Contracted identity and access management (IAM) maintenance for a Thai government agency
We were the maintenance contractor for a Thai government agency's Identity and Access Management (IAM) system, which determines which systems each user can access, from December 2025 to September 2026. The contract covered 4 main areas: software license renewals, system inspections and maintenance, incident response, and service reports.
- Software licence renewalWithin the contract scope
- Scheduled maintenance checksUser accounts, password reset, database
- Resolve reported issuesRecorded in the report
- Reports per contract periodCompared against contract requirements
- Acceptance committeeBefore payment for that period
- Industry
- Government
- Year
- 2025–2026
- Scope of work
- 4 main parts under the contract: software licence renewal, scheduled user account system maintenance checks, fixes on notification, and service reporting, with delivery divided into monthly contract periods.
- Duration
- Dec 2025 – Sep 2026
Summary
- We were the contractor for the maintenance of a Thai government agency's user account and access rights (IAM) system from Dec 2025 to Sep 2026.
- The main contract scope has 4 parts: software licence renewal, system maintenance checks, fixes on notification, and service reporting.
- The contract divides the work into monthly periods, and payment is made once the agency's committee has accepted that period.
- The first-period report records that the 3 main systems reported on were in normal status and that no problems requiring correction were found that month.
- This page does not give the name of the agency, the names of individual software components or the system connection structure, because user account data is official government information that must be kept confidential.
The on-site brief
The agency needed its user account and access rights system to be available throughout the contract term, with scheduled system checks, fixes when problems occurred, and reports that the committee uses to accept the work of each contract period.
What we did
We were the contractor and were responsible for the main work within the contract scope, in 4 parts: software licence renewal, user account system maintenance checks, fixes on notification, and service reporting. The contract divides the work into monthly periods, and payment is made once the committee has accepted that period.
Results
The first-period maintenance report records that the software licence renewal had been completed and that the 3 main systems reported on (the user account system, the password reset system and the database) were in normal status. No problems requiring correction were found that month. This result applies to the first period only.
How the brief came about
This government agency needed a contractor to administer its user account and access rights system under contract, so that the system would be available throughout the contract term. This system is the point that determines which systems each user can access. If it has a problem, users may be unable to access their work systems.
We were the contractor from Dec 2025 to Sep 2026. This page summarises only the scope of work and the results confirmed by documents, without naming the agency.
What is IAM?
IAM (Identity and Access Management) is the management of user accounts and system access rights. An IAM system determines which systems each user can access. A password reset system is used to set new passwords for user accounts.
Requirements and constraints
The main requirements of this work come from the service contract and from the nature of the data, which is official government information. The main items are as follows.
- Renew the software licences used with the user account system, within the contract scope
- Carry out maintenance checks of the user account system, the password reset system and the database at the intervals set by the contract
- Start fixing a problem on notification, within the time set by the contract
- Submit service reports in monthly contract periods; the agency's committee must accept them before payment for that period
- User account data is official government information, so only the general scope of work can be disclosed publicly
How is a user account system administration contract divided, and how does this division help acceptance?
This contract divides the main work into 4 parts: software licence renewal, scheduled maintenance checks, fixes on notification, and reporting. This division gives each part its own evidence, so the committee can check, one contract period at a time, whether each part of the work was fully done.
Scheduled checks (Preventive Maintenance, meaning checks before a problem occurs) are used to find abnormalities before they affect users. Fixes on notification (Corrective Maintenance) address problems that have already occurred. These two parts must therefore be recorded separately in the report.
- 1
Software licence renewal
Renew the software licences of the user account system within the contract scope, and record the results in the report.
- 2
Scheduled maintenance checks
Check the status of the user account system, the password reset system and the database at the intervals set by the contract.
- 3
Resolve reported issues
When the agency reports a problem, the contractor must start the fix within the time set by the contract and record it in the report's problem-resolution section.
- 4
Submit reports to the acceptance committee
Each period's report goes to the agency's committee for acceptance, and payment for that period follows.
Deliverables
The main deliverables of this work are the maintenance reports per contract period, together with the software licence renewal. The first-period report was structured as follows.
- A table comparing each contract requirement with the work results
- Software licence renewal results
- Status of the user account system, the password reset system and the database
- Problem-resolution log (Corrective Maintenance) for that month
What results can be confirmed from the first-period report?
The first-period maintenance report records that the software licence renewal had been completed and that the 3 main systems reported on (the user account system, the password reset system and the database) were in normal status. The problem-resolution section for that month records that no problems requiring correction were found.
This result applies to the first period only and is not an assurance of availability throughout the contract term. This case has no other measured figures, so we report only what is confirmed by documents.
What we learned
This work offers 3 principles for contracted user account system administration.
- A report that is compared against the contract requirements one by one lets the committee keep its acceptance check on point. Reviewers do not have to interpret for themselves which part of the work appears in which part of the report.
- Software licence renewal should sit in the same scope as the system administration work, with the results recorded in the report, so that expiry dates have a clear owner.
- A normal status in one period's report is evidence for that period only. The report therefore has to keep system status separate from the problem-resolution log, so that it can be checked afterwards what happened in which month.
How can this approach be applied to your organisation?
If your agency or organisation contracts out user account system administration by period, you can use the 4-part main work structure of this case as a starting point. What needs adjusting is the list of systems to check, the check intervals and your organisation's acceptance format.
Reusable parts and parts that need adapting
| Part of the work | Reusable | Needs adapting when |
|---|---|---|
| Scope of work | Dividing the work into licence renewal, scheduled checks, fixes on notification and reporting | Your organisation has more or fewer systems to look after than in this case; the system list must be redefined |
| Reports per contract period | Table comparing contract requirements with work results | Your organisation carries out acceptance quarterly or annually; the reporting cycle must be adjusted to match the acceptance cycle |
| Licence renewal | Including renewal in the administration contract and recording the results in the report | The software items do not all expire at the same time; a list of expiry dates must be drawn up before the contract starts |
| Confidentiality | Disclosing only the general scope of work to the public | Your organisation has stricter rules on data; the scope of disclosure must be agreed before work starts |
- List the systems to be looked after and the software whose licences need renewing, with their expiry dates.
- Define the check intervals and the fix start time that the agency can accept, before writing them into the contract.
- Agree the report structure with the acceptance committee from the first contract period.
Technology used
Frequently Asked Questions
What was Inspektion's role in this work?
We were the contractor and were responsible for the main work within the contract scope, in 4 parts: software licence renewal, user account system maintenance checks, fixes on notification, and service reporting.
Why does this page not name the agency or the software used?
This work involves the user account data of a government agency, which must be kept confidential. We therefore show only the general scope of work, without giving the name of the agency, the names of individual software components or the system connection structure.
What should a maintenance report per contract period include?
In this case, the first-period report had a table comparing contract requirements with work results, the software licence renewal results, the status of each system checked, and the problem-resolution log for that month. This structure helps the committee carry out acceptance item by item.
Does a normal status in the report mean the system was available throughout the contract?
No. The normal status in the first-period report is the result for that period only. Availability in other periods must be read from each period's report.
If you want to contract out user account system administration, what should you prepare first?
Prepare a list of the systems to be looked after, the software whose licences need renewing with their expiry dates, and the acceptance cycle your organisation uses. Then contact us to discuss the contract scope.
