Question:
Will TMR consider suppliers' use of offshore resources for delivery of implementation and managed support services? Offshore resources will primarily be from India but can include other countries or regions.

Answered on 07/Jul/2026 03:27 PM:


Suppliers are encouraged to provide information about where their support services staff are located, as requested in the Request for Information response section.

Should the Department issue a subsequent Invitation to Offer, it will contain a requirement that no Customer Data be used, stored or accessed from locations outside of Australia – including where support services remotely access the system to provide support assistance.

For clarity, the Department has already engaged an implementation partner who will be responsible for the implementation of the Customer’s IDAM Solution (a component of which includes IGA), so limited implementation services are anticipated and will likely be restricted to issue / defect resolution during initial access provisioning

Question:
Can suppliers leverage their offshore team to support the response to this RFI?

Answered on 07/Jul/2026 03:28 PM:


The RFI documents may be accessed from or sent to the Supplier’s personnel and advisors irrespective of their location for the sole purpose of generating and submitting a response.

Question:
With regard to the response document Section 3, Question 10 - PAM Integration. Can you advise if QLD TMR currently use a PAM solution, and if so, what PAM tool(s) are in use that require integration.

Answered on 09/Jul/2026 12:14 PM:


At this stage, suppliers should not assume a single mandated PAM product but should outline how their solution would integrate with common enterprise PAM platforms and support a future-state PAM environment.

The future-state PAM platform has not yet been finalised and may be replaced through ongoing procurement and design activities. Suppliers should therefore describe their integration approach for both:

• To support privileged access controls and credential management capabilities.

• Industry-standard PAM platforms, including Microsoft PIM/PAM and equivalent enterprise PAM solutions.

TMR expects any proposed solution to support integration with privileged administrator accounts, service accounts, emergency/break-glass accounts, just-in-time access workflows, privileged access reviews, and audit/reporting functions. Integration with Microsoft Active Directory, Microsoft Entra ID, ServiceNow and related identity governance processes will also be required.

ICT Procurement

Information Technology Branch | Enabling Solutions Group

Department of Transport and Main Roads

Question:
Good afternoon, could you please advise of the contract mechanism for this RFI - QITC General Contract terms or comprehensive?

Answered on 07/Jul/2026 05:56 PM:


This is a Request for Information only. There will be no contract resulting from this stage of the procurement activity. The Department will determine and indicate the appropriate contract form in the tender issued subsequent to this Request for Information (if any).

Question:
Has escrow as a risk mitigation tool been considered for this solution?

Answered on 09/Jul/2026 01:18 PM:


No decision has been made to either mandate or exclude escrow arrangements. The requirement has not been formally established at this stage and will be assessed as part of later commercial, legal, risk, and contract negotiations should TMR determine that escrow provides measurable value for the selected solution and deployment model.

Should escrow be required, TMR would assess through its normal procurement and risk management processes.

ICT Procurement

Information Technology Branch

Department of Transport and Main Roads

Question:
Are responses required to be submitted through a delivery partner?

Answered on 09/Jul/2026 02:15 PM:


This RFI is being conducted to obtain information from the market and encourage participation from all respondent types. TMR has no preference regarding the submission pathway and welcomes responses from all participants capable of providing relevant information.

Question:
1. TMR85 System / Application - What are these applications that TMR looking to on-board in Phase 1?

2. NetIQ - Is that a tool TMR leverage for the IGA or PAM today, will NetIQ be replaced with a new IGA tool?

Answered on 13/Jul/2026 06:13 PM:


1. At this stage, TMR does not intend to publish the complete list of 85 systems as part of the RFI process. Detailed application information, onboarding priority, sequencing and technical integration requirements may be made available in a subsequent tender where appropriate.

Respondents can assume a mix of:

(a) Major enterprise platforms including SAP, ServiceNow/SCO, Microsoft Entra ID, Microsoft Active Directory, IBM RACF and OpenText NetIQ/eDirectory.

(b) A combination of modern applications already leveraging standards such as SAML, OIDC and Entra ID integration.

(c) Legacy and niche applications that require LDAP-based authentication, custom integration patterns or specialised onboarding approaches.


2. NetIQ is currently used as part of its existing Identity and Access Management environment. TMR's current-state identity capability includes OpenText NetIQ Identity Manager/eDirectory and related NetIQ components that support identity management, directory services, authentication and authorisation functions.

Question:
Dear Panel,

I would like to ask the below questions in order to give the most accurate response to the RFI:

1) What Microsoft Entra ID licensing tier is currently deployed (e.g., P1, P2, or Entra ID Governance)? Specifically, are features such as Entitlement Management, Access Reviews, or Privileged Identity Management (PIM) already licensed and/or in use?

