White House makes Login.gov mandate final with two-year governmentwide rollout

The White House has finalized its plan to make Login.gov the universal sign-on for most public-facing federal services, converting a draft policy disclosed last week into a governmentwide mandate with firm deployment deadlines and new requirements governing competing identity providers.

On Monday, the Office of Management and Budget (OMB) issued Memorandum M-26-18, Scaling Use of Login.gov to Deliver a Universal Sign-on for Public Services, requiring agencies to deploy Login.gov across covered federal websites over the next two years. A separate White House fact sheet says the policy puts the government on a path toward “a universal sign-on across services.”

The OMB’s draft that was circulated last week required agencies to make Login.gov available for most public-facing services requiring authentication. The final policy largely preserves that approach but provides considerably more detail about how and when agencies must carry it out.

Agencies now have one year to deploy Login.gov on covered websites supporting services designated by OMB as High Impact Service Providers. Within two years, they must deploy it on all existing public-facing websites covered by the policy or submit a notice to OMB explaining why they cannot.

The final memorandum also puts tighter limits on agencies’ continued use of other identity providers.

The draft made clear that commercial services such as ID.me or CLEAR would not necessarily be displaced. The final policy confirms that agencies may retain alternatives when Login.gov cannot meet the needs of a particular population or operational requirement, or when eliminating an existing sign-on would place a significant burden on users.

But it goes further by directing agencies to phase out identity solutions that no longer meet those conditions, regularly reconsider whether alternatives remain necessary and promote Login.gov as the default option for new accounts among populations it can serve.

That makes the final policy more than an instruction to add Login.gov alongside existing systems. It establishes an explicit presumption in favor of consolidating federal authentication and identity verification around the government-operated platform while preserving exceptions for services and users Login.gov cannot adequately accommodate.

The implementation timetable also changed from the version described last week.

The 60-day deadline for agency chief information officers to inventory public-facing websites requiring authentication remains.

Agencies now have 240 days to conduct Digital Identity Risk Management assessments under National Institute of Standards and Technology’s (NIST) SP 800-63-4, rather than the six-month period described in reporting on the draft. NIST has 120 days to publish a resource to help agencies conduct those reviews.

The final memorandum also gives considerably more definition to Login.gov’s longer-term evolution.

Within six months, the General Services Administration (GSA) must assess opportunities to create and use verifiable digital credentials, with veteran status cited as an example, and identify ways to reduce repeated collection of the same information from users.

GSA must also hold an industry day examining commercial digital identity technologies that Login.gov could potentially use.

Within a year, GSA and NIST are directed to explore additional capabilities, including accepting credentials issued by commercial credential service providers and allowing identity verification to become progressively stronger according to the risk posed by a particular transaction.

“Login.gov unlocks the potential for users to re-use their information as they interact across services,” the White House said, arguing that government currently pays in some cases to verify the same person repeatedly or pays commercial vendors to verify identity attributes against information government agencies themselves maintain.

Article Topics

digital government  |  digital identity  |  identity proofing  |  Login.gov  |  NIST Special Publication 800-63  |  single sign-on  |  U.S. Government