Citizen Digital Identity Management: Findings from a Survey of the States 

Author & Staff Contact: Eric Sweden, Director, Enterprise Strategy, Architecture & Governance

NASCIO’s latest report on citizen digital identity management finds that states are increasingly treating digital identity as a foundational component of modern government, moving away from fragmented, agency-by-agency systems toward centralized or hybrid enterprise approaches. Based on responses from CIOs, CISOs and CTOs in 47 states and territories, the research highlights growing efforts to create a more seamless “digital front door” for residents while strengthening identity assurance, fraud prevention and cybersecurity. States continue to face significant obstacles, including inadequate funding, siloed identity solutions, organizational resistance and technical debt, even as emerging AI-enabled threats add new urgency to the issue. Looking ahead, the report points toward enterprise identity platforms, adaptive security, reusable credentials and digital wallets as part of a broader shift toward secure, interoperable and citizen-centered digital identity ecosystems.

---

• The 2026 NASCIO President’s Initiative: Citizen Digital Identity Management
• Background and Context
• State Approaches to Citizen Digital Identity Management
• Approaches for organizing and managing citizen digital identity management
• Business Drivers Behind Citizen Digital Identity Initiatives
• Barriers & Challenges in Planning & Delivering Citizen Digital Identity Management
• Preparing for AI-driven identity threats
• Emergent Strategies for Managing Citizen Digital Identity
• The Road Ahead and Recommendations

Establishing confidence that someone is who they claim to be requires validating identity claims, verifying that identity and granting access only to authorized resources. This is a complex value stream in the digital world where fraud is rampant, the stakes are high and sophisticated attacks on citizens continue to escalate. 

State government is at the center of this challenge and is working diligently to address the burgeoning challenges, threats and costs incurred by our citizens. Citizens are not abandoned. State governments are creating, experimenting, collaborating, learning and building a portfolio of business and technical capabilities to ensure government services are delivered to those who are intended to receive them. While leveraging every available means, states are protecting citizens’ identities in a digital world. 

The 2026 NASCIO President’s Initiative: Citizen Digital Identity Management 

NASCIO 2025-2026 President, J.R. Sloan, CIO for the State of Arizona, set his stated purpose in the charter for this year’s presidential initiative: “Deliver a time-bound effort to help states better understand, evaluate and navigate citizen identity management decisions that are increasingly foundational to cybersecurity, digital services, program integrity and public trust.” 

“Time bound” is an important descriptor in this year’s initiative as it would have been impossible to discover or surface every issue or dimension of this critical subject. We conducted a limited survey of all states and a set of interviews to address some aspects of citizen digital identity management and those findings are presented in this brief.  We look forward to future efforts to continually build on our understanding, our experiments and our continual transformation of state government business and technology capabilities. 

This effort could not be effectively addressed without the partnering state governments have with industry. Industry provides state government with the research and development to enable the many state government service delivery value streams for engaging and serving citizens. 

Background and Context 

Identity management has become a critical dependency for citizen-facing digital services offering no-wrong-door service delivery and reducing fraud. Despite its importance, state identity management efforts remain fragmented and uneven. Based on the 2024 State CIO Survey only thirteen percent of state chief information officers (CIOs) indicate that they had a fully implemented citizen identity solution. Identity management has been on the NASCIO State CIO Top Ten Technology list every year except 2015. Identity management appears on the Top Ten Strategies every year starting in 2021.  

Many states struggle with siloed systems, unclear governance, inconsistent terminology and competing internal and external pressures. At the same time, citizens expect a streamlined and seamless experience in their interactions with their state government.  The 2026 NASCIO President’s initiative studies this duality and is one contributing effort to address a growing need for state-centered insight into how citizen identity decisions are made, sustained and adapted over time.  

State CIOs, chief information security officers (CISOs) and chief technology officers (CTOs) from 47 states and territories responded to our survey on this topic and we extend our thanks to these individuals. They put forth much effort in their responses, and the quality and detail of our information is a credit to their outstanding participation.  

State Approaches to Citizen Digital Identity Management  

• Statewide standards 
• Adoption of recommended approaches through shared governance, architecture review and service onboarding processes 
• Stated priority, support and oversight from the governor’s office 
• IT policies 

Some states, even those with established statutory authority, recognized that the most effective approach is through relationship building, collaboration, co-creation and shared governance. This is especially true in federated and decentralized organizational models. 

