Experian Digital Identity and Risk Solutions

Two-year contract to deliver and support Experian digital identity and risk solutions, including software, analytics tools, and professional services for managed identity verification and risk management.

Submit bids electronically through BidBuy only.
Submit Vendor Disclosure or IPG Active Registered Vendor Disclosure.
Submit Offer to the State of Illinois Information and Technology Contract.
Submit Manufacturers Form.
Submit Business Enterprise Program/Veterans Small Business Program Utilization Plan (if applicable).
Ensure submitted documents are accessible and readable using Microsoft Office suite software or Adobe Reader.
Ensure BidBuy account is up-to-date.
Bid must remain firm for 180 days from bid opening.
Submit a redlined version of Standard Terms and Conditions if taking exceptions.
Submit pricing in the Quote Items Tab on BidBuy.
Provide a statement of manufacturer authorization to resell and deliver products/services.
Be registered by the Illinois Small Business Set-Aside Program (if applicable).
Submit a Bid Bond with the bid if required.
Maintain authorization to resell and deliver Experian products/services for the contract term.
Ensure all professional services are provided by Experian or an authorized Experian Service Provider.
Deliver all licensed items electronically.
Maintain verifiable records of electronic delivery.
Obtain prior written approval for subcontractors and disclose their names, addresses, and work descriptions.
Perform services in the United States unless otherwise disclosed.
Maintain firm prices for the first 12 months, with subsequent annual adjustments based on CPI-U.
Ensure system supports secure integration with the State Identity and Access Management (IAM) platform (ILogin).
Enforce multifactor authentication (MFA) for all privileged accounts.
Provide a Software Bill of Materials (SBOM) for all products/services.
Maintain a robust and reliable data backup system with encrypted backups.
Provide a written disaster recovery methodology and documented proof of annual testing.
Sanitize all media containing State data using NIST Special Publication 800-88.
Render all State data hosted within its environment permanently inaccessible using crypto shredding.
Do not resell or redistribute information gained from access to State data.
Do not engage in adware, unauthorized software, marketing, telemetry, or user tracking features unless explicitly authorized.
Have a documented security incident policy and plan, with annual testing.
Comply with all United States federal and State of Illinois laws, rules, and regulations.
Cooperate fully with any federal or State audit or security review.
Comply with the State's Enterprise Security Policies.
Coordinate program and project management activities with the State governance program.
Provide an SSAE-18 SOC 1 Type 2 report annually when hosting or processing State financial information.
Ensure all information technology products, services, and digital content comply with the Illinois Information Technology Accessibility Act (IITAA) Standards.
Meet the State's Minimum Logging Requirements and provide logs within 24 hours of request.
Ensure security, storage, and integrity of the State’s content, data, computers, networks, and systems.
Immediately notify the State Chief Information Security Officer (CISO) within 24 hours of any actual or suspected information breach or security incident.
Encrypt State data both at rest and in transit using FIPS 140 and AES 256-bit encryption.
Use State data only for purposes stated in the contract.
Do not use State data in non-production systems or for training AI/ML models without prior written authorization.
Do not replicate State data to testing, development, sandbox, or non-production environments without prior written authorization.
Provide a complete and current copy of all State data in a non-proprietary, structured, and machine-readable format upon request or termination.
Ensure the physical location of any data center utilized is within the contiguous United States.
Ensure data access is only within the contiguous United States.
Do not utilize Artificial Intelligence (AI) systems unless expressly disclosed and authorized by the State.
Disclose the nature and extent of AI contributions and involvement.
Clearly identify AI-driven interactions in user interfaces.
Unmistakably mark all AI-generated output.
Comply with Illinois Identity Protection Act, Illinois Personal Information Protection Act, FERPA, FBI CJIS Security Policy, CMS MARS-E Document Suite, and CMS ARS.
Adhere to a minimum security baseline as identified in NIST Special Publication 800-53, Revision 5.
Adhere to Cloud Security Alliance recommendations for cloud solutions.
Supply a current list of all non-proprietary/open-source software used in the solution.
Ensure products/services interface with the State's identity and access management solutions.
Begin remediation within 24 hours of discovery for all critical and high (CVSS 7.0 and higher) vulnerabilities.
Provide notice to the State within 24 hours of discovery of critical and high vulnerabilities.
Maintain General Commercial Liability, Auto Liability, and Worker’s Compensation insurance.
Do not employ any person employed by the State during the contract term.
Comply with the Illinois Human Rights Act and rules applicable to public contracts.
Assign to the State all rights, title, and interest in any antitrust claim upon request.
Warrant that supplies conform to standards, are merchantable, free from defects, comply with laws, are of good title, and do not infringe intellectual property rights.
Warrant that services will be performed efficiently, effectively, and by trained personnel.
Immediately notify the State of any event that may materially impact performance.
Comply with the Drug Free Workplace Act (if applicable).
Do not participate in an international boycott.
Do not have convictions for bid rigging or bid rotating.
Do not pay dues to or reimburse employees for fees to any 'discriminating club'.
Ensure no foreign-made equipment, materials, or supplies are produced by forced labor or child labor under the age of 12.
Mitigate any violations of the Lead Poisoning Prevention Act.
Comply with Executive Order No. 1 (2007) regarding lobbying.
Comply with the registration requirements of the Elections Code and restrictions on political contributions.
Provide products manufactured in Illinois or the United States if awarded through the Procurement of Domestic Products Act preference.
Post employment vacancies on IllinoisJobLink.com or provide an online link.
Not be prohibited by federal agencies due to cybersecurity risks.

$1,000,000 – $5,000,000

The contract will have an initial term of two (2) years commencing upon the last date of execution, with an option for a one (1) year renewal. Electronic delivery of licensed items is required within 15 business days following execution of the agreement. The State will confirm receipt of electronically delivered items within 7 business days of delivery. The State will have forty-five (45) days from receipt of a deliverable to perform testing. Upon receipt of a Rejection Notice, the Vendor shall undertake corrections within twenty (20) days. The bid must remain firm for 180 days from the bid opening date.

Department of Innovation & Technology

Organization overview and procurement intelligence available on paid plans.

This RFP seeks a vendor to provide Experian digital identity and risk solutions, including identity proofing software, risk analytics tools, and associated professional services. The engagement includes access to Experian's identity resolution platforms, decisioning APIs, data analytics, scoring engines, and third-party verification services, all aimed at supporting secure and efficient use of Experian’s identity risk products.

The vendor will offer support for onboarding, usage monitoring, and technical configuration within Experian’s ecosystem. Orders under this contract will specify particular billing and shipping details, and execution will be governed by applicable license agreements that detail software use, data access, and API integration. The contract term is two years.

Experian Digital Identity and Risk Solutions

Overview

Fit Score

SUMMARY

KEY REQUIREMENTS

BUDGET

CONTRACT DURATION

TIMELINE

Issuing Agency

DESCRIPTION

Similar RFPs