Identity and Access Management

An article on AI-enabled cyberattacks recommends that organizations use a phased Zero Trust strategy informed by NIST Special Publication 800-207. It identifies potential cybersecurity services demand across government and other sectors, but announces no solicitation, award, funding, or new mandatory requirement.

A Security Boulevard analysis recommends designing identity and access management alongside cloud infrastructure, using least privilege, short-lived workload identities, and federated authentication. The guidance offers contractors and procurement teams practical evaluation criteria for cloud modernization, but identifies no solicitation, award, funding, deadline, or new mandatory compliance requirement.

DISA’s November 6 solicitation seeks a modular cloud-hosted enterprise ICAM prototype for IL5 and IL6, targeting fragmented directories, authentication delays, and access-control and audit gaps. Solution briefs are due November 30; the potential for a larger follow-on without a new competition makes prototype results and transition planning strategically important.

The Department of Homeland Security plans a 12-month, sole-source blanket purchase agreement with incumbent Dignari LLC for identity, credentialing, and access management services, estimated at $50 million to $100 million. DHS forecasts releasing the solicitation November 20, 2026, with work expected to conclude by December 12, 2027; the source does not establish a link to the Icepick data exposure.

A Qubole-related supply-chain attack used compromised AWS credentials to assume customer roles, access cloud data, and harvest AWS, Microsoft Entra ID, and Okta credentials. Sentra reported dozens of affected customers, underscoring the need for contractors to review third-party cloud access and credentials; no procurement opportunity was identified.

A CircleID analysis recommends risk-tiered safeguards for autonomous AI agents, including dynamic identity verification, restricted API capabilities, model provenance, auditable execution, and graceful degradation. It identifies no government solicitation, award, funding, or agency requirement, but signals potential contractor demand for AI security and operational resilience capabilities.

A discussion on security in a post-AGI environment highlights agent authorization, prompt-injection resistance, rapid access revocation, and verification as important challenges. For federal buyers and contractors, these concerns offer potential criteria for evaluating agentic AI security, but the discussion identifies no agency requirement or procurement opportunity.

Senators Ron Wyden and Elizabeth Warren want Treasury and the IRS to explain their reliance on ID.me, including its new requirement for TreasuryDirect access, by November 9, 2026. The scrutiny follows an OMB directive favoring Login.gov where possible and could clarify future identity-verification requirements, though no active solicitation or confirmed migration decision has been identified.

A Federal News Network commentary urges agencies to treat single sign-on (SSO) as critical infrastructure and seek transparent, capacity- or load-based pricing. It recommends specifying portability, upgrade testing, attribute control, and risk-based multifactor authentication in solicitations and contract management, but identifies no active procurement or award.

A Federal News Network commentary says agencies should distinguish AI-agent identities from human identities, document agent ownership, and require human authorization for high-risk actions. The analysis signals potential future demand for identity assurance, IAM integration, governance, and audit capabilities, but identifies no funded opportunity or solicitation.

Pradiman Pandita’s analysis argues that cloud services, hybrid work, and interconnected systems have shifted cybersecurity toward identity-centered controls. The article highlights capabilities contractors can position for security planning and market research, but identifies no solicitation, funding, agency requirement, or near-term procurement opportunity.

NIST has proposed 10 design tenets for managing AI-agent identities and access, including verifiable identities, least-privilege permissions, human review of high-risk actions, and tamper-evident logs. The guidance is not a procurement announcement or stated mandatory requirement, but offers federal buyers and contractors a reference for shaping and evaluating AI security capabilities as NCCoE demonstrations explore supporting standards and technologies.

A reported breach exposed searchable records on more than 41,000 current and former DHS employees and contractors, including personnel at CBP, ICE, and CISA. DHS says it is addressing a potential breach; the reports identify no related solicitation, award, or contract action, but raise operational cybersecurity and workforce-protection concerns for contractors supporting the department.

The Department of Homeland Security forecasts a 12-month, departmentwide follow-on BPA for identity, credential and access management support, valued at $50 million to $100 million. The forecast identifies a sole-source acquisition with no specified small-business set-aside; DHS targets a November 20, 2026 solicitation and expects an award in the first quarter of FY2027.

MeriTalk and sponsor Okta are promoting an educational ebook on public-sector identity security, covering threats including session hijacking, lateral movement, unmanaged machine identities, and shadow AI. The resource is not a solicitation or award, but it offers procurement teams and contractors a checklist of issues relevant to zero trust, identity and access management, and cyber resilience.

A technical guide outlines OAuth 2.1-style authentication, audience-bound tokens, per-tool scopes, and audit controls for AI agents using Model Context Protocol servers. It identifies no government buyer, funding, solicitation, or acquisition path, but offers topics for agencies and contractors to consider in AI security evaluations.

Zero-trust analysis points to asynchronous security-signal sharing as a way to reassess access against current risk rather than rely on stale tokens. Federal procurement teams can evaluate support for the OpenID Foundation’s SSF and CAEP, but the article identifies no solicitation, award, or funding announcement.

A WashingtonExec op-ed warns that AI is accelerating cyberattacks and urges federal agencies to strengthen access controls, patching, incident response, and oversight of AI adoption. The priorities may create opportunities for contractors in cybersecurity services and post-quantum readiness, while CISA’s existing CDM program offers an established pathway—not a newly announced solicitation or award.