Governance
The rules that decide who gets access and how that decision is reviewed: identity governance policy, access review campaigns, and the evidence trail behind each approval.
Government
Identity services built for government programs.
CogniAccess provides identity, credential, and access management (ICAM) services to federal agencies and state government — directly, and as an identity subcontractor to the prime contractors who serve them. The work is Entra ID, Okta, Zero Trust identity, FISMA Audit & Controls, and POA&M support, documented to the standard an assessor will test.
Federal ICAM
Federal ICAM, in the FICAM frame
Federal identity work runs on the FICAM architecture — the federal identity, credential, and access management framework carried by OMB M-19-17. CogniAccess organizes its government identity services against the same segments a program office uses, so a scope maps cleanly onto the program's own ICAM language.
Identity
The authoritative record of who a user is: Entra ID and Active Directory design, hybrid identity, and joiner–mover–leaver lifecycle processes that keep the directory current.
Credential
The credentials a user proves identity with: PIV and certificate-based authentication under FIPS 201 (HSPD-12), passkeys and FIDO2 keys, and phishing-resistant MFA framed against NIST SP 800-63 assurance levels.
Access
The decision at the moment of sign-in: Conditional Access policy sets, session controls, device trust signals, and privileged access that is temporary by design.
Federation
Trust between systems and agencies: SAML 2.0, OpenID Connect, and OAuth 2.0 federation, SCIM provisioning, and cross-platform trust between Entra ID and Okta.
Authorization & evidence
The record that the first five segments work: FISMA control implementation, assessor evidence, POA&M tracking, and ATO package support under the Risk Management Framework.
Zero Trust
Zero Trust starts at the identity pillar
The federal Zero Trust strategy (OMB M-22-09) makes identity the first pillar, and the CISA Zero Trust Maturity Model measures how far an agency has moved along it — from traditional authentication toward phishing-resistant MFA, centralized identity stores, and risk-based access decisions. CogniAccess sequences identity work against that maturity path, so each step is a milestone a program can report, not a product installed.
What advancing the identity pillar looks like
- Phishing-resistant MFA — PIV, passkeys, FIDO2 — replacing SMS and voice for the populations a mandate covers
- Conditional Access decisions that use device compliance and sign-in risk, evaluated per request
- Least-privilege access with just-in-time privileged elevation instead of standing administrator rights
- Identity governance evidence: reviews, approvals, and removals an assessor can sample
How CogniAccess sequences it
Assessment first: the current-state review names where the program stands against the identity pillar today. Then a risk-ranked order of work — authentication methods, policy design, governance — delivered in waves with report-only testing before enforcement, so a maturity milestone never arrives as a sign-in outage.
Teaming
For prime contractors: an identity subcontractor that arrives audit-ready
Identity workstreams fail primes in a predictable way: the configuration gets done, but the control evidence, status reporting, and authorization material lag behind it. CogniAccess is structured to prevent that — an identity subcontractor whose delivery includes the documentation a federal program is judged on, from the first workstream review onward.
Subcontract workstream
Workstream within a prime program
A defined identity or compliance workstream inside a larger federal program, delivered with status, deliverables, dependencies, and acceptance points aligned to the prime.
Fixed scope
Fixed-scope assessment
A named assessment product — identity current-state, Conditional Access & MFA review, or FISMA control gap — with scope, duration, and deliverables agreed before work begins.
Retainer
Ongoing advisory
A recurring block of specialist time for architecture decisions, audit readiness, control review, and roadmap support alongside a program team.
Company data for vendor onboarding — legal name, entity type, Virginia SCC Entity ID, NAICS codes, and EIN handling — is listed under Contracting & company data on the Capabilities page, along with the teaming process and a downloadable one-page capability statement.
State & local
State government identity modernization
State agencies run the same workforce-identity problems as federal programs, under their own audit and compliance regimes: aging directories, MFA mandates arriving through policy and cyber-insurance alike, and identity findings that need a remediation order. CogniAccess offers state government the same services, scoped to state programs.
Workforce identity consolidation
Entra ID and Okta consolidation for state workforces — directory cleanup, federation standards, and application onboarding that ends disconnected portals.
MFA & passkey rollout
Phishing-resistant authentication for agency staff: passkeys and FIDO2 keys deployed in waves, legacy methods retired, and exceptions documented rather than left open.
Governance & audit readiness
Access reviews, privileged-access governance, and control evidence organized for state audit cycles — plus help desk and service desk support for the enrollment and recovery load a rollout creates.
Company data
CogniAccess LLC — contracting data
The data a contracting or vendor-onboarding package requires. The one-page capability statement is available as a PDF download for circulation inside a capture team.
| Legal name | CogniAccess LLC |
|---|---|
| Entity | Limited liability company, Commonwealth of Virginia |
| Virginia SCC Entity ID | 12098820 |
| Operations | Manassas, Northern Virginia |
| Service delivery | On site in the Washington, DC metropolitan area; remote across the United States |
| NAICS | 541512 — Computer Systems Design Services (primary) 541519 — Other Computer Related Services 541611 — Administrative Management and General Management Consulting Services |
| EIN | Issued — provided during contracting |
| Contact | info@cogniaccess.com |
Discuss a government identity scope.
Send the program context, the identity or compliance workstream, and the contracting timeline. CogniAccess will respond with the next scoping step.