top of page
Zero Trust.
Executed in the Right Order.
CISA ZTMM User Pillar: Building Dynamic Privilege Rules for OMB M-22-09 Identity Requirements
Most civilian agencies still have a privilege problem hiding inside normal operations: static Active Directory groups, standing administrator roles, VPN-era access assumptions, and quarterly access reviews that do not respond to user risk in the moment. That model does not hold up against the CISA ZTMM User Pillar or the identity direction in OMB M-22-09. Explore how conditional user access has to move from policy language into enforceable rules.
2 days ago7 min read
Enterprise ICAM Implementation for CISA ZTMM Conditional Access Requirements Under OMB M-22-09
Conditional user access is not an MFA project. To meet OMB M-22-09, it is an enterprise ICAM operating model tied to attributes, privileged access, policy enforcement, monitoring, and ATO boundaries. Agencies are trying to build that while operating under continuing resolution uncertainty, lean IT staffing, FedRAMP procurement constraints, and production systems that cannot be taken offline for identity redesign. This blog details how to get it right with the right sequencing
6 days ago6 min read
CISA ZTMM User Attribute Architecture: Meeting OMB M-22-09 Requirements for Federal Identity Management
Conditional access breaks down fast when user attributes live in too many places. We see this across agencies: HR owns one version of the user, Active Directory owns another, the identity provider has a partial profile, and mission applications maintain local roles that nobody reconciles until access is wrong. That is not a tool problem first. It is an attribute architecture problem, and it affects how well an agency can implement OMB M-22-09 and the CISA Zero Trust Maturity
Jun 87 min read
bottom of page