2) To what extent has Entra ID Governance already been evaluated or piloted against TMR's requirements, and what specific gaps were identified that are driving the need for a third-party IGA solution?

3) How many Microsoft Active Directory instances are in scope, and what is the forest and domain trust structure across those instances?

4) How many NetIQ (Novell) eDirectory instances are in scope, and what versions are currently running?

5) Is there a planned consolidation or migration of the eDirectory instances, or are these expected to remain as long-term targets for the IGA solution?

6) The IBM RACF environment is referenced as "large," but no further detail is provided, which makes it difficult to assess connector maturity. What is the approximate scale of the RACF environment (e.g., number of user profiles, managed systems, and resource profiles)?

7) Are there specific RACF features in scope for the IGA solution, such as RACF group management, dataset access profiles, or general resource profiles?

8) Is the RACF environment connected to any existing identity synchronisation tooling?

9) Is SAP S/4HANA deployed on-premises, in the cloud (RISE with SAP), or in a hybrid model, and are there single or multiple instances in scope?

10) Approximately how many non-human identities (e.g., service accounts, workload identities, and AI agents) are in scope beyond the 200 service accounts already listed in the user volume table?

11) What platforms host the AI agent identities that need to be governed (e.g., Microsoft Azure AI, AWS, or on-premises orchestration platforms)?

12) Is there an existing PAM solution currently deployed at TMR (e.g., CyberArk, BeyondTrust, Delinea)? If so, which platform is in use?

13) Are the approximately 600 privileged accounts already onboarded into a PAM vault, or is the expectation that the IGA solution will also support onboarding those accounts?

14) What are the expected service level targets for Level 3 support escalations (e.g., P1 response times)?

15) Are support hours expected to align with AEST business hours, or is 24/7 coverage a requirement for any severity level?

16) Pending the speed of the answers to the above questions, and desire to give as accurate and thorough response to the RFI, is it possible to grant an extension for 1 week for the submission of the RFI?

Thank you in advance.

Answered on 13/Jul/2026 06:22 PM:


1. TMR's current Entra capability supports advanced identity security features associated with Entra ID P2, including Privileged Identity Management (PIM) and Microsoft Access Reviews. Current operating processes include privileged identity approvals and quarterly access reviews leveraging Microsoft Access Review capabilities.

2. TMR has assessed Microsoft Entra ID Governance capabilities, including Entitlement Management, Access Reviews, Lifecycle Workflows and Identity Governance features. While these capabilities are available within the Microsoft ecosystem and are being evaluated, TMR is seeking responses from the market for a dedicated enterprise IGA solution.

3. TMR currently operates multiple identity directories and Active Directory environments as part of its broader identity ecosystem. The primary Active Directory environments identified within scope include:

• A Corporate Active Directory and an Application Active Directory.

• Extranet Directory services as well as dedicated Test and Development forests.

In addition to Active Directory, TMR maintains other identity stores and directories including OpenText NetIQ eDirectory, Microsoft Entra ID instances and IBM RACF. These systems form part of the broader identity landscape and are expected to require consideration during future IGA integration planning.

The detailed forest and domain trust discovery is not suitable for publication through the RFI process. Consequently:

• Respondents should assume multiple Active Directory environments exist within scope.

• Integration with multiple Active Directory instances and Microsoft Entra ID instances should be supported.

• The final number of forests, domains, trusts and synchronisation relationships will be confirmed during discovery and detailed design phases following supplier engagement.

Vendors are encouraged to describe their capability to support multi-forest, multi-domain and hybrid identity environments, including coexistence with Microsoft Entra ID, Active Directory, LDAP-based directories, IBM RACF and legacy identity repositories.

4. TMR currently has multiple NetIQ (Novell/OpenText) eDirectory instances within scope. Current in scope directories are as follows:

• TMR's central metadata repository for identity management, operating on eDirectory 9.2.9.

• TMR's primary LDAP directory supporting internal and external users operating on eDirectory 9.2.9.

• eDirectory (Business Directory) operating on eDirectory 9.1.2

As part of the discovery and detailed design phases, suppliers should assume that migration, coexistence, consolidation and/or integration requirements may apply across multiple eDirectory repositories and associated NetIQ Identity Manager, User Application and Access Manager components.

5. Detailed migration and consolidation decisions remain subject to the outcomes of the procurement activities and future-state solution design.

6. Approximately 3,500 active user records were identified during discovery activities; however this figure represents application users and should not be assumed to represent the total RACF profile count. Details remain subject to detailed design activities. Respondents should therefore assume:

• IBM RACF is a material enterprise integration requirement.

