Federal, state, and local agencies are under a hard deadline to kill passwords, not just discourage them, and most passwordless pitches skip the part where you still have PIV/CAC infrastructure to interoperate with. This guide ranks the passwordless approaches agencies actually deploy in 2026, scored against NIST assurance levels and the federal zero trust mandate, not vendor marketing copy.
- FIDO2/WebAuthn hardware keys are the best passwordless authentication solution for government agencies without a legacy PIV lock-in — Buy.
- PIV/CAC certificate-based auth stays mandatory for agencies already issued cards, but doesn’t extend to contractors or cloud-native systems — Hold.
- Synced passkeys typically land at NIST AAL2, not AAL3, which disqualifies them for high-sensitivity federal systems — Skip.
- Passwordless alone doesn’t stop lateral movement after a session token is stolen; pairing it with identity microsegmentation closes that gap — Buy.
Why this matters
Executive Order 14028, signed in 2021, told federal agencies to move to zero trust architecture. OMB memorandum M-22-09, issued in January 2022, made it specific: agencies must adopt phishing-resistant multi-factor authentication, and passwords with any second factor that can be relayed or phished no longer qualify.
That mandate collides with reality inside most agency IT stacks. PIV and CAC cards have handled identity since FIPS 201 first shipped in 2004, and ripping that infrastructure out isn't realistic for 2026 budgets. The question isn't whether to go passwordless — it's which passwordless architecture fits an agency that still runs PIV readers on half its workstations and cloud-native SaaS on the other half.
A zero trust platform for government agencies needs to answer that question before it answers anything else, because the wrong passwordless choice either fails the compliance audit or breaks the existing credential-issuance pipeline.
How this list is ranked
Each approach below is scored against three things: whether it meets NIST SP 800-63B's Authenticator Assurance Level 3 (AAL3, the level required for high-sensitivity federal systems), whether it satisfies OMB M-22-09's phishing-resistance requirement, and how much it disrupts an agency's existing PIV/CAC issuance chain. Vendor marketing claims about assurance level are checked against the actual NIST mapping, not the sales deck. Approaches that require agencies to abandon existing identity infrastructure without a migration path score lower, even when the underlying cryptography is sound.
The ranked list
1. PIV/CAC certificate-based authentication — the mandated baseline
FIPS 201 personal identity verification cards have been the federal standard since 2004, with FIPS 201-3 updating the specification in 2022. Certificate-based auth backed by a hardware smart card meets NIST AAL3 out of the box, and most agencies already have the card-issuance infrastructure running.
The gap: it doesn't cover contractors without a card, cloud-native workloads, or agencies trying to extend coverage to mobile users without a smart card reader. Verdict: Hold — keep it where it's already deployed, don't expand it as your only passwordless path for 2026.
2. FIDO2/WebAuthn hardware security keys — the phishing-resistant standard
FIDO2 hardware keys cryptographically bind the credential to the origin domain, which is exactly what OMB M-22-09 means by phishing-resistant. They hit AAL3 without the PKI issuance overhead a CAC program carries, and they work across cloud and on-prem systems the same way.
For agencies that aren't fully card-issued, or that need to onboard contractors fast, this is the practical fit. Verdict: Buy for any agency modernizing credential issuance in 2026 without deep CAC dependency.
3. Derived PIV credentials on mobile — the mobile-workforce fix
NIST SP 800-157 has allowed derived PIV credentials since 2014, letting agencies extend AAL3-level assurance to mobile devices that don't have a smart card slot. It solves the mobile access problem without inventing a parallel identity system.
The catch is that it's still tethered to the same certificate authority infrastructure issuing the physical cards, so it inherits every operational bottleneck that infrastructure has. Verdict: Hold — useful as a bridge, not a long-term replacement.
4. Synced passkeys / platform authenticators — the fast-rollout option
Windows Hello and mobile biometric unlock feel like passwordless authentication to end users, and rollout is genuinely fast. But NIST's own guidance distinguishes hardware-bound authenticators from syncable passkeys, and syncable keys that can move between devices typically land at AAL2, not AAL3.
That disqualifies them for CUI and other high-sensitivity federal workloads, even though they're fine for low-sensitivity internal tools. Verdict: Skip for anything touching controlled unclassified information in 2026.
5. Push notification with number matching — the one still tied to a password
Number-matching push cuts down MFA fatigue attacks compared to plain approve/deny push, and it's a real improvement over SMS codes. But it doesn't cryptographically bind to the requesting origin the way FIDO2 does, so NIST and the OMB memo don't count it as phishing-resistant.
