{"id":3307,"date":"2019-08-27T09:54:03","date_gmt":"2019-08-27T13:54:03","guid":{"rendered":"http:\/\/gsablogs.gsa.gov\/technology\/?p=3307"},"modified":"2024-01-11T18:18:08","modified_gmt":"2024-01-11T23:18:08","slug":"new-omb-policy-puts-identity-management-in-perspective","status":"publish","type":"post","link":"https:\/\/gsablogs.gsa.gov\/technology\/2019\/08\/27\/new-omb-policy-puts-identity-management-in-perspective\/","title":{"rendered":"New OMB Policy Puts Identity Management in Perspective"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">Identity, Credentialing, and Access Management (ICAM) is the set of security disciplines that allows agencies to manage, monitor, and secure access to protected resources. These resources may be electronic such as files or computer systems, or physical resources such as server rooms and buildings.&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In May of this year, the Office of Management and Budget (OMB) released an updated policy on <a href=\"https:\/\/www.whitehouse.gov\/wp-content\/uploads\/2019\/05\/M-19-17.pdf\">Identity, Credentialing, and Access Management (ICAM)<\/a>. The policy provides ICAM guidance for the federal government and outlines specific responsibilities for federal agencies.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">As one of the agencies that leads governmentwide ICAM efforts, GSA is committed to ensuring the federal government\u2019s long-term viability, security, responsiveness, and efficiency. To do so, we have specific responsibilities regarding the ICAM acquisition solutions we make available to agencies.<\/span><\/p>\n<h2>ICAM Policy<\/h2>\n<p><span style=\"font-weight: 400;\">This ICAM policy comes at a crucial time. The discussion around defining identity is evolving rapidly. Identity is now more than just a person; it is a unique representation of a subject and can include devices like cell phones, tablets, TVs, or any network connected item. Ensuring the right people (or device) have the right credentials and access are paramount.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">OMB\u2019s ICAM policy gives the federal government direction by first clarifying what it considers to be identity. The policy further defines what it means to:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">manage those identities,&nbsp;<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">provide credentials to not only government employees and contractors but the public as well, and&nbsp;<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">allow access to the right information systems and physical access to buildings.&nbsp;<\/span><\/li>\n<\/ul>\n<h2>Agency-Level Responsibility<\/h2>\n<p><span style=\"font-weight: 400;\">ICAM is now an agency-level responsibility. Agencies\u2019 approach to ICAM should consider governance, architecture, and acquisition. The ICAM policy lays out agency responsibilities to meet policy outcomes accordingly.&nbsp;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">What must agencies do? Here\u2019s a high-level list:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Develop an agency-wide ICAM office, which may require more resources.&nbsp;<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Assess current ICAM capabilities, identify gaps for new capabilities, and develop plans to transition obsolete capabilities.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Use acquisition vehicles such as <a href=\"https:\/\/www.gsa.gov\/buying-selling\/category-management\/bestinclass\">Best-In-Class<\/a>, Tier 2, or federal shared services to procure new capabilities.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Also, the ICAM policy specifies responsibilities for agencies that lead governmentwide efforts in identity management. GSA, along with the National Institute of Standards and Technology (NIST), Office of Personnel Management (OPM), and Department of Homeland Security (DHS), will update to the ICAM guidance and develop ICAM roadmaps. The other agencies\u2019 responsibilities are described within the policy.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">GSA is specifically tasked with ensuring all current ICAM solutions and shared services are immediately available for agencies to use to begin meeting policy requirements.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Also, GSA will ensure ICAM acquisition solutions comply with this OMB ICAM policy as well as other relevant laws, standards, and guidance.<\/span><\/p>\n<h2>GSA\u2019s ICAM Solutions<\/h2>\n<p><span style=\"font-weight: 400;\">Agencies can visit GSA\u2019s eLibrary to see the current <a href=\"https:\/\/www.gsaelibrary.gsa.gov\/ElibMain\/searchResults.do;jsessionid=r6G1GPftwwEv+3LRDOqpnID6.prd2pweb64?searchText=ICAM&amp;searchType=allWords&amp;x=28&amp;y=5\">ICAM SINs on IT Schedule 70<\/a> available, which includes the <b>PKI Shared Service Provider (SSP) Program (132-61)<\/b>, <b>HSPD-12 (132-62)<\/b>, and <b>PKI Professional Services (132-60f)<\/b>.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Another important ICAM solution is the USAccess Program. GSA&#8217;s <a href=\"http:\/\/www.fedidcard.gov\/\">USAccess <\/a>program provides federal government agencies with identity credential solutions. This shared service provides an efficient, economical and secure infrastructure to support agencies\u2019 credentialing needs. Currently, the program supports over 600,000 users and continues to add more users.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The Department of Veterans Affairs is the most recent large federal agency to choose USAccess for its identity credentialing solution. When fully operational, this will bring over 500,000 additional cardholders onto the USAccess system.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Please follow us on Twitter <a href=\"https:\/\/twitter.com\/GSA_ITC\">@GSA_ITC<\/a> and <a href=\"https:\/\/www.linkedin.com\/company\/office-of-information-technology-category-itc-\">LinkedIn<\/a> to join our ongoing conversations about government IT.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Identity, Credentialing, and Access Management (ICAM) is the set of security disciplines that allows agencies to manage, monitor, and secure access to protected resources. These resources may be electronic such as files or computer systems, or physical resources such as server rooms and buildings.&nbsp; In May of this year, the Office of Management and Budget &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/gsablogs.gsa.gov\/technology\/2019\/08\/27\/new-omb-policy-puts-identity-management-in-perspective\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;New OMB Policy Puts Identity Management in Perspective&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1138,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[19152],"tags":[19190],"class_list":["post-3307","post","type-post","status-publish","format-standard","hentry","category-it-security","tag-usaccess"],"_links":{"self":[{"href":"https:\/\/gsablogs.gsa.gov\/technology\/wp-json\/wp\/v2\/posts\/3307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gsablogs.gsa.gov\/technology\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/gsablogs.gsa.gov\/technology\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/gsablogs.gsa.gov\/technology\/wp-json\/wp\/v2\/users\/1138"}],"replies":[{"embeddable":true,"href":"https:\/\/gsablogs.gsa.gov\/technology\/wp-json\/wp\/v2\/comments?post=3307"}],"version-history":[{"count":7,"href":"https:\/\/gsablogs.gsa.gov\/technology\/wp-json\/wp\/v2\/posts\/3307\/revisions"}],"predecessor-version":[{"id":3318,"href":"https:\/\/gsablogs.gsa.gov\/technology\/wp-json\/wp\/v2\/posts\/3307\/revisions\/3318"}],"wp:attachment":[{"href":"https:\/\/gsablogs.gsa.gov\/technology\/wp-json\/wp\/v2\/media?parent=3307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/gsablogs.gsa.gov\/technology\/wp-json\/wp\/v2\/categories?post=3307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/gsablogs.gsa.gov\/technology\/wp-json\/wp\/v2\/tags?post=3307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}