· Federal ICAM
The short answer
ICAM stands for identity, credential, and access management: the combination of policies, processes, and technology an organization uses to manage digital identities, issue the credentials people and systems prove themselves with, and control who can reach which resources. It covers the full life of an identity — creation, proofing, credential issuance, authentication, authorization, review, and removal.
Why the federal government says ICAM, not just IAM
Commercial practice usually shortens the discipline to IAM — identity and access management. Federal usage keeps the C in the middle for a reason: credentialing is a discipline of its own in government, anchored by the PIV credential under HSPD-12 and FIPS 201. The federal frame for the whole subject is FICAM — federal ICAM — the architecture and playbooks agencies follow, and OMB M-19-17 directs agencies to manage identity as one enterprise discipline rather than as separate per-system decisions.
The five FICAM segments
The FICAM architecture divides the work into five segments. Governance sets the rules and accountability. Identity management maintains the authoritative record of who each user is across their lifecycle. Credential management issues and maintains PIV cards, certificates, passkeys, and other authenticators. Access management makes and enforces the sign-in decision — authentication, authorization, and session controls. Federation extends trust so an identity verified in one organization or system can be relied on by another, using standards such as SAML and OpenID Connect.
The assurance vocabulary: NIST SP 800-63
NIST SP 800-63 gives ICAM programs their measurement language: identity assurance levels (IAL) for how rigorously an identity was proofed, authenticator assurance levels (AAL) for how strongly a credential resists theft or replay — phishing-resistant methods sit at the top — and federation assurance levels (FAL) for how assertions are protected between systems. A program that can name its IAL and AAL per population can state its identity risk precisely, and defend it.
ICAM and Zero Trust
Zero Trust did not replace ICAM; it built on it. The federal Zero Trust strategy (OMB M-22-09) names identity as its first pillar, and the CISA Zero Trust Maturity Model measures identity maturity in ICAM terms — authentication strength, identity stores, governance, and risk-based access. An agency cannot advance the identity pillar faster than its ICAM foundations allow.
What a working ICAM program has to show
A functioning program can answer five questions with evidence: Which identities exist, human and non-human? Who owns each one? What can each reach, and who approved it? How strong is the credential at the moment of access? And when was all of that last reviewed? CogniAccess's government identity work is organized around making those answers producible on demand.
CogniAccess government identity services · How the Entra ID service works