Identity & Access Management Analysis IT Assessment & …

1 Texas Department of Information Resources STATEMENT OF WORK (SOW) FOR DELIVERABLES-BASED INFORMATION TECHNOLOGY SERVICES Identity & Access Management Analysis IT Assessment & Planning Gartner, Inc. DIR-SDD-2042 Statement of Work Identity and Access Management Analysis 2 1. Introduction The purpose of this Statement of Work (SOW), in accordance with SB 1878 (84R), is to outline the IT Assessment and Planning services provided by Gartner, Inc. (Gartner) to perform Analysis for the purpose of implementing new identification and Access requirements for accessing certain information that is electronically stored by the state, including personal identifying information and sensitive personal information, as those terms are defined by Section , Texas Business and Commerce Code.

2 2. Scope Approach Overview: Understanding and Business Context Gartner s approach to this project breaks the effort into phases and tasks as defined in its methodology, described in Section of its response to the SOW dated March 4, 2016, customized to address the DIR Identity Management Analysis project s requirements to ensure the successful procurement of a new IAM solution set. As a critical success factor, Gartner will involve project key stakeholders at critical decision points throughout the project. Identity and Access Management Assessment Tasks The first phase of the project will be delivered as follows.

3 Task 1 - Project Kickoff Task 2 Current State Environment Discovery o Interviewing 12 focus groups o Sending Electronic Survey to 150 identified agencies and Institutions of Higher Education (IHEs) o Culling existing security maturity assessments for additional details Task 3 Current State Data Analysis and Validation o Identification of Use Cases o Development of High-Level Requirements o Identification of complexities and potential solutions Task 4 Research and Analysis of Vendor Options o Available market-place solutions review and Analysis o Vendor solution architecture discussions with potential vendors/service providers o Development of relative costs and benefits from various technological options o Security

4 Considerations o Optional Workshop: Potential Vendor Solutions and Alternatives Workshop Presentation Statement of Work Identity and Access Management Analysis 3 Task 5 Report, Review and Updates o Delivery and Review of First Draft Report o Report review and update o Delivery of Second Draft Report o Report review and update o Final Report Delivery Task 6 Summary Results Presentation Task 1: Project Kickoff Deliverable(s) and Time Frame Objective: Work closely with DIR to set the foundation for a successful engagement that is delivered on time, within budget, and meets DIR s objectives.

5 Refine the project schedule and expectations from those established in this Statement of Work (SOW). Activities performed by Gartner: Conduct a kickoff meeting with DIR to establish and ensure understanding of the project objectives, scope, schedule and milestones, roles, responsibilities, communication plan, and required resources for Gartner and DIR. Additional conference calls may be used to supplement the kickoff meeting as necessary to complete the necessary communication and information transfer. Discuss anticipated risks and mitigation plans, based on lessons learned from past experience.

6 Gather any relevant background material from DIR, as well as logistics for onsite project activities including the information gathering interviews. DIR responsibilities: Ensure attendance at kickoff meeting by Project Sponsor, Project Manager and other key stakeholders, as determined prior to kickoff. Identify relevant information necessary for the project, identify personnel required for participation in the defined tasks of the project, and establish timeframes and logistics for on-site interviews and activities. Establish a DIR Core Team (as necessary and mutually agreed upon) to support and participate in the activities of the engagement.

7 A list of the typical roles represented for this effort are (1) project/program manager (2) line-of-business (3) enterprise architect (4) architect (5) domain expert; DIR and Gartner will collaborate on forming the DIR core team. Deliverable(s): Kickoff meeting materials Draft project schedule Draft project plan Communications Plan Interview questions, participant list, schedule, and related travel logistics information Pre-interview survey Time frame: Duration One (1) week Meeting Time: 90-120 minutes Relevant Information and Supporting Material (not all of these may exist).

8 Existing information regarding strategies, governance, architecture, infrastructure components, and related in-flight projects Documented business and use cases Functional requirements and specifications documents including infrastructure, process, data flow, and architecture diagrams Other documentation such as existing policies, procedures, and audit and incident reports Statement of Work Identity and Access Management Analysis 4 Task 1: Project Kickoff Deliverable(s) and Time Frame Assign a project team leader who will effectively manage the execution of the project, including: Communicate factors (as soon as they are known, if any) that could affect the project s schedule or the cost, quality, or delivery of Gartner s consulting services Inform Gartner of the project s status from DIR s perspective so that Gartner can quickly address issues associated with direction and scope Provide timely feedback on questions and information requests submitted by Gartner.

9 Task 2: Current State Environment Discovery Deliverable(s) and Time Frame Objective: Ensure that both Gartner and DIR are working from the same baseline understanding of the business environment including the current-state of the infrastructure, the business drivers, and the strategic future-state requirements. This task is comprised of three primary subtasks Interviews with 12 focus groups Electronic survey of approximately 150 agencies and IHEs Compilation of IAM-related security maturity content Activities performed by Gartner: Review the documentation provided during kickoff.

10 Through the review, acquire a sufficient overview of and background on the DIR business environment, the target processes and supporting infrastructure, and potential constraints and impacts. This will enable the consulting team to appropriately focus the follow-on interviews and information gathering activities. Conduct a series of focus group interviews with key technical personnel, functional organizations, sponsors, stakeholders, and executives. These interviews will allow stakeholders and impacted organizations to describe their existing responsibilities technological capabilities, requirements and desires.