Approaches for organizing and managing citizen digital identity management  

A dominant theme across responses was the movement toward centralized or hybrid identity architectures. Many states described implementing enterprise identity platforms that provide common authentication services, while still allowing agencies to retain responsibility for program-specific authorization, business rules and user attributes. This hybrid model reflects the practical realities of state government environments, where agencies often maintain different operational needs, statutory authorities and legacy technology environments. 

Several states emphasized the importance of enterprise-wide authentication platforms serving as a unified “digital front door” for government services. These platforms are intended to reduce fragmentation by allowing residents to use a single account across multiple agencies and programs. Respondents consistently linked this approach to broader goals of improving user experience, reducing duplicate credentials, streamlining navigation across government services and strengthening citizen trust in digital interactions with government. Further discussion of citizen digital experience is presented in NASCIO’s 2023 publication, Creating a Citizen-Centric Digital Experience: How Far Have We Come? 

Multiple respondents described large-scale enterprise identity platforms intended to centralize authentication, enable secure data sharing and improve consistency across state services. Some states reported supporting millions of constituent accounts across dozens of agencies while integrating identity verification, adaptive authentication and shared user profile capabilities into their enterprise platforms. Others described statewide single sign-on environments intended to consolidate access across hundreds of systems and applications. 

At the same time, many states acknowledged they remain in transitional stages of implementation. Numerous respondents described ongoing migrations from decentralized and fragmented agency-managed identity environments toward more centralized enterprise models. Several states noted that legacy applications continue to operate outside enterprise identity platforms and that modernization efforts are proceeding incrementally over time. Responses frequently referenced phased onboarding strategies, gradual agency adoption and modernization roadmaps extending over multiple years. 

Several states noted that enterprise identity services are available but that not all agencies or applications have yet migrated. Others described their efforts as early-stage initiatives tied to broader constituent portal modernization or digital government strategies. 

Importantly, the responses demonstrated that citizen digital identity initiatives are often tightly coupled with larger digital transformation strategies rather than being pursued as standalone identity projects. Many respondents linked their identity modernization efforts to statewide portal initiatives, business service modernization, or “one-stop shop” government service strategies. In these cases, identity management functions as an enabling layer supporting broader goals around digital government integration and service delivery transformation. 

States repeatedly framed digital identity as a mechanism for reducing friction in citizen interactions with government. Respondents referenced goals such as minimizing password resets, enabling seamless navigation between agencies, simplifying access to services and consolidating multiple user accounts into unified resident profiles. Several states specifically referenced “digital front door” strategies intended to create a more intuitive and citizen-centered government experience. 

Governance and enterprise authority also emerged as major differentiators among state approaches. More mature programs often described strong central leadership through statewide CIO authorities, enterprise technology offices, or formal governance structures that establish common standards and adoption requirements. Some states require the use of centralized identity services for new systems or include enterprise identity requirements within vendor contracts. Others are relying more heavily on collaboration, onboarding playbooks and shared services models to encourage adoption across agencies. 

Several respondents described governance approaches involving centralized oversight combined with agency operational participation. Some states indicated that enterprise identity platforms are mandatory for newly modernized applications requiring authentication, while others described the use of onboarding playbooks, developer guidance and statewide policy frameworks to standardize implementation approaches across agencies. 

Another significant finding was the growing emphasis on identity assurance and fraud mitigation. Respondents from more mature states increasingly described risk-based approaches that align verification requirements with the sensitivity of services being accessed. Several states referenced identity proofing, adaptive security controls, multi-factor authentication, biometric validation and tiered trust models designed to balance usability with fraud prevention. 

Several respondents described approaches that align identity verification requirements to the level of risk associated with specific services, while still seeking to minimize barriers for users. Others referenced “single identity” models that combine orchestration, single sign-on and risk-based identity proofing to scale assurance levels according to fraud risk and business need. 

This evolution signals a broader shift in how states conceptualize digital identity. Rather than treating identity solely as an access management or cybersecurity function, leading states increasingly view digital identity as a strategic trust capability that must simultaneously support security, privacy, convenience and service delivery modernization. Collectively, the responses suggest that states are converging around a common long-term vision: enterprise digital identity as a shared statewide service delivered through hybrid architectures that balance centralized governance with agency flexibility. However, the survey also demonstrates that most states remain in varying stages of maturity and transformation. For many, the journey from fragmented identity environments to fully integrated enterprise identity ecosystems is still actively underway. 

