Public Sector Network Tender Alert


UK-Sheffield: data-processing services

Identity assurance service. In supporting the digital by default policy in general and the Government’s welfare reform agenda in particular, cabinet office have produced guidance for all major public service provider departments relating to the need for identity assurance of members of the public when accessing government services. The intention of this guidance is to leverage secure identity assurance capabilities that are already available or will be developed in the private sector, allowing citizens to choose the private sector partner(s) they wish to use to assert their identity and so access a government service. This approach will support: — Increased digital uptake – supporting channel shift, — Maintaining security – through collaboration between private and public sectors, — Uniformity – standards based approach will reduce complexity and costs, — Integration of a diverse set of suppliers through a common published integration standard. DWP is intending to establish a commercial framework of suppliers to deliver an identity assurance service consistent with these guidelines and agreed standards and to support the rollout of strategic customer services and DWP programmes including universal credit and personal independence payments. The service will be required to provide identity assurance for approximately 21 000 000 claimants of DWP services. As the DWP customer base is diverse, a wide range of business types will be required for the framework to ensure demographic coverage and that no claimant sector is unfairly disadvantaged by limiting supplier choice. To support the rollout of universal credit and personal independence payments providers will be selected by June 2012 and systems will need to be fully operational from March 2013. Further details of service delivery and implementation will be provided at supplier briefing events and within the invitation to tender pack. DWP wish to contract with organisations under a framework agreement to provide an identification service covering the following: — Identity verification. The provider will verify that sufficient evidence exists to verify that a person presenting on a given channel is the owner of the claimed identity. DWP will provide a standard against which to judge ‘sufficient evidence’. This standard will be issued with the ITT, but indicatively DWP wish to verify identity at levels of assurance aligned with 1, 2, and 3 of the 2003 eGif standard. The draft standards present a more ‘online’ or ‘remote’ verification flavour than the eGif document, and present a more granular scale than discrete levels, 0, 1, 2, 3, Verification will be performed in an appropriate channel (web, telephone or face to face), — Credential management. The provider will securely manage the credential lifecycle (e.g. user name, password, hard or soft tokens, grids, voice samples, memorable information, one time passwords etc), from issue to decommission, including all aspects of management of the customer, which will include for example credential loss/recovery/reissue. Again a standard with the ITT will indicate varying credentials and management thereof compatible with various levels of assurance, — Identity correction services. Managing and resolving customer and DWP driven identity errors, and revocation of the identity (or use thereof for government authentication purposes) from the supplier, — Identity authentication. The provider will enable authentication using appropriate credentials in the relevant channel (web, telephone). In the web channel the interface with departmental systems will be standardised in a SAML 2 profile to be issued in the ITT. DWP will also present a standards based approach to technical integration with private sector identity providers, supporting authentication requests and responses in the telephony channel. — The identity asserted in the relevant channel will be described in terms of a standardised data description (to be detailed in the ITT) indicatively: Names, Gender, DOB, DOD, address, and the history of these items. The authentication will also carry technical information describing the level of assurance and of authentication, — The provision of associated data attributes, out-with those above may also be requested by the DWP and provided by the service provider: e.g. bank account details, e.g. verified telephone numbers, e.g. history of addresses, — The supplier will comply with standards of assurance over its operational practice in line with terms to be published covering, audit, support for investigation, support for assurance visits and processes, access to data and standards of operation substantiating proper discharge of the supplier’s duty under the contract and compliance with agreed processes, — The assurance regime and operational capability of the service provider will be required to support a privacy model and consent process on behalf of the customer, indicatively ensuring that the customer has an understanding of the type of information which may be released to the DWP as a result of their consent to use the service, — Channel support. Identity provider services invited under this framework should support access over one or more channels: online web browser and by telephone, and or face to face assurance. No one supplier is required to offer services on all channels and at all levels. Combined service offered by telephone and web browser are desirable, — Geographical reach. Services of potentially more than one identity provider will be available for use for the whole of DWP across the United Kingdom, and including Northern Ireland, — Demographic reach. It is expected that segments of the DWP customers will likely be serviced by potential identity service providers with a history of contact of subgroups, in demographic and socioeconomic terms. Different suppliers may have reason to support a particular group more effectively than other groups. This Framework may be accessed by Central Government departments in Great Britain, with a requirement for identification assurance of individual customers accessing their services. It will also be used by “DSD” The Department for Social Development acting for and on behalf of the Social Security Agency (Northern Ireland). Further information on this department can be viewed at: The Customer volumes associated with this notice refer to volumes for DWP only. CPV: 72310000.

Ref: UI_DWP_100186,



Contract value: 200000000.00GBP

Published: 8 Jun 2012, Receipt by: 8 Jun 2018