Identity for Government & Public Sector

The job identity does in government

Government identity operates at two extremes: workforce and mission systems that demand the highest assurance, and citizen-facing services that must serve an entire population, including people with limited devices or digital skills. A third population is easy to miss: contractors, vendors and private companies granted access to government systems and registers.

Government accounts for 4 of the 123 incidents in the Identity Breach Database (3.3%). Each failed differently: a third party's register access, a hijacked VPN session that got past MFA, a stolen vendor key, and a test account an IT provider created in 2012 and never removed. Two were attributed to nation-state actors, and three ran through access held by someone outside the agency.

The identity threat picture, from the incident record

A vendor's key into Treasury workstations. In December 2024 an attacker used a stolen key BeyondTrust used to secure its Remote Support SaaS to bypass the service's security, remotely access some US Treasury workstations and take unclassified documents. Treasury attributed it to a China state-sponsored actor and reported it to Congress as a major incident. No human login was involved, so MFA was not applicable: remote support tools are privileged access paths, and this was static API key abuse. BeyondTrust disclosed CVE-2024-12356 the same month but has not said how it figured in the attack.

MFA that did not survive the gateway. From January 2024 a nation-state actor breached MITRE's NERVE research network by exploiting two Ivanti Connect Secure zero-days, including CVE-2023-46805, hijacking VPN sessions to get past MFA and using compromised accounts including an administrator. It echoes the 2021 Pulse Connect Secure exploitation that led CISA to issue Emergency Directive 21-03. See session hijacking and session cookie theft.

A national register queried through a private company. Denmark's CPR administration disclosed on 5 October 2026 that Pays ApS's lawful access to the CPR register was abused to retrieve data on about 8.8 million people, through about 14 million automated searches between 10 and 20 September. A person claiming responsibility said the password was 123456; authorities have not confirmed that.

A test account nobody removed. The UK ICO found that ransomware reached Data Cymru, the Welsh local government data unit, on 1 November 2024 through "Test2", a test account its IT provider Ogi Networks created in January 2012 with the password "Password1", and that local administrator accounts on the three affected systems had kept the same password for more than 12 years. The attacker took 42GB, exposing personal information on 3,300 people, most of them children. On 20 October 2026 the ICO reprimanded both organizations under UK GDPR Article 32, and Data Cymru also under Article 28(4) for having no compliant processing contract. See orphaned account abuse and orphaned accounts.

Outside the sector tally, Storm-0558 forged Microsoft tokens to read Exchange Online mail and was detected by the US State Department through its own audit logs; see also Midnight Blizzard.

The regulatory floor

• US federal workforce and public users. OMB M-22-09 (26 January 2022) set the zero trust strategy: "For agency staff, contractors, and partners, phishing-resistant MFA is required," and "For public users, phishing-resistant MFA must be an option." For routine self-service access, agency systems must discontinue methods that fail to resist phishing, including SMS or voice, one-time codes and push notifications, and must drop password rules requiring special characters or regular rotation. The strategy's goals were due by the end of FY2024, and the memo points to the PIV cards agency staff and partners are generally issued as the ready-made phishing-resistant token. Our OMB M-22-09 page breaks down the identity requirements.
• Assurance levels. NIST SP 800-63-4, final on 31 July 2025, supersedes 800-63-3. In 800-63B-4, verifiers "SHALL offer at least one phishing-resistant authentication option at AAL2", AAL3 requires a non-exportable private key so syncable passkeys are out at that level, single-factor passwords must be at least 15 characters, and periodic forced changes are prohibited. See NIST SP 800-63, AAL, IAL and FAL.
• Cloud authorization. FedRAMP announced FedRAMP 20x in March 2025; it is in phase 3 (wide-scale adoption), and FedRAMP says it "will stop accepting new Rev5 Certifications on June 11, 2027." Check a vendor's current status on the FedRAMP Marketplace rather than its marketing, and see the FedRAMP regulation page for the 20x identity indicators and dates.
• Law enforcement. The CJIS Security Policy requires MFA for privileged and non-privileged accounts (IA-2(1) and IA-2(2)) for anyone accessing criminal justice information; version 6.1 took effect 26 June 2026. Texas DPS told agencies that MFA is already sanctionable at audit and that they have until 1 October 2027 to update IA-1 policies to mandate MFA for all users. See CJIS.
• Defense contractors. CMMC Phase 2 begins 10 November 2026, when DoD intends to require Level 2 third-party certification, covering NIST SP 800-171 controls including MFA and least privilege, for applicable contracts. Phase 3 follows on 10 November 2027. See the CMMC regulation page for the identity controls by level.
• EU. Every Member State must offer at least one EU Digital Identity Wallet by 24 December 2026, with public authentic-source attributes verifiable the same day; see eIDAS 2. NIS2 applies to public administration at central and regional level, per the Commission; see identity controls for NIS2.

