MANAGEMENT UPDATE.

MODERNIZING DIGITAL IDENTITY MANAGEMENT

Last Tuesday, August 25, the National Association of State CIOs (NASCIO) issued its latest report on citizen digital identity management, the framework of efforts that governments are using to create and manage secure identities for residents.

At a time when this is an extremely hot topic – with growing concerns about privacy and validity, this research couldn’t be timelier.

As the report finds, “states are increasingly treating digital identity as a foundational component of modern government, moving away from fragmented, agency-by-agency systems toward centralized or hybrid enterprise approaches.”

The report was based on responses from CIOs, CISOs and CTOs in 47 states and territories.

Clearly there are lots of hurdles to overcome as states “continue to face significant obstacles, including inadequate funding, siloed identity solutions, organizational resistance and technical debt, even as emerging AI-enabled threats add new urgency to the issue,” according to the report.

In response, NASCIO found that states are “working diligently to address the burgeoning challenges, threats and costs incurred by our citizens. . . State governments are creating, experimenting, collaborating, learning and building a portfolio of business and technical capabilities to ensure government services are delivered to those who are intended to receive them.”

The major themes covered by NASCIO include the following:

“Many states described implementing enterprise identity platforms that provide common authentication services, while still allowing agencies to retain responsibility for program-specific authorization, business rules and user attributes. This hybrid model reflects the practical realities of state government environments, where agencies often maintain different operational needs, statutory authorities and legacy technology environments”.

“Multiple respondents described large-scale enterprise identity platforms intended to centralize authentication, enable secure data sharing and improve consistency across state services. Some states reported supporting millions of constituent accounts across dozens of agencies while integrating identity verification, adaptive authentication and shared user profile capabilities into their enterprise platforms. Others described statewide single sign-on environments intended to consolidate access across hundreds of systems and applications.”

“Many states acknowledged they remain in transitional stages of implementation. Numerous respondents described ongoing migrations from decentralized and fragmented agency-managed identity environments toward more centralized enterprise models. Several states noted that legacy applications continue to operate outside enterprise identity platforms and that modernization efforts are proceeding incrementally over time. Responses frequently referenced phased onboarding strategies, gradual agency adoption and modernization roadmaps extending over multiple years.”

“The responses demonstrated that citizen digital identity initiatives are often tightly coupled with larger digital transformation strategies rather than being pursued as standalone identity projects. Many respondents linked their identity modernization efforts to statewide portal initiatives, business service modernization, or “one-stop shop” government service strategies. In these cases, identity management functions as an enabling layer supporting broader goals around digital government integration and service delivery transformation.”

“States repeatedly framed digital identity as a mechanism for reducing friction in citizen interactions with government. Respondents referenced goals such as minimizing password resets, enabling seamless navigation between agencies, simplifying access to services and consolidating multiple user accounts into unified resident profiles. Several states specifically referenced ‘digital front door’ strategies intended to create a more intuitive and citizen-centered government experience.

“More mature programs often described strong central leadership through statewide CIO authorities, enterprise technology offices, or formal governance structures that establish common standards and adoption requirements. Some states require the use of centralized identity services for new systems or include enterprise identity requirements within vendor contracts. Others are relying more heavily on collaboration, onboarding playbooks and shared services models to encourage adoption across agencies.”

“Respondents from more mature states increasingly described risk-based approaches that align verification requirements with the sensitivity of services being accessed. Several states referenced identity proofing, adaptive security controls, multi-factor authentication, biometric validation and tiered trust models designed to balance usability with fraud prevention”.

The report also offered a number of recommendations, including that:

Identity management is recognized as a cornerstone capability for security, privacy, digital service delivery and citizen experience.

Identity management must be a centralized capability for effectiveness, consistency within state government and for those connecting with state government.

Identity management architecture will continue to evolve. Future approaches will include elements such as self-sovereign identity and digital wallets that address the necessity of centralized governance and the existing myriad of applications and program services.