Market Research: Internet-based Identity Proofing, Risk-Based Authentication, and "Out-of-Wallet Data" solutions

REQUEST FOR INFORMATION AND INDUSTRY COMMENT The Social Security Administration (SSA) is conducting MARKET RESEARCH to locate commercial firms that either sell commercial products or services, or are capable of developing such, that can verify the identity of SSA's online customers. NO FORMAL SOLICITATION IS BEING ISSUED AT THIS TIME. BACKGROUND SSA handles approximately 53 million e-Service transactions yearly. This number will increase significantly over the next decade. To facilitate electronic business processes, SSA has developed an E-Authentication strategy that recognizes the risk of fraudulent use of new electronic processes and improper disclosure. Proper security controls and more robust e-authentication routines will provide reliable and accurate outcomes for citizens, businesses and other government agencies, which rely upon SSA applications. SSA seeks information on vendors able to provide authentication technology solutions in the areas of Identity Proofing, Risk-Based Authentication, and Out-of-Wallet Data in support of SSA's E-Authentication strategy. Vendor solutions must be able to integrate with and support SSA customer-facing applications, as well as support customer registration and subsequent authentication events consistent with SSA's E-Authentication strategy. SSA is interested in highly-reliable, adaptive solutions that will meet all technical and operational requirements specified below and within the draft statement of work (see attached). Any potential vendor solution must support: ? Seamless Integration within the SSA authentication framework utilizing secure, open standards in order to reduce the impact of solution implementation upon SSA and its customers; ? Identity Proofing: the e-authentication process by which an assertion of an identity is verified; ? Risk-Based Authentication: a technique that uses both contextual and historical user information, along with data supplied during an Internet transaction, to assess authenticity of a user interaction; and ? Out-of-Wallet Data: refers to private data used for authentication activities, e.g., any personal information that cannot be found in a person's wallet. - Out-of-wallet data may be drawn from public, publicly available and non-public proprietary databases. A typical out-of-wallet question may be based on information taken from a credit report, such as the name of the company that issued your home loan. Any potential vendor solution must adhere to the following federal security guidelines that support strong Level 3 identity proofing. ? National Institute of Standards and Technology (NIST), Special Publication (SP) 800-63 ? Office of Management and Budget Memorandum M 04 04 INSTRUCTIONS TO INTERESTED PARTIES Interested and capable parties are invited to submit information in response to this notice.. All responses must include the following information in their responses: ? A description of how the solution satisfies SSA's technical requirements. This description must include the factors, elements, and process used to generate a risk score in support of the Risk-Based Authentication requirements; ? A description of how the solution will integrate with SSA systems, while conforming to applicable standards, transports, and protocols described within this solicitation; ? A description of how the solution's performance, security, and reliability will be monitored, maintained, reported, and potentially improved to satisfy SSA requirements; ? An general project plan that defines how the general levels of effort required on the vendor's part to implement the solution, the estimated duration to implement the solution, the types of key personnel required to implement and maintain the solution, and a description of the anticipated level SSA personnel's involvement in implementing and maintaining the solution. ? Any additional relevant information on quality assurance, warranties, or guarantees of performance of the solution. ? A comprehensive list of Out-of-Wallet questions the vendor will employ that is sufficient to verify identity during the authentication process. ? A clear description of how the will provide access to information that supports authentication requirements specified within NIST 800-63, such as address and financial information [e.g., credit card numbers, banking account numbers (checking, savings), loan information (home, car, student)]. SSA seeks evidence of a vendor's ability to deliver the broadest range of identity verification data to support the authentication of a highly diverse customer base. ? A description of how the vendor's solution is commonly sold I the commercial marketplace (e.g., initial price approaches, user license based, transaction based recurring pricing, price policies for solution maintenance, hourly or engagement based services pricing). Vendors should also indicate whether their services/products are available on GSA Federal Supply Schedules or any other Government-wide Agency Contract (GWAC), and if applicable provide the relevant contract numbers. ? Examples of relevant corporate past performance information that demonstrates the vendor's previous success in delivering solutions of similar size, scope, and complexity in the government or commercial marketplace. Vendors are invited to submit complete responses to this notice and make advisory comment on the attached draft statement of work document. Vendor submissions of simple marketing materials or brochures, incomplete responses that do not conform to the elements of this request for information, or references to vendor websites will not be considered by the Government. The Government will not return any information submitted in response to this notice, nor will the Government pay for any information submitted in reply to this notice. Information submitted in response to this notice will be used in SSA's market research efforts and for procurement planning purposes. The Government reserves the right to contact, or not contact, any party responding to this notice in order to obtain further information for market research purposes. NO FORMAL SOLICITATION IS BEING ISSUED AT THIS TIME. Requests for copies of a solicitation at this time will not be acknowledged. All responses must be submitted in an electronic format (compatible with MS Office 2003) via e-mail to the Contract Specialist. Faxed information will not be considered. The file size limitation for e-mail attachments is 5 megabytes. Electronic responses must be received by 5:00PM ET April 10, 2009.