Reference · In review
M-19-17 and FICAM Crosswalk
OMB M-19-17’s identity requirements, section by section, and the FICAM Architecture’s services, each mapped to where the workbook treats it and the evidence it leaves
Status — In review
This page is under review and is not yet part of the workbook's production guidance. Its claims are sourced, but its analysis and any recommendation are the program's working view; they may change before review is complete, and they are not endorsed by any federal agency. Last reviewed 2026-11-02.
OMB M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management (May 21, 2019), is the federal ICAM policy. It tells agencies to govern identity as one program, to manage the identities of devices and automated technologies as well as people, to use PIV and derived PIV, and to federate.1 The FICAM Architecture on idmanagement.gov breaks the same territory into services. This page maps both onto the workbook, so an ISSO or assessor can find the chapter and the evidence for each requirement, and see which ones the workbook doesn’t reach.
It builds on the Federal Framework Crosswalk, which lists M-19-17 among the sources the books cite, and sits beside the RMF Map.
How to read the marks
| Mark | Meaning |
|---|---|
| Strong | The workbook says what the requirement asks, who does it, how, and what evidence shows it done |
| Partial | The requirement is treated, but only part of it, or without the evidence |
| Gap | No page treats it |
| Out of scope | Deliberately outside the workbook, with the reason stated |
Marks come from reading the linked pages, not from keyword counts. The FICAM Architecture is design guidance: idmanagement.gov describes it as “a framework for an agency to use in the ICAM program and solution roadmap planning,” not as policy.2 M-19-17 is policy: its “shall” items are requirements, and it says agencies must implement SP 800-63 and its successors.3
The workbook by identity area
The summary first: one row per identity area, with the M-19-17 sections and FICAM services that cover it.
| Area | M-19-17 | FICAM services | Where in the workbook | Evidence | Mark |
|---|---|---|---|---|---|
| Workforce identity | §III.1; §IV Architecture 1 | Identity Management: Creation, Provisioning, Maintenance, Identity Aggregation, Deactivation | Book 03, HR as the source of authority (Ch 02), the provisioning pipeline (Ch 05), joiner, mover, leaver (Ch 08); Book 02 for the directory; the HR-Driven Identity guide | The evidence each lifecycle event leaves (Book 03, Ch 11); HR lifecycle kit runs packaged by the drift pipeline | Strong |
| Non-person identity | §IV Architecture 3 (devices, non-person entities, RPA and AI: “distinguishable, auditable, and consistently managed”) | Identity Management; Credential Management; Access Management | The Non-Person Identity implementation guide and its developer workbook, Building Non-Person Identity; Book 04, Ch 05 (applications and workload identities); Book 17 (AI identities, Ch 04) | The non-person identity kit: the register, ownership and orphan findings, least-privilege checks, drift against an approved baseline | Strong |
| Device identity | §IV Architecture 3 | Credential Management (device certificates); Access Management (device signal) | Book 05 (Intune-first onboarding, Ch 04; compliance and the Conditional Access hand-off, Ch 10); Book 07, Ch 06 (device certificates); Book 03, Ch 09 | Device inventory reconciliation and compliance reports (Book 05, Ch 10) | Strong |
| Credentials and PIV | §III.2 (PIV as the primary means; derived PIV; timely revocation); §III.5 (PIV digital signature); §III.6 (encryption, a “should”) | Credential Management: Sponsorship, Registration, Generation & Issuance, Maintenance, Revocation | Book 03, Ch 09 (proofing, issuance and binding; the leaver sequence); Book 07, Ch 09 (PIV, derived PIV and federation); Book 07, Ch 06 (Entra certificate-based authentication; S/MIME); Book 02, Ch 10 (phishing-resistant authenticators) | What the credential evidence must show (Book 03, Ch 09) | Partial: PIV signing and encryption are treated only as S/MIME certificate profiles, and physical access isn’t covered |