Agencies that lean on this as their answer to M-22-09 are going to fail the audit. Verdict: Skip if the goal is actual compliance, not just a friendlier login screen.
6. Passwordless plus identity microsegmentation — the attack-path-complete pick
Removing the password stops credential theft at the front door. It doesn't stop what happens if an attacker gets a live session token or pivots from a compromised workstation — that's a lateral movement problem, not an authentication problem.
Secfolio pairs passwordless identity with microsegmentation so a compromised session can't reach adjacent systems, containing the blast radius instead of just hardening the login. Agencies rolling this out at scale should look at how to implement passwordless authentication at enterprise scale alongside a plan to segment identities to contain a breach if one account is compromised anyway. Government networks that also carry ransomware risk get an added layer here: Secfolio's Cyber Storage architecture encrypts and shards data before an attacker can reach a reconstructable file, so even a fully compromised session doesn't hand over usable data. Verdict: Buy — this is the only approach on this list that addresses both the credential and the blast radius.
Comparison table
| Approach | NIST AAL Level | Phishing-Resistant | Legacy Infra Required | Verdict |
|---|---|---|---|---|
| PIV/CAC certificate auth | AAL3 | Yes | Existing PKI | Hold |
| FIDO2/WebAuthn hardware keys | AAL3 | Yes | Minimal | Buy |
| Derived PIV on mobile | AAL3 | Yes | Existing PKI | Hold |
| Synced passkeys | AAL2 (typical) | Partial | None | Skip |
| Push with number matching | AAL2 | No | Minimal | Skip |
| Passwordless + microsegmentation | AAL3 | Yes | Minimal | Buy |
Procurement rules for 2026
- Confirm FedRAMP authorization or GSA schedule listing before any vendor enters a procurement cycle — this isn't optional for federal buyers.
- Verify AAL3 claims against the actual NIST SP 800-63B mapping, not the vendor's own assurance-level label; syncable and hardware-bound authenticators get conflated constantly.
- Check the integration path with your existing PIV/CAC certificate authority before signing — a second, parallel identity store is a common failure mode in agency rollouts.
Map your agency’s attack-path exposure
See how passwordless identity and microsegmentation work together to contain breaches.
FAQ
What’s the best passwordless authentication solution for government agencies in 2026?
FIDO2/WebAuthn hardware security keys are the best fit for most agencies in 2026 because they meet NIST AAL3 and OMB M-22-09’s phishing-resistance requirement without the PKI overhead of a full PIV rollout. Agencies already running PIV/CAC should keep that infrastructure rather than replace it.
Is FIDO2 phishing-resistant enough to meet OMB M-22-09?
Yes, FIDO2/WebAuthn cryptographically binds the credential to the requesting origin, which is the exact mechanism OMB M-22-09 requires for phishing-resistant MFA. Push notifications and SMS codes do not meet this bar.
Do agencies still need PIV/CAC cards with passwordless authentication?
Agencies with existing PIV/CAC issuance infrastructure should keep it running rather than tear it out, since it already meets NIST AAL3. Passwordless additions like FIDO2 keys typically extend coverage to contractors and cloud-native systems PIV doesn’t reach.
What NIST assurance level do government systems need?
High-sensitivity federal systems require NIST SP 800-63B Authenticator Assurance Level 3 (AAL3), which mandates a hardware-bound cryptographic authenticator. Systems handling lower-sensitivity data can operate at AAL2.
Are synced passkeys allowed under federal zero trust mandates?
Synced passkeys that can move between devices typically achieve AAL2, not AAL3, which disqualifies them for controlled unclassified information and other high-sensitivity federal workloads. They’re acceptable for lower-sensitivity internal tools.
What happens if a passwordless credential is compromised?
Removing the password stops credential theft at login, but a compromised session or device can still let an attacker move laterally to adjacent systems. Identity microsegmentation contains that movement by limiting what a compromised session can reach.
Does passwordless authentication replace identity microsegmentation?
No, passwordless authentication and identity microsegmentation solve different problems. Passwordless removes the reusable credential attackers steal at the front door; microsegmentation contains what happens if a session gets compromised anyway.
One last thing
The distinction most vendors don't volunteer in 2026: NIST separates hardware-bound authenticators from syncable ones, and only the hardware-bound kind clears AAL3. An agency that buys a passkey rollout assuming it satisfies OMB M-22-09 across the board is going to find that out during the audit, not before it.
Related guides
- Privileged access management for government agencies
- How to reduce blast radius after credential compromise
