WASHINGTON, Nov. 10, 2026 — The U.S. Treasury is seeking a contractor to oversee the security and administration of shared authentication systems used by the Bureau of the Fiscal Service as federal policy expands Login.gov use across public-facing government services.

The Bureau of the Fiscal Service issued a sources-sought notice Nov. 5, seeking qualified businesses in the Small Business Administration's 8(a) Business Development Program to provide engineering, project management and Federal Information Security Modernization Act (FISMA) compliance services for its Authentication Services General Support System (AS GSS).

The system includes the Common Approach to Identity Assurance (CAIA), which connects Fiscal Service applications to federal credentials and external credential service providers, including ID.me and Login.gov. Responses to notice SS-FSA-27-005 are due Nov. 16 at 3 p.m. EST.

The proposed contract runs from Feb. 5, 2027, through Nov. 4, 2031, with a nine-month base period followed by four 12-month options. The pricing sheet identifies Engineer and Project Manager labor categories. The notice is market research to identify qualified 8(a) businesses and does not constitute a request for proposals or a commitment to make an award.

Treasury’s Identity Systems

CAIA provides a shared authentication system for Fiscal Service applications, allowing them to accept credentials from multiple identity providers rather than maintain separate identity systems. The system connects Treasury applications to federal credentials and commercial providers such as ID.me, as well as Login.gov.

Treasury documentation describes CAIA as a federated architecture that accepts credentials from external credential service providers. Fiscal Service also replaced IBM Security Identity Manager with SailPoint IdentityIQ for application permission management. The architecture allows applications to use different identity providers according to their assurance requirements.

An August 2023 Fiscal Service onboarding guide explained why several CAIA-connected financial applications requiring Identity Assurance Level 2 (IAL2) could not then use Login.gov. It noted: “Login.gov does not have a current IAL2 compliant offering, leaving ID.me as the only current CAIA-enabled CSP IAL2 offering.”

Applications whose Digital Identity Risk Assessment required Identity Assurance Level 1 (IAL1) could use either Login.gov or ID.me. Applications requiring IAL2, including the Intra-governmental Payment and Collection system and G-Invoicing, had to use ID.me. Login.gov introduced an IAL2-compliant identity verification service in September 2024, and the General Services Administration announced the capability the following month.

Fiscal Service’s Do Not Pay portal allows users without federal personal identity verification (PIV) credentials to authenticate through either ID.me or Login.gov using CAIA. Its enrollment materials also list PIV and Common Access Card (CAC) authentication. The Automated Standard Application for Payments (ASAP), however, requires recipient-organization users to verify their identities through ID.me, which Fiscal Service identifies as the only available option at present. Its guidance also requires public users to provide a driver's license and Social Security number as part of the CAIA integration.

Contractor Responsibilities

The contractor would perform Information System Security Officer (ISSO) duties and FISMA compliance work for the AS GSS. Responsibilities include creating and maintaining security documentation, overseeing security controls, managing FISMA lifecycle tasks, and conducting continuous monitoring through the government's governance, risk, and compliance tool.

The contractor would also serve as an audit liaison for reviews of Authentication Services and CAIA-connected applications. These include audits involving the Schedule of the Federal Debt, Consolidated Financial Statements, the Treasury Office of Inspector General and the Government Accountability Office. The work includes addressing findings from vulnerability scans and coordinating remediation.

Other duties cover Identity, Credentialing and Access Management (ICAM) operations, help desk services, access management, user provisioning, account reconciliation and recertification, business continuity and disaster recovery. The contractor would respond to daily program and user-access issues and maintain policies, standards and procedures governing access to Fiscal Service IT resources.

Technical responsibilities include maintaining public key infrastructure (PKI), Lightweight Directory Access Protocol (LDAP) directory services, single sign-on (SSO), Splunk enterprise log management, Vault and CAIA services. The contractor would also participate in cloud migration initiatives and address security requirements established by the National Institute of Standards and Technology (NIST), Treasury and Fiscal Service, and business-line security requirements. Additional duties include personnel training on NIST requirements, ICAM technical status meetings, contract reporting, government-furnished property records, and coordination with Fiscal Service and Federal Reserve Bank information system security officers and system owners. The notice also identifies possible integration work involving Enterprise User Access software, CAIA, SailPoint IdentityIQ and other access management systems.

Login.gov Requirements

The Office of Management and Budget issued Memorandum M-26-18 on Aug. 31, directing agencies to expand Login.gov use across covered public-facing services. Agencies must offer Login.gov as a sign-in option on covered websites. When a service requires identity verification in addition to authentication, agencies must use Login.gov’s identity verification service unless they determine it cannot meet requirements specific to the service's users, risk profile, or operations.

The policy excludes websites for services used solely by businesses or other organizations, people acting on behalf of organizations, and people acting on behalf of another individual. Agencies may retain other identity services for specific user groups or operational requirements that Login.gov cannot meet. They must regularly reassess those alternatives and promote Login.gov as the default for new accounts among populations it can serve.

Photo credit: Pexels

The memorandum requires agencies to inventory public-facing websites with authentication within 60 days and complete digital identity risk assessments within 240 days. Agencies must deploy Login.gov on existing covered websites associated with services OMB has designated as HISPs within one year, and on other existing covered websites within two years. Agencies unable to meet the deadlines must notify OMB, explain the operational requirements, and provide an agency-head certification to Congress. A Sept. 29 executive order, titled Streamlining Access to Government Services Through America.gov, separately directs agencies to integrate covered online services with America.gov and complete Login.gov integration in accordance with the memorandum. The order generally covers public-facing federal services with more than 100,000 users in a 12-month period, subject to specified exclusions.

Treasury’s use of commercial identity providers has also drawn scrutiny from Sens. Ron Wyden and Elizabeth Warren. In an Oct. 27 letter, they asked Treasury and the Internal Revenue Service to explain their reliance on ID.me, identify security, technical, capacity and fraud-prevention requirements Login.gov cannot meet, disclose payments to ID.me over the previous four years, and provide a timetable for making Login.gov available where it meets agency requirements. They also requested a delay in the TreasuryDirect ID.me requirement until after the 2027 tax filing deadline. ID.me became the only login method for TreasuryDirect on Oct. 28. The contractor sought through the procurement would administer and secure the authentication infrastructure; decisions about which identity providers individual applications use would remain with the government.