| Privileged identity | §III.2 (revoke access when no longer authorized) | Access Management: Privileged Access Management | Book 04: privileged roles and tiers (Ch 04), PIM with approval (Ch 08), access as code (Ch 10) | The privileged access kit: the tiered inventory, emergency access checks, the evidence run | Strong |
| Federation and interoperability | §III.3 (accept other agencies’ PIV); §IV Architecture 2 and 5 | Federation: Policy Alignment, Authentication Broker, Attribute Exchange | Book 02, Ch 10 (cross-tenant access settings and B2B collaboration, including trusting a partner tenant’s MFA and device claims); Book 07, Ch 04 (the Federal PKI and PIV-I); Book 07, Ch 09 (accepting another agency’s PIV, federation with agencies and partners); Book 13, Ch 12 says cross-agency federation is “designed, not built” | Cross-tenant access policy settings | Partial: tenant-to-tenant trust and the FIPS 201-3 federation model are covered; the chapter doesn’t walk through electronic verification of other agencies’ PIV assertions or draft a federation agreement |
| Access lifecycle | §III.2 (manage access control; revoke privileges and credentials in a timely manner) | Access Management: Digital Policy Administration, Authentication, Authorization; Identity Management: Deactivation | Book 03, Ch 08 and Ch 10 (from attributes to access); Book 04, Ch 03 and Ch 09 (access packages, reviews, Lifecycle Workflows) | Access review evidence (Book 04, Ch 09); leaver timing measured in Book 03, Ch 11 | Strong |
| Governance | §IV Governance 1 to 4 | Governance: Identity Governance, Analytics, Mitigation | ICAM governance structure: Book 03, Ch 07, Book 02, Ch 06, Book 13, Ch 09, Book 00, Ch 03 and Ch 07; drift and metrics: Book 03, Ch 11, Book 13, Ch 06 | Responsibility matrices (design guidance); drift reports | Partial: the governance body is Strong; the single ICAM policy, the strategic-plan objectives and the e-authentication reassessment are not covered |
| Public identity | §V (identity proofing and authentication for the public; §IV Architecture 4) | — | Out of scope by design. Book 00, Ch 02 limits the workbook to workforce identity and internal systems; OMB M-26-18 governs public sign-on through Login.gov. The workbook still applies Section 508 and IDEA §3(c) to internal systems | — | Out of scope |
M-19-17, section by section
M-19-17 has six sections, a list of rescissions and a policy-assistance contact. Section I is context; Sections III to V carry the agency requirements; Section VI assigns government-wide work to the standard-setting and shared-service agencies, not to every agency.4 The section structure was read from the White House PDF on November 2, 2026.
| Section | Requirement (short) | Status | Where in the workbook | Evidence | Mark |
|---|---|---|---|---|---|
| I. Contextualizing Identity in the Federal Government | Context: identity as an enabler of mission delivery | — | — | — | Not a requirement |
| II. Managing Identities, Credentials, and Access in Modern Government | Agencies “must implement” SP 800-63-3 “and any successive versions,” and move off the obsolete levels-of-assurance model | Required | Book 03, Ch 09 (IAL3 proofing under SP 800-63A-4); help desk identity verification in Book 15, Ch 01, Ch 03 and Ch 04 | Help desk verification records | Partial |
| III.1 | Follow OPM’s requirements on eligibility to issue, suspend and revoke PIV | Required | Book 03, Ch 08 (personnel actions as triggers) and Ch 09 | Leaver sequence evidence | Partial: vetting and adjudication are the credentialing office’s |
| III.2 | PIV as the primary means of authentication; derived PIV; pilots; timely revocation; PIV for physical access per the ISC standard and SP 800-116 | Required | Book 03, Ch 09; Book 07 and Ch 06; Book 11, Ch 03 (derived PIV under M-22-09) | Certificate binding configuration; revocation in the leaver sequence | Partial: physical access (PACS) is a gap |
| III.3 | Support cross-government federation: verify other agencies’ PIV assertions electronically, accept their valid PIV rather than issue new ones, keep federation agreements | Required | Book 07, Ch 04 describes the Federal PKI; Book 07, Ch 09 covers accepting another agency’s PIV and the federation options | Cross-tenant access policy settings | Partial |
| III.4 | Capabilities aligned to the FICAM Architecture and CDM for continuous vetting of personnel | Required | — | — | Gap |
