Delivery of Sailpoint IdentityNow

SailPoint is the chosen product by the National Enabling Programme (NEP) to manage application user identities to a common standard across all police forces. Using SailPoint in the MPS will improve governance in the MPS Joiners, Movers and Leavers process resulting in officers and staff having the right access to important applications that are pertinent to their role. This is especially useful for officers and staff who need to access information, resources and knowledge that reside in a wide variety of different IT systems to solve crimes.

SailPoint is mandated by the NPCC to be used across all forces. It is also at the heart of a programme called NIAM (National Identity and Access Management) that is run by the Home Office, and will manage identities for national applications such as the LEDS (Law Enforcing Database) applications, amongst others.

Officers and staff need accurate and up-to-date information, and they need to be able to get access to all the information they need, exactly when they need it. To enable access to the NIAM Applications the Met needs to be in a position where identity and access management are conducted properly and this is where SailPoint comes in.

The Deputy Mayor for Policing and Crime is recommended to:

1. Approve The MPS adopting SailPoint as a Minimum Viable Product, with capabilities such as Provisioning, Access Certification and Access Recertification for users (including guest users) for applications with workflow automation facilities, that is covered within the agreed MOU charge of £66k, plus additional costs for licensing and ongoing support of £436k starting mid 2022/23.

2. Approve project revenue of £205k (2022/23) all fully funded from MOPAC approved Digital Policing Revenue budget.

3. Approve a direct award contract for using SailPoint as the product of choice as mandated by the NPCC across all forces.

1. Introduction and background

1.1. This project will bring the MPS into alignment with national policing strategies for Identity and Access Management (IAM). IAM enables access rights to be assigned automatically, resulting in new officers and staff quickly getting up-to-speed in protecting the public.

1.2. SailPoint has been mandated by the NPCC to be used across all forces to achieve good governance for identities management with automation to control accounts when people join and leave the organisation. If the MPS takes on SailPoint for managing identities it can then take advantage of National Identity and Access Management (NIAM) which manages all identities for national Programmes and is established by the Home office.

1.3. The NIAM service helps ensure that both local and national problems are effectively tackled in a trusted way that aligns with the MOPAC Met Direction Strategy 2018-2025. This approach will also support officers and staff to access other national systems, saving time in double or triple handling the information, which brings collaboration that is a key element for modern policing.

1.4. Both programmes (IAM and NIAM) prevent the risk of officers and staff not having access to applications they need in protecting the public and sharing vital information with partners.

2. Issues for consideration

2.1. The MPS face the risk of not achieving governance with managing identities and not having a common standard of sharing information more securely and efficiently with other forces if it does not take on SailPoint.

2.2. If the MPS do not take on SailPoint it will be preventing itself from the opportunity of being NIAM-ready and utilising some of the certification and recertification capabilities for users of national applications.

2.3. Without SailPoint the MPS will not have the advantage of being involved in a proof of concept for LEDS Property that will ultimately replace PNC Property nationally and cross border. PNC Property is the primary source of information for investigating constrained property type cases (stolen and of a high threshold, not Custody property) and the gateway for interaction, cross-border and nationally.

3. Financial Comments

3.1. Adoption of Sailpoint as minimum viable Product along with all capabilities will cost 66k as part of the agreed MOU charge. Ongoing revenue costs, including licensing, will cost £436k per annum (commencing mid 2022/23). Project Revenue will be £205k. These costs are all fully funded from the MOPAC approved Digital Policing Revenue budget.

4. Legal Comments

4.1. The report identifies a Health Trust Europe’s (HTE’s) ICT Solutions Framework (ComIT 2 – Complete IT) framework agreement as the preferred route to market for the proposed contract award. On the basis of the statements provided, this will represent a compliant route where the ordering processes laid out in the framework agreement are followed.

4.2. Paragraph 4.13 of the MOPAC Scheme of Delegation and Consent provides the Deputy Mayor for Policing and Crime (DMPC) has delegated authority to approve the procurement strategy for all requests to go out to tender for contracts valued at £500,000 or above and all contract exemptions for £100,000 or above. In this case the contract award is a contract exemption as the National Enabling Programme (NEP) have selected SailPoint as the product to provide governance of application user identities across police forces. Noting that the total value of the procurement is near to the £500k limit, consent is consider to be prudent, but not strictly required.

4.3. Paragraph 7.23 provides the Director of Strategic Procurement has consent to approve the award of all contracts, with the exception of those called in through the agreed call in procedure. Paragraph 4.13 provides that the Deputy Mayor for Policing and Crime reserves the right to call in all decisions to award MPS contracts valued at £500,000 or above, although as noted above the estimated value for this procurement is beneath this sum.

5. Commercial Issues

5.1. Procurement will be a direct award through the Health Trust Europe’s (HTE’s) ICT Solutions Framework (ComIT 2 – Complete IT) framework agreement. The reseller for Sailpoint is approximately 80% below the recommended price offered through other suppliers.

5.2. Benefits of Sailpoint include:

• Reduction in officers and staff double or triple handling the information required for investigations, by having all forces sharing information on one national platform.

• Increased volumes in solving crimes by having access to the right applications or specific part of an application whenever required.

• Increase in bringing criminals to justice by simply entering the details of a single identity to gain access to relevant data needed and sharing with other forces and eventually with other partners.

5.3. In line with the Anchor Institute Charter Identity and Access management will enable access rights to be assigned automatically and that means new officers and staff can quickly get up to speed in protecting the public and preventing crime in communities, such as domestic violence that has increased during the pandemic. Access to NIAM through SailPoint will result in the MPS sharing important information with other forces and its partners supporting Londoners who have become victims of crime.

6. GDPR and Data Privacy

6.1. The MPS is subject to the requirements and conditions placed on it as a 'State' body to comply with the European Convention of Human Rights and the Data Protection Act (DPA) 2018. Both legislative requirements place an obligation on the MPS to process personal data fairly and lawfully in order to safeguard the rights and freedoms of individuals.

6.2. Under Article 35 of the General Data Protection Regulation (GDPR) and Section 57 of the DPA 2018, Data Protection Impact Assessments (DPIA) become mandatory for organisations with technologies and processes that are likely to result in a high risk to the rights of the data subjects.

6.3. The Information Assurance and Information Rights units within MPS will be consulted at all stages to ensure the programme / project meets its compliance requirements.

6.4. A DPIA has been completed for Sailpoint Identity Now. The SailPoint Identity Now project will ensure a privacy by design approach, which will allow the MPS to find and fix problems at the early stages of any project, ensuring compliance with GDPR. DPIAs support the accountability principle, as they will ensure the MPS complies with the requirements of GDPR and they demonstrate that appropriate measures have been taken to ensure compliance.

7. Equality Comments

7.1. SailPoint will be available for every member of staff and police officers ensuring everyone has the right information needed at the right time to conduct their work. Design will make it useable for those with assistive technology and will not exempt those with disabilities.

7.2. Support will be provided to ensure all levels of digital competency are catered for.

7.3. There is no impact on health and safety within the SailPoint environment.

8. Background/supporting papers

8.1. Report.