OMB issues anticipated memo enforcing Login-dot-gov use

The Office of Management and Budget has officially released a memo directing agencies to expand the use of Login-dot-gov for user identity verification in a push to make it the universal sign-on for public services.

In a six-page document dated Monday, OMB Director Russell Vought told agencies the absence of a clear strategy has led to agencies deploying various sign-on solutions and taking different approaches to digital identity management. Per the memo, that means users often need multiple sign-ons and the government pays more.

“This policy enforces Login.gov as the universal sign-on for accessing public services online, enabling more seamless and efficient service delivery while safeguarding user privacy and supporting resilience against fraud and security threats,” Vought said in the memo.

Official release of the policy comes after OMB recently circulated a draft version of the document to leaders for feedback. FedScoop obtained a copy of that draft and first reported on its contents last week. At the time, current and former officials viewed the policy as an effort to continue a longstanding push to establish a single sign-on for government.

Login, which is run by the General Services Administration, was first envisioned under President Barack Obama, launched in 2017 during President Donald Trump’s first term and continued under President Joe Biden. It was created after Congress required that agencies establish a single sign-on platform for government website logins. As of late last year, Login was used at over 50 federal and state agencies, per a 2025 roadmap.

While the memo enforces use of Login for public-facing websites, it doesn’t prohibit the use of other identity verification services. It allows other services to help the agency either meet needs that Login can’t fill or to avoid burdening certain populations, such as those that currently rely on another sign-on service. 

The memo includes multiple deadlines for agencies, GSA and the National Institute of Standards and Technology. 

The first of those deadlines is for agencies, which must inventory all public-facing websites with authentication elements within 60 days. That responsibility rests with chief information officers. Agencies also must adopt GSA’s best practices for Login within a year and eventually implement the system on all covered websites within two years. 

GSA is required to regularly convene agency customers for input beginning in 90 days, establish best practices in 180 days, and host an industry day to get feedback on technologies that Login could leverage also in 180 days, among other tasks. The memo also orders a new Digital Identity Risk Management resource from NIST that helps agencies implement existing guidance within 120 days.

The memo comes amid a couple of key leadership changes.

Monday was Greg Barbaccia’s last day as federal CIO. Barbaccia notably held roles at GSA, and a source at the agency previously told FedScoop the plan was to try to get the Login memo out before he left. 

Login also has a new leader. Department of Treasury CIO Sam Corcos was recently named acting assistant commissioner of Login, in addition to two other GSA titles, as reported first by FedScoop. He’ll hold all three concurrently with his Treasury role. 

CyberScoop’s Derek Johnson and FedScoop’s K. Sophie Will contributed reporting.