1. Vendor background
- 1.1
Company background, ownership, customer count in our size bracket.
- 1.2
Reference customers in our industry — 3-5 willing to take a call.
- 1.3
12-month roadmap, especially around AI-assisted decisions + cloud-native delivery.
RFP template · reviewed 2026-05-22
IGA RFP template — the questions to actually ask
A copy-into-Word RFP scaffold for selecting an IGA platform (SailPoint, Saviynt, Omada, One Identity). Differentiating questions on certification cadence, SoD, and role mining.
Who uses it
CISO / Chief Compliance Officer at regulated enterprises selecting or replacing an IGA platform.
Typical timeline
12-16 weeks RFP → shortlist → bake-off → award
20 questions across 8 sections. CC BY 4.0 — copy freely.
2. Connector library + provisioning
- 2.1
Number of certified connectors. Provide list. Specifically call out: HRIS (Workday, SuccessFactors), AD, SaaS providers (top 50), SAP, mainframe.
- 2.2
Custom connector framework. Time-to-build a custom connector for an obscure app.
- 2.3
SCIM 2.0 conformance level.
3. Access certifications
- 3.1
Describe certification campaign types — manager, app-owner, role-based, risk-based.
- 3.2
Describe reviewer UX. What context does the reviewer see (last-login, peer comparison, risk indicators)?
- 3.3
Continuous certification mode vs campaign mode.
4. Role mining + management
- 4.1
Describe the role-mining engine. AI / ML assistance? Manual vs automated workflow?
- 4.2
How is the role model maintained over time? Drift detection? Periodic re-mining?
5. Separation of duties
- 5.1
Describe SoD rule engine — how rules are expressed, enforced at request time vs detected post-grant.
- 5.2
SAP-specific SoD analytics support (if applicable).
- 5.3
Exception / risk-acceptance workflow.
6. Workflow + automation
- 6.1
Describe the workflow engine. UI-based vs code-based.
- 6.2
Version control / change management of workflows.
7. Audit + compliance
- 7.1
Describe audit log emission + retention.
- 7.2
Pre-built reports for FedRAMP, SOC 2, HIPAA, FFIEC.
8. Pricing + implementation
- 8.1
Per-identity pricing. Connector add-ons.
- 8.2
3-year TCO including implementation services (often 1-2× annual license).
Evaluation rubric
How to score responses.
| Criterion | Weight | How to score |
|---|---|---|
| Connector coverage | 15% | Specifically for your environment — SAP, mainframe, custom apps. |
| Certification reviewer UX | 15% | Context + decision-support determines rubber-stamp rate. |
| Role mining maturity | 15% | AI assist + re-mining workflow. |
| SoD enforcement | 15% | Request-time vs post-grant; SAP fit. |
| Workflow extensibility | 10% | Custom logic at scale. |
| TCO (3yr) | 15% | Including implementation services. |
| Reference customer signal | 15% | 3-5 references. |
Want help running it?
We run vendor selections + bake-offs.
Vendor-neutral procurement assistance — from RFP to shortlist to bake-off to negotiation. We’ve seen every vendor pitch + every contract structure.