QLD's Department of Transport issues identity management RFI

The Queensland Department of Transport and Main Roads (TMR) has issued a request for information (RFI) for the supply of market information to inform its business strategy and potential future sourcing scope and approach relating to an Identity Governance and Administration (IGA) solution.

The Department's current operating environment includes a large volume of digital identities and associated access entitlements distributed across multiple systems and platforms. In this context, effective governance of identity lifecycle processes and access permissions is essential to ensure compliance, security, and operational efficiency.

TMR considers the implementation of IGA capabilities to be a strategic, long-term investment in identity security and governance. This RFI aims to help TMR assess the cost, value and residual risk of available capability uplift options and confirm the scope of requirements for any future procurement.

TMR currently utilises Microsoft Entra ID as its primary enterprise identity platform, providing core identity management, authentication and access control capabilities across the organisation, intending to maximise the value of its existing investment in Entra ID by leveraging native features and integrations to support identity governance outcomes wherever feasible.

However, it is recognised that Entra ID may not fully meet all governance and administration requirements, particularly in relation to advanced access certification, role lifecycle management, and complex entitlement governance across heterogeneous systems.

Any proposed IGA solution must complement and integrate with Entra ID, extending its capabilities where required. Importantly, this includes the ability to integrate with key enterprise platforms SAP S/4HANA, ServiceNow, multiple NetIQ (Novell) eDirectory’s, multiple Microsoft Active Directory’s as well as a large IBM RACF-based environment, to enable end-to-end visibility and control of identities and access across cloud, on premises and legacy systems.

The anticipated scope of an IGA Solution in the context of TMR’s environment includes capability to manage identity lifecycle processes across connected systems; govern and administer access entitlements and roles; and support access request workflows and approval processes.

The new solution is also required to enable periodic access certifications and compliance reporting and provide centralised visibility and control over identity-related activities.

The contract is likely be a minimum of five years with options to extend.

The closing date for responses is 4:00PM on July 16.

In the last 12 months, the TMR has gone to market to procure cyber security awareness training and to provide managed services for the establishment of a co-managed SOC.