OMB Mandates Login.gov as Default Federal Sign-On by 2028

Key points

• OMB Director Russ Vought’s memo mandates Login.gov for most public-facing federal websites, excluding Defense Department and national security systems.
• Agencies must inventory authenticated websites within 60 days and conduct digital identity risk management reviews within six months.
• The policy allows exemptions for specific user groups, such as businesses and individuals acting on behalf of others, but requires Login.gov to be the default option.
• GSA is tasked with publishing implementation guides, hosting industry days, and reporting on customer experience improvements within six months.
• The mandate follows a 2025 GAO report highlighting that agencies spent $209 million on commercial identity solutions versus $32.5 million on Login.gov between 2020 and 2023.

Background

Login.gov was launched by the General Services Administration (GSA) in 2017 to fulfill a 2015 congressional directive for a single sign-on platform. Despite its existence, adoption has been uneven, with many agencies relying on commercial providers like ID.me or CLEAR. A 2023 GSA inspector general report found that the Technology Transformation Service had misled agencies about Login.gov’s compliance with NIST standards, leading to a loss of confidence and continued investment in alternative systems. This new OMB memo seeks to reverse that trend by enforcing a governmentwide standard.

How outlets are covering it

Federal News Network emphasizes the cost efficiencies and security benefits of a unified system, noting that fragmented approaches create unnecessary burdens for citizens. Biometric Update highlights the technical evolution of Login.gov, including new device fingerprinting and mobile driver’s license verification, while noting concerns about fraud in the Identity Assurance Level 2 workflow. ExecutiveGov focuses on the administrative requirements, such as the 60-day inventory deadline and GSA’s role in coordinating with commercial providers. All sources agree that the policy is a significant step toward standardizing federal digital identity, though some note that agencies may still use commercial solutions alongside Login.gov for specific use cases.

Why it matters

This policy could save billions in duplicative spending and improve the user experience for millions of Americans interacting with federal services. It also strengthens the government’s security posture by allowing centralized deployment of advanced anti-fraud technologies. However, the success of the mandate depends on addressing past issues with Login.gov’s reliability and ensuring that exemptions do not undermine the goal of a unified identity system.

What to watch

Agencies must submit an inventory of authenticated public-facing websites to OMB within 60 days. NIST is expected to publish a resource within 120 days to help agencies implement NIST Special Publication 800-63-4. Agencies have 240 days to conduct digital identity risk management reviews. Within one year, agencies must deploy Login.gov on all High Impact Service Provider websites, and within two years, on all in-scope websites. GSA will hold quarterly meetings with agencies and publish a best-practices guide within six months.