and refinement, system integration, migration from legacy environments, and structured change management. The solution must integrate with SAP Authentication, Active Directory, Microsoft Exchange, Microsoft 365, Azure AD (Entra ID), and a custom security layer named Global via REST APIs. Deployment is required for both a production environment and a cold-failover disaster recovery site. The platform will manage identities for permanent staff, consultants, contractors, temporary election personnel, service/system accounts, and external stakeholders such as voters and political party members.

Technical Requirements

• Environment & Scale: Must operate on Windows Server 2022+ and support Windows 11+ client devices. Must accommodate a minimum of 1,500 diverse identities.
• Integrations: Mandatory connectivity to SQL Server, PowerBI, Microsoft Identity Manager, SAP ECC/GRC, Exchange, Active Directory, and Global via REST APIs. The bidder may propose replacing Global or MIM if functionally equivalent.
• Access Governance: Automated provisioning/de-provisioning, periodic access certification/attestation, self-service request portal with workflow approvals, and real-time anomaly detection.
• Security Controls: Enforcement of Segregation of Duties (SoD) and Least Privilege principles. Configuration-driven workflows (no code modifications required). Emergency lockout capability and FortiSIEM API integration.
• Audit & Reporting: Non-repudiable audit trails for all objects, events, and actions. Configurable dashboards, scheduled/ad-hoc reporting, and exportable audit logs.
• Lifecycle Management: Support for job changes, promotions, lateral moves, extended leave, contract expirations, and terminations. Bulk provisioning capabilities for election-related surges. Orphaned account detection and remediation.
• Architecture: Must explicitly design for a production and DR instance. Infrastructure (servers, networks, firewalls) will be provided by the Commission.

Skills Requirements

• Experience: Minimum five years of proven experience in delivering, implementing, and supporting IGA solutions.
• Team Composition: Detailed CVs for senior implementation resources, including product-specific certifications, installation/customization counts, and expertise in policy mapping, change management, and consulting. A staffing plan specifying full-time and part-time allocations is mandatory.
• Project Documentation: Comprehensive risk management strategy, phased implementation timeline with milestones, quality assurance testing plan, and change management framework.
• Compliance & References: Proof of OEM/reseller authorization. Two verifiable client references for comparable IGA projects completed within the last 36 months, including customer details, service descriptions, and project duration.

Key Technical & Operational Terms

• Segregation of Duties (SoD): A security control that prevents fraud and operational errors by ensuring critical processes cannot be completed by a single individual. Conflicting access rights are automatically validated and blocked.
• Least Privilege Principle: Ensures users are granted only the minimum system access and permissions necessary to perform their specific job functions.
• Cold-Failover Disaster Recovery: A backup infrastructure that remains completely inactive until a production failure occurs. Upon failover, all operations shift exclusively to the DR site.
• Global: A proprietary, custom-built security layer used by the Commission to centralize application access management. The new IGA solution must integrate with it via REST APIs or fully replace it.