| III.5 | Require and implement the PIV digital signature capability | Required | Book 07, Ch 06 (S/MIME signing profiles, not PIV signing) | — | Partial |
| III.6 | Use PIV to encrypt information in transit between federal employees or contractors | Guidance (“should”) | Book 07, Ch 06 (S/MIME encryption and key archival) | — | Partial |
| IV Governance 1 | An integrated agency-wide ICAM office, team or governance structure, with the CIO, CFO, HR, General Counsel, CISO, SAOP, chief acquisition officer and physical security | Required | Book 03, Ch 07; Book 02, Ch 06; Book 13, Ch 09; Book 00, Ch 03 and Ch 07; Book 01, Ch 09 | Charter and responsibility matrices (design guidance) | Strong |
| IV Governance 2 | One comprehensive ICAM policy, process and technology roadmap, aligned to the FICAM Architecture and CDM | Required | The program plan and roadmaps: Book 00, Ch 05; Book 01, Ch 12 | Program plan and roadmap (a technology roadmap, not an ICAM policy) | Partial |
| IV Governance 3 | Agency-wide performance expectations across the identity lifecycle; ICAM objectives in the strategic plan | Required | Book 03, Ch 11 (the measured lifecycle); Book 00, Ch 10 (the program scorecard) | Lifecycle metrics | Partial: strategic-plan objectives aren’t covered |
| IV Governance 4 | Digital identity risk management per SP 800-63; update legacy e-authentication risk assessments | Required | Help desk assurance in Book 15, Ch 01; authenticator choices in Book 02, Ch 10 | — | Partial: no digital identity risk assessment is shown; e-authentication reassessment isn’t covered |
| IV Architecture 1 | Authoritative ICAM solutions: rationalize what to keep, replace, retire or consolidate | Required | Book 01; Book 02; Book 03, Ch 02; Book 00, Ch 10 (retirement) | Forest assessment from the Start Kit | Strong |
| IV Architecture 2 | Interchangeable capabilities: commercial products, open APIs and standards | Required | Book 13, Ch 08 (the adapter model); SCIM provisioning in Book 03, Ch 05 | — | Partial |
| IV Architecture 3 | Manage the lifecycle of devices, non-person entities, RPA and AI; bind, update, revoke and destroy their credentials | Required | See the non-person and device identity rows above | NPI kit runs | Strong |
| IV Architecture 4 | Authoritative attribute sources selected by OMB offer privacy-enhanced validation APIs for public and private identity proofing | Required for selected agencies only | — | — | Out of scope (public proofing; applies only where OMB selects the agency) |
| IV Architecture 5 | Federated solutions to accept partners’ identity and authentication assertions, on open standards | Required | Book 02, Ch 10 (cross-tenant access and B2B) | Cross-tenant policy settings | Partial |
| IV Acquisition 1 | HSPD-12 and FIPS 201 clauses in contracts that give contractors access (FAR subpart 4.13) | Required | Book 03, Ch 09 cites FAR 52.204-9 for the return of credentials | — | Partial |
| IV Acquisition 2 | Products and services compliant with OMB policy and NIST standards (for example GSA’s Approved Products List) | Required | — | — | Gap |
| IV Acquisition 3 | Best in Class and Tier 2 vehicles, or federal shared services, for digital certificates | Required | — | — | Gap |
| IV Acquisition 4 | Use the CDM Program for ICAM tools | Required | CDM appears as a reporting channel in Book 12 and Book 11, not as an ICAM acquisition route | — | Gap |
| V. Improving Digital Interactions with the American Public (items 1 to 5) | Proofing, PII minimization, binding of non-government authenticators, reuse of existing credentials, shared services for the public | Required for public services | Book 00, Ch 02 | — | Out of scope |
| VI. Enumerating Government-wide Responsibilities | Roadmaps, guidance, PKI and vetting work assigned to the standard-setting and shared-service agencies | Not an agency requirement | — | — | Not mapped |
| Rescissions | Rescinds M-04-04, M-05-05, M-06-18, M-11-11 and the 2011 memo on accepting externally issued credentials | — | No page cites the rescinded memos as current | — | — |
The FICAM Architecture’s services
The FICAM Architecture, version 3.3 (June 2023), groups ICAM into five service areas.5 Each service is mapped below.
