The White House Office of Management and Budget (OMB) is directing federal agencies to deploy Login.gov across most public-facing websites within two years, according to an Aug. 31 memo from OMB Director Russel Vought.
The Login.gov platform is administered by the General Services Administration (GSA) and acts as a digital front door to the federal government. The system provides federal agencies with a single sign-on platform to verify the identity of individuals seeking access to government websites.
“This policy enforces Login.gov as the universal sign-on for accessing public services online, enabling more seamless and efficient service delivery while safeguarding user privacy and supporting resilience against fraud and security threats,” Vought wrote in the memo.
In a fact sheet, the White House said the new policy aims to improve the user experience by allowing Americans to reuse their information across government services. It also seeks to increase the adoption of digital services and save taxpayer dollars by consolidating agencies around a single digital identity solution.
In a Sept. 1 press release, GSA said it will lead the implementation of OMB’s directive and is “prepared to support increased demand from federal agencies” with onboarding, technical guidance, integration assistance, and other resources as they transition to Login.gov.
“Expanding Login.gov adoption creates a more simple, safe, and consistent digital government experience for the American people,” said GSA Administrator Edward Forst. “GSA is proud to lead that transformation by bringing the operational capacity, technical expertise, and infrastructure needed to rapidly implement OMB’s directive.”
Deadlines for federal agencies
The memo sets a series of implementation deadlines for federal agencies. Within 60 days, agencies must report inventories of public-facing websites that use authentication. Agency chief information officers are responsible for coordinating the reports.
Within 240 days, agencies must complete a digital identity risk assessment for public-facing digital services that use authentication or identity verification.
Within one year, OMB said agencies must adopt Login.gov best practices from GSA. Also within a year, agencies must deploy Login.gov on all existing in-scope websites for designated High Impact Service Providers.
Agencies have two years to deploy the platform across all other existing in-scope websites.
The requirements apply to public-facing agency websites used by individuals acting on their own behalf. They do not apply to services accessed solely by organizations, people acting for organizations, or people acting on another individual’s behalf, though OMB encouraged agencies to expand Login.gov to those services where appropriate.
The mandate also does not apply to the Department of Defense, intelligence community elements, or national security systems. OMB encouraged the Pentagon to offer Login.gov on public-facing websites that require authentication where practicable.
Agencies may continue offering commercial or other identity solutions when those tools address needs Login.gov cannot meet or avoid “imposing additional burden on a significant population of users.” However, OMB said agencies must promote Login.gov as the default for new accounts among populations the platform can serve.
The memo also directs agencies to “phase out identity solutions” that do not meet those conditions and routinely reassess the need for alternatives based in part on active user volume.
Agencies that cannot meet an implementation deadline must notify OMB, explain the operational requirements preventing compliance, and provide a personal certification from the agency head. The notification must also be shared with the appropriate congressional committees.
Deadlines for GSA and NIST
GSA, which operates Login.gov, has its own deadlines under the policy. Within 90 days, GSA must begin convening a cohort of agency customers at least quarterly to collect feedback on the product.
Within 180 days, the agency must publish a Login.gov implementation guide, incorporate relevant practices into the U.S. Web Design System, and host an industry day focused on commercial digital identity technology.
GSA must also report to OMB within 180 days on digital identity opportunities that could improve customer experience, including verifiable digital credentials and ways to reduce repeated information collection.
Within one year, GSA and NIST must explore expanding Login.gov’s services based on agency risk reviews. The memo points to potential capabilities such as inheriting credentials from commercial providers and increasing identity verification as transaction risk rises.
Finally, NIST has 120 days to publish a resource that helps agencies apply its digital identity risk management methodology.