Full Breakdown
OMB Mandates Federal Agencies to Adopt Login.gov for Public-Facing Websites
9/4/2026, 5:54:36 AM
Core Event: Unified Sign-On Requirement
The Office of Management and Budget (OMB) issued a memo in August 2026 directing most federal agencies to deploy Login.gov as the default authentication platform for their citizen-facing websites. The two-year rollout sets milestones, with exemptions for services that serve organizations, act on behalf of another individual, or are classified as national-security systems.
Background & Context
Login.gov, launched by the General Services Administration (GSA) in 2017, serves as a single sign-on (SSO) gateway for federal digital services. A July 2025 Government Accountability Office (GAO) report showed agencies spent roughly $209 million on commercial identity solutions versus $32.5 million on Login.gov, while about 190 million users authenticated through Login.gov compared with ?60 million on the four leading commercial systems combined. In 2023 the GSA Inspector General found the Technology Transformation Service had misrepresented Login.gov’s compliance with NIST SP 800-63-3 for four years. OMB labeled the fragmented landscape a “burden on citizens” and called for a universal solution.
Timeline of Implementation Milestones
- August 2026 – OMB memo released.
- Within 60 days – Agencies submit inventories of public-facing sites that require authentication.
- Within 120 days – NIST publishes guidance for the upcoming SP 800-63-4 Digital Identity Guidelines.
- Within 240 days – Agencies conduct Digital Identity Risk Management (DIRM) reviews.
- Within 1 year – Agencies must deploy Login.gov on all designated High-Impact Service Provider (HISP) sites or submit an exemption notice.
- Within 2 years – Full deployment across all remaining in-scope websites or submission of exemption notices.
GSA will convene agency customers quarterly (starting within 90 days), publish an implementation guide and integrate best practices into the U.S. Web Design System (both within 180 days), and host an industry day on commercial digital-identity technologies (also within 180 days). NIST is tasked with releasing a resource to support agency DIRM efforts within 120 days.
Data & Statistics
- Spending (FY 2020-2023): $209 million on commercial solutions; $32.5 million on Login.gov.
- User volume (FY 2020-2023): 190 million Login.gov users vs. ~60 million across four major commercial providers.
- Agency adoption (CFO Act agencies): 15 use Login.gov exclusively, 6 use it alongside commercial tools, 3 rely solely on commercial solutions.
Official Statements & Responses
- “And as use of Login.gov for identity verification increases, the government realizes cost efficiencies from economies of scale and a reduction in duplicative verification costs…,” — Russ Vought, OMB director
- “Expanding Login.gov adoption creates a more simple, safe, and consistent digital government experience for the American people,” — Edward Forst, GSA Administrator
What’s Next
Agencies unable to meet a deadline must certify the shortfall to OMB and notify the relevant congressional committees. GSA will continue quarterly outreach, and NIST’s forthcoming SP 800-63-4 guidance will define the assurance levels agencies must apply during DIRM reviews.