• The future IGA solution must support governance and lifecycle management of RACF-connected identities.

7. IBM RACF is in scope as a significant downstream identity repository and authentication/authorisation platform. Current discovery activities have confirmed that RACF user accounts, profiles and role-based access controls form part of the broader identity lifecycle that the future IGA solution will be required to govern. At this stage the RFI's requirements are focused primarily on:

• User and account lifecycle management (Joiner, Mover, Leaver processes).

• Account provisioning, modification, suspension, reactivation and deprovisioning.

• Access governance, certification and audit reporting.

• Integration with RACF identities as part of a centralised identity governance model.

8. Yes, IBM RACF environment is connected to existing identity synchronisation tooling within the current-state IAM architecture. Integration between RACF and the NetIQ/OpenText identity platform, with identity data propagated between systems using RACF-specific synchronisation components.

9. Multiple instances in scope considering development and test environments. SAP has recently been migrated to SAP S/4HANA Cloud, Private Edition (PCE) under the RISE with SAP model, hosted on AWS infrastructure. The future-state architecture is described as a hybrid-cloud deployment model, integrating SAP RISE services with TMR on-premises systems, identity platforms and enterprise integrations.

10. The only validated volume currently available is approximately 200 service accounts. TMR has not yet established an authoritative count of other non-human identity categories and expects further discovery to occur during subsequent project phases. Respondents should assume that:

• Additional non-human identities exist across TMR's environment and are expected to increase over time as cloud, automation and AI capabilities mature.

• The selected IGA solution should be capable of governing both human and non-human identity types.

• Discovery, onboarding and lifecycle management of non-human identities, including service accounts, workload identities, API identities and AI agents, should be considered part of the future-state identity governance capability.

11. TMR has not yet identified a definitive set of platforms hosting AI agent identities. AI agents are currently treated as an emerging non-human identity class that the future IGA capability must be able to govern should such identities be deployed across Microsoft, AWS, on-premises or other orchestration platforms.

12. Current privileged access controls are delivered through a combination of administrative processes, Microsoft Entra Privileged Identity Management (PIM), platform-specific controls and governance activities.

13. The approximately 600 privileged accounts are not managed within one centralised enterprise PAM vault today.

14. TMR is seeking information from the market about its standard offerings and available support service options, including service levels. TMR has not yet determined preferred service level targets.

15. TMR is seeking information from the market about its standard offerings and available support service options, including coverage hours. TMR has not yet determined its preferred coverage hours. Suppliers are encouraged to respond with all available options for support hour coverage, including itemised pricing for each.

16. Note that an extension has been granted. Please refer to Vendor Panel for the updated Closing Date and Time.

Question:
1. TMR's remit includes road network operations (e.g. traffic signal control), tunnel management, and marine operations, which may involve Operational Technology (OT) or Industrial Control Systems (ICS) distinct from standard corporate IT. Can TMR confirm whether OT/ICS environments are within scope for the proposed IGA solution, or whether identity governance for these environments is being addressed separately?

2. We note the RFI's referenced user volume table (Section 1, item 5) was not populated in the issued document, and that the RFI Q&A register (13 July 2026) and Addendum 2 (21 July 2026) have since published approximate figures of 200 service accounts, 600 privileged accounts, 2,000 external Machinery-of-Government users, and a total range of 8,000–14,000 users/identities. Can TMR confirm whether these figures represent the complete basis suppliers should use for pricing, or whether a more granular breakdown (e.g. by licence/user type) will be issued before the closing date?

Answered on 21/Jul/2026 05:05 PM:


1. At this stage, TMR's primary focus for the proposed IGA capability is the governance of workforce, privileged and non-human identities across corporate and enterprise information technology environments.

Suppliers are encouraged to describe any existing capabilities, architecture patterns, connectors or governance approaches that would enable the future governance of identities, privileged accounts and non-human identities within OT/ICS environments should TMR elect to extend the scope in later phases.

2. Quantities and volumes were included and populated in the table at Section 1 Item 5 – a copy of which is included here for ease of reference.

• Total number of employee user accounts that need to be protected: 11,500

• Developer user accounts: Included in total

• Service accounts currently in use: 200 (approx.) Additional to total

• Privileged user accounts: 600 (approx.) Additional to total

• External workers, business partners and third-party users: 2,000 (approx.) Included in total

• Additional personas to be considered include former internal users moved to other government agencies following a Machinery of Government (MoG) change to now be external (new) users: 2,000 (approx.) in addition to the above external workers.

Suppliers should use these figures for pricing.

No further granular breakdown will be provided before the closing date.