Business Drivers Behind Citizen Digital Identity Initiatives  

We next asked states to describe the business driver(s) or circumstance(s) that initiated their public/citizen digital identity management initiative. Responses to the survey revealed that citizen digital identity initiatives are being driven by a convergence of operational, security, modernization and customer experience pressures. While individual state circumstances vary, respondents consistently described digital identity efforts as emerging from broader attempts to simplify government interactions, modernize aging systems, strengthen security and create more unified digital service environments. 

The single most common driver identified across responses was fragmentation. Many states described environments in which residents were required to maintain multiple usernames, passwords and identity records across different agencies and programs. Respondents noted that this fragmented approach created confusion for users, increased administrative burden, weakened security controls and produced inconsistent experiences across government services. 

Several respondents explained that agency-specific identity systems evolved independently over time as online services expanded, resulting in disconnected authentication environments that became increasingly difficult to manage and maintain. In many cases, identity modernization efforts began as attempts to consolidate these fragmented systems into more unified enterprise platforms capable of supporting multiple agencies and programs through a shared identity layer. 

Improving the citizen experience emerged as another major catalyst for action. Respondents frequently framed digital identity initiatives as part of broader efforts to make government easier to navigate and more accessible through digital channels. States described goals such as reducing login complexity, minimizing repeated identity verification steps, simplifying online transactions and enabling residents to access multiple services through a single account or “digital front door.” Many respondents emphasized that citizen expectations for government services increasingly mirror expectations formed through private-sector digital experiences. Residents now expect streamlined, mobile-friendly, secure and intuitive online interactions and states are under growing pressure to modernize accordingly. Several responses referenced “no wrong door” or “one-stop” service delivery strategies intended to provide more seamless access across agencies and programs. 

Digital government modernization initiatives also played a central role in launching many identity programs. Respondents repeatedly connected citizen identity efforts to larger statewide modernization strategies, including constituent portals, integrated business service platforms, health and human services modernization and enterprise digital transformation programs. In many cases, states indicated that identity management became essential as they attempted to unify services behind centralized portals or integrated service delivery environments. 

Several respondents explained that identity management initiatives initially emerged from specific programmatic efforts, such as business registration systems, workforce services, motor vehicle modernization or online benefits delivery. As those services expanded, the need for a shared identity framework capable of supporting cross-agency interactions became increasingly apparent. 

Security, fraud prevention and identity assurance concerns were also consistently identified as major drivers. Respondents noted growing concerns around cybersecurity threats, inconsistent identity verification practices and increasing fraud targeting public benefit systems and citizen-facing services. Several states specifically referenced the importance of multi-factor authentication, stronger identity proofing, enterprise monitoring and standardized authentication controls as part of their modernization efforts. 

For some respondents, the COVID-19 pandemic served as a significant accelerator, exposing vulnerabilities in fragmented identity systems during periods of heightened online service demand and increased fraud attempts. These experiences reinforced the need for stronger enterprise identity capabilities capable of supporting secure remote access to government services at scale. 

Legacy technology constraints were another recurring theme throughout the responses. Many states described aging identity infrastructure that could no longer support modern security standards, mobile-first service delivery or scalable digital government strategies. Respondents cited challenges associated with maintaining technically fragile systems, supporting legacy integrations and relying on specialized skill sets to sustain outdated identity environments. 

These modernization pressures are driving states toward enterprise identity platforms and shared services models that can support long-term digital transformation goals while reducing duplication and operational complexity. Several respondents also emphasized that centralized identity environments can reduce overall maintenance costs by eliminating redundant systems and consolidating infrastructure investments. 

The responses further demonstrated the importance of executive leadership, legislation and funding in accelerating identity modernization efforts. Several respondents noted that momentum increased significantly when digital identity initiatives received direct support from governors, statewide modernization strategies, legislative mandates and/or dedicated funding programs. In some cases, respondents indicated that efforts remained fragmented or stalled when enterprise sponsorship or sustained funding were absent. 

Collectively, the responses suggest that citizen digital identity initiatives rarely emerge from a single isolated driver. Rather, they are typically the product of intersecting pressures related to fragmented user experiences, growing fraud and cybersecurity concerns, aging infrastructure, modernization priorities and increasing expectations for accessible and trustworthy digital government services. Across the responses, states consistently portrayed digital identity as an increasingly foundational capability necessary to support the next generation of digital government transformation. 

