OMB Mandates Login.gov Across Federal Portals, Curtailing Commercial Alternatives
The Office of Management and Budget has issued a mandate requiring federal civilian agencies to integrate GSA's Login.gov as the primary single sign-on platform across public-facing websites within two years, while setting strict guidelines for commercial identity vendor offboarding.
The Office of Management and Budget (OMB) has issued Memorandum M-26-18, establishing a binding two-year timeline for federal civilian agencies to deploy the General Services Administration’s (GSA) Login.gov as the default authentication mechanism across public-facing portals. Under the strategy, agencies face immediate compliance milestones: submitting an inventory of public-facing authenticated websites within 60 days, conducting digital identity risk assessments within 240 days, and fully adopting GSA best practices within one year. Notably, the Department of Defense, elements of the intelligence community, and national security systems are exempt from mandatory deployment, though DoD is encouraged to integrate Login.gov for public-facing sites where practical.
This policy signals a major market pivot for commercial Credential Service Providers (CSPs) such as ID.me and CLEAR. While agencies retain conditional flexibility to offer third-party tools for specialized operational requirements or to prevent user disruption, OMB mandates that Login.gov become the mandatory default for all new account creations. Furthermore, civilian agencies are ordered to systematically evaluate active user volumes and phase out redundant commercial identity solutions, effectively shrinking the long-term federal addressable market for standalone commercial authentication contracts.
Signal Pro feature
This signal is in the subscriber archive.
Signals older than seven days are reserved for members. Subscribe to read the full analysis and unlock the complete Defense Signals archive.
Executive takeaway
Subscribe to receive signals like this — plus the executive analysis behind them.
Get the Signals