State of Identity in Government 2026
US federal government IAM benchmarks — FedRAMP authorization counts, phishing-resistant MFA adoption per OMB M-22-09, Zero Trust architecture maturity across CFO Act agencies, and CISA Emergency Directive enforcement state.
Reviewed
2026-05-22
5 benchmarks · CC BY 4.0
Regulators
OMB (Office of Management and Budget) · CISA · GAO · agency Inspectors General · FedRAMP PMO
Effective
OMB M-22-09 phishing-resistant MFA mandate
OMB M-22-09 (Jan 2022) requires federal agencies to deploy phishing-resistant MFA for all users by end of FY24. Implementation is mostly complete at CFO Act agencies; smaller agencies + components have catching up.
Source: OMB · 2024
Mid-implementation
Federal Zero Trust strategy maturity
The Federal Zero Trust Strategy (M-22-09) drives a multi-year arc. Agencies report mid-implementation as of 2026 — identity pillar mature, devices + network pillars trailing.
Source: OMB + agency IG reports · 2026
Near-universal at CFO Act agencies
PIV + CBA adoption
PIV cards + certificate-based authentication are the long-standing federal baseline. M-22-09 confirms PIV remains compliant; FIDO2 also accepted.
Source: NIST + agency practice · 2025
Frequent in 2024-2025
CISA Emergency Directives invoking identity
CISA Emergency Directives ED-24-01 (Ivanti), ED-24-02 (Midnight Blizzard / Microsoft email), and others invoke identity-adjacent compromises requiring rapid federal response.
Source: CISA · 2025
Cite this page
Reference our benchmarks in your reporting.
These benchmarks are licensed under CC BY 4.0 — free to cite, quote, and link to with attribution. Pick a format below.
askmeidentity. (2026). The State of Identity, live (v2026.05). Retrieved 2026-05-22 from https://askmeidentity.com/resources/state-of-identity-government/
"The State of Identity, live." askmeidentity, v2026.05, https://askmeidentity.com/resources/state-of-identity-government/. Accessed 2026-05-22.
@misc{askmeidentity_state_of_identity_2026_05, title = {The State of Identity, live}, author = {{askmeidentity}}, year = {2026}, note = {Version 2026.05, retrieved 2026-05-22}, url = {https://askmeidentity.com/resources/state-of-identity-government/} }