Barriers & Challenges in Planning & Delivering Citizen Digital Identity Management  

We asked what barriers and challenges states have encountered when working toward delivering public/citizen digital identity management capabilities.  Inadequate funding, a significant barrier, was the top answer. This is related to budget availability of partner agencies to adopt a centralized platform for access to existing applications. 

The second highest ranked choice was fragmented and siloed identity solutions, while organizational resistance to enterprise approaches was third, and technical debt ranked fourth. 

Additional response data from comments described the barrier of account reconciliation, a process for linking legacy accounts to newly created and managed digital identification. Stricter security requirements like multifactor authentication (MFA) often assume citizens have reliable access to personal devices, connectivity and digital literacy which can create barriers for some individuals. Some citizens may struggle with completing steps in creating a digital identity. This leads to citizens dropping out of the process before completion, increased lockouts and/or inequitable access to services. There is also the presence of available capacity in some states for providing advanced support over the phone when self-service is not adequate or available. 

Preparing for AI-driven identity threats  

Survey responses revealed that states are increasingly aware of the growing risks posed by AI-enabled identity attacks and are beginning to adapt their identity, cybersecurity and fraud prevention strategies accordingly. While levels of maturity vary considerably, respondents consistently described efforts to strengthen identity assurance, modernize authentication practices, improve fraud detection and expand monitoring capabilities in response to rapidly evolving threats such as synthetic identities, deepfake-enabled fraud, automated account abuse and sophisticated phishing campaigns. This is explored in detail in the 2026 NASCIO-Deloitte Cybersecurity Study. 

A notable theme across responses was that most states are not approaching AI-driven identity threats as a completely separate discipline. Instead, respondents described building upon existing identity security and cybersecurity foundations by extending current fraud prevention, identity proofing, multi-factor authentication and security operations capabilities to address emerging AI-related risks. 

Many respondents emphasized that AI-driven threats are accelerating the need for stronger identity verification at both account creation and authentication stages. In particular, states described growing concern around synthetic identities, AI-generated spoofing attempts, deepfake-enabled impersonation and increasingly sophisticated automated attacks targeting citizen-facing systems. As a result, many states are strengthening identity proofing controls and exploring technologies capable of validating that users are legitimate individuals rather than AI-generated personas or manipulated credentials. 

Several respondents specifically referenced the use of biometric verification, liveness detection and enhanced identity proofing services as critical defensive measures. These capabilities are increasingly viewed as essential protections against generative AI-based fraud attempts that can mimic human behavior, manipulate images, or automate credential attacks at scale. 

Risk-based and adaptive authentication strategies also emerged as foundational components of state responses. Many respondents described scaling identity verification requirements according to the sensitivity and fraud risk associated with specific services or transactions. Lower-risk activities may require minimal friction, while higher-risk services involve stronger proofing, additional authentication steps or enhanced monitoring controls. 

Respondents frequently referenced behavioral analytics, contextual signals, anomaly detection and adaptive access controls as mechanisms for identifying suspicious activity patterns associated with AI-enabled attacks. Several states also discussed continuous monitoring approaches intended to identify unusual login behavior, automated account activity or indicators of synthetic identity fraud in real time. 

The responses further demonstrated that zero trust principles and phishing-resistant authentication are becoming increasingly central to state identity security strategies. Numerous respondents referenced MFA, passkeys, risk-based authentication, endpoint protections and continuous verification models designed to reduce implicit trust and strengthen defenses against credential compromise. 

Several states also described expanding the role of security operations centers (SOCs), threat intelligence platforms and enterprise monitoring capabilities to better identify and respond to AI-enabled attacks. Respondents noted that AI-driven threats often evolve more quickly than traditional signature-based security tools can detect, creating growing interest in behavioral analysis and intelligence-driven detection models capable of identifying suspicious activity patterns. 

Another important finding was the heavy reliance on vendor ecosystems and external partnerships to build AI-threat readiness capabilities. Many states indicated that they are leveraging commercial identity verification platforms, fraud detection services and evolving AI-enabled security tools to strengthen protections against synthetic identities, bot activity and automated fraud attempts. Several respondents noted that their vendors are continuously enhancing liveness detection, anomaly detection and AI-spoofing protections in response to emerging threats. 

This reliance on vendor capabilities reflects both the rapidly evolving nature of AI threats and the complexity of developing advanced