| Service area | Service | Where in the workbook | Evidence | Mark |
|---|---|---|---|---|
| Identity Management | Creation | Book 03, Ch 08 (joiner) and Ch 05 | Provisioning logs; HR lifecycle runs | Strong |
| Identity Proofing | Book 03, Ch 09 (IAL3 per SP 800-63A-4, via the PIV process); Book 15, Ch 03 (help desk) | — | Partial: proofing itself is the credentialing office’s | |
| Provisioning | Book 03, Ch 05; the HCM-to-Entra kit | SCIM requests and provenance | Strong | |
| Maintenance | Book 03, Ch 04 and Ch 06 (one writer per attribute) | Drift between HR and the directory | Strong | |
| Identity Aggregation | Book 03, Ch 06 (the canonical schema); the non-person identity register | Correlation output | Partial | |
| Deactivation | Book 03, Ch 08 (leaver, deletion) | Separation timing (Book 03, Ch 11) | Strong | |
| Credential Management | Sponsorship | Book 03, Ch 09 (the joiner event starts sponsorship) | — | Partial |
| Registration | Book 03, Ch 09 | — | Partial | |
| Generation & Issuance | Book 07 (the target PKI and certificate profiles); PIV issuance runs in the card management system, outside the workbook | Certificate inventory | Partial | |
| Maintenance | Book 07, Ch 08 (lifecycle monitoring); NPI certificate rotation (the NPI guide) | Rotation plans; expiry monitoring | Strong | |
| Revocation | Book 03, Ch 09 (the canonical leaver sequence) | Leaver evidence | Strong | |
| Access Management | Digital Policy Administration | Book 04, Ch 07 (the Conditional Access library) and Ch 10 (as code) | Policy exports in the repository | Strong |
| Authentication | Book 02, Ch 10; Book 07, Ch 06 (certificate-based authentication) | Authentication methods policy | Strong | |
| Authorization | Book 03, Ch 10; Book 04, Ch 09 | Access package assignments and reviews | Strong | |
| Privileged Access Management | Book 04, Ch 04 and Ch 08 | Privileged access kit runs | Strong | |
| Federation | Policy Alignment | Book 07, Ch 09 (federation protocols and the agreements they need) | — | Partial |
| Authentication Broker | Book 02, Ch 10 (cross-tenant and B2B) | Cross-tenant settings | Partial | |
| Attribute Exchange | — | — | Gap | |
| Governance | Identity Governance | Book 04, Ch 09; Book 03, Ch 07 | Access reviews; responsibility matrices | Strong |
| Analytics | Book 03, Ch 11; Book 12, Ch 03 (identity telemetry) | Lifecycle metrics; sign-in telemetry | Partial | |
| Mitigation | Book 13, Ch 06 (the drift engine); the drift pipeline | Drift reports and findings | Strong |
Gaps, in one list
- M-19-17 §III.3, cross-government federation, in part: Book 07, Ch 09 covers accepting another agency’s PIV and federating with agencies and partners, but no page drafts the federation agreement or walks through electronic verification of another agency’s PIV assertions.
- §III.4, continuous vetting aligned to the FICAM Architecture and CDM.
- §III.2, PIV for physical access (PACS, the ISC standard, SP 800-116).
- §IV Acquisition 2 to 4: the Approved Products List, Best in Class vehicles for certificates, and CDM as the route for ICAM tools.
- §IV Governance 2 to 4, in part: a written ICAM policy, ICAM objectives in the strategic plan, and the update of legacy e-authentication risk assessments.
- FICAM Federation: Attribute Exchange, and Policy Alignment in part (Book 07, Ch 09 names the agreements, but the workbook ships no template).
Status and review
In review. M-19-17’s sections were read from the White House PDF, and the FICAM Architecture’s services from idmanagement.gov, on November 2, 2026. Every mark comes from reading the pages it links. Corrections are welcome as issues on GitHub.
Footnotes
Office of Management and Budget, M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management, May 21, 2019, §§I–VI, “Governance,” “Architecture” and “Acquisition” under §IV, and “Rescissions,” https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf (accessed Nov 2, 2026).↩︎
General Services Administration, IDManagement.gov, FICAM Architecture, version 3.3 (page header June 30, 2023; the version table gives June 20, 2023), “Services Framework and Service Descriptions,” https://www.idmanagement.gov/arch/ (accessed Nov 2, 2026).↩︎
Office of Management and Budget, M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management, May 21, 2019, §§I–VI, “Governance,” “Architecture” and “Acquisition” under §IV, and “Rescissions,” https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf (accessed Nov 2, 2026).↩︎
Office of Management and Budget, M-19-17, Enabling Mission Delivery through Improved Identity, Credential, and Access Management, May 21, 2019, §§I–VI, “Governance,” “Architecture” and “Acquisition” under §IV, and “Rescissions,” https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf (accessed Nov 2, 2026).↩︎
General Services Administration, IDManagement.gov, FICAM Architecture, version 3.3 (page header June 30, 2023; the version table gives June 20, 2023), “Services Framework and Service Descriptions,” https://www.idmanagement.gov/arch/ (accessed Nov 2, 2026).↩︎