OMB M-22-09
OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
M-22-09 sets the federal zero trust architecture strategy that followed Executive Order 14028. Issued on January 26, 2022, it required agencies to meet specific cybersecurity standards and objectives by the end of fiscal year 2024. Its identity pillar is the most cited part: agencies must run centralized identity management systems, enforce MFA at the application layer, require phishing-resistant MFA for staff, contractors and partners, offer a phishing-resistant option to the public, drop password rules that demand special characters or regular rotation, and consider at least one device-level signal when authorizing access. OMB's memoranda page listed no rescission of M-22-09 on 5 November 2026.
Who it applies to
Heads of federal executive departments and agencies, covering agency staff, contractors and partners who sign in to agency systems, and public-facing agency systems that support MFA.
Identity requirements
- Employ centralized identity management systems for agency users that can be integrated into applications and common platforms
- Use strong MFA throughout the enterprise, enforced at the application layer instead of the network layer
- Require phishing-resistant MFA for agency staff, contractors and partners, and for routine self-service access discontinue methods that fail to resist phishing, including SMS or voice codes, one-time codes and push notifications
- Give public users of systems that support MFA the option of phishing-resistant authentication within one year of the memo, which means supporting Web Authentication-based approaches such as security keys
- Remove password policies that require special characters or regular rotation from all systems within one year of the memo
- Consider at least one device-level signal alongside identity information about the authenticated user when authorizing access
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | Phishing-resistant MFA (PIV, including Derived PIV, or FIDO2 and WebAuthn authenticators) became the federal enterprise baseline, and SMS, voice, one-time codes and push were ruled out for routine staff access. |
| Identity governance (IGA) | Centralized, enterprise-managed identities that integrate with applications are the first required action, ending per-application account silos. |
| Customer identity & consent (CIAM) | Public-facing systems that support MFA must offer a phishing-resistant option, so citizen sign-in flows need WebAuthn support alongside other methods. |
| Audit, logging & accountability | Agencies had to submit implementation plans for FY22 to FY24 to OMB and CISA within 60 days and name a zero trust implementation lead within 30 days. |
Penalties
M-22-09 is an OMB policy memorandum and sets no penalties. OMB oversees agency progress through the implementation plans and budget estimates the memo required agencies to submit to OMB and CISA.
Status and dates last verified against primary sources on 2026-11-05.
OMB M-22-09: frequently asked questions
- What does M-22-09 mean by phishing-resistant MFA?
- The memo defines phishing-resistant authentication as processes designed to detect and prevent disclosure of authentication secrets and outputs to a website or application masquerading as a legitimate system. It names the federal PIV standard and the W3C Web Authentication standard as approaches, and says agencies must stop supporting SMS or voice codes, one-time codes and push notifications for routine self-service access by staff, contractors and partners.
- Does M-22-09 ban password rotation?
- Yes, for agency systems. Consistent with NIST SP 800-63B, agencies had to remove password policies that require special characters or regular rotation from all systems within one year of the memo's January 26, 2022 issuance.
- Does M-22-09 apply to private companies?
- It is addressed to federal executive departments and agencies. Its phishing-resistant MFA requirement covers agency staff, contractors and partners who access agency-hosted accounts, so contractors meet it when they sign in to agency systems.