The identity controls that matter most

1. Phishing-resistant MFA for everyone with agency access. PIV or CAC where issued, FIDO2 keys for contractors and partners without one. Retire SMS, OTP and push for routine access, as M-22-09 requires. See implementing passkeys in the enterprise.
2. Vendor and remote support access treated as privileged. Treasury shows a vendor-held credential can reach endpoints directly. Require short-lived, scoped credentials, customer-side approval per session and recording; see implementing PAM and API key rotation.
3. Session binding and re-authentication behind remote access gateways. MITRE's MFA was bypassed by a hijacked session. Patch appliances fast, replace exposed VPNs with ZTNA, and require fresh authentication before admin actions.
4. Strong authentication and query limits for third parties on registers. The Danish CPR case is millions of lookups through one company's access. Phishing-resistant MFA for every organization with register access, plus rate limits and alerts on bulk queries.
5. High-assurance, equitable proofing for citizens. Choose the IAL per service, offer in-person or trusted referee paths, and accept mobile driver's licenses and wallets as they arrive. See identity proofing and login.gov.
6. Audit that an agency can act on. Storm-0558 was caught from the State Department's own logs. Retain and monitor identity provider and mailbox access logs; see ITDR.

Workforce vs citizen identity

Vendor shortlist

• Workforce IAM: Microsoft Entra ID, Okta or Ping Identity; self-hosted Keycloak where sovereignty rules out SaaS. See best identity tools for government.
• Governance: SailPoint; see best compliant IGA platforms.
• Privileged and vendor access: CyberArk (Idira); see best compliant PAM platforms.
• Credentialing and PKI: Entrust.
• Phishing-resistant hardware: Yubico; see best phishing-resistant MFA and the MFA matrix.
• Citizen proofing: ID.me among others; see best identity verification for enterprises.

Background is in identity for government, and national schemes are tracked in digital IDs.

Common pitfalls

• Equity failures in citizen proofing that lock out legitimate users.
• Legacy and mission systems excluded from phishing-resistant MFA.
• Vendor remote support and API keys outside privileged access controls.
• Treating FedRAMP authorization as the finish line rather than the floor.

Where it is heading

The Rev5 cut-off in June 2027, CMMC phases 2 and 3, and CJIS's 2027 policy deadline all land in the next year. EU wallets arrive in December 2026, and private relying party acceptance follows in December 2027, which will reduce repeat proofing for citizens.

Frequently asked questions

What does OMB M-22-09 require for MFA?

Phishing-resistant MFA for agency staff, contractors and partners, and a phishing-resistant option for public users. It names PIV and WebAuthn as phishing-resistant approaches.

When was NIST SP 800-63-4 published?

The final version was published on 31 July 2025 and supersedes SP 800-63-3.

Does CJIS require MFA?

Yes. The CJIS Security Policy requires MFA for both privileged and non-privileged accounts that access criminal justice information.

How was the US Treasury breached in 2024?

Through a stolen key that BeyondTrust used to secure its Remote Support SaaS, which let the attacker bypass the service's security and remotely access some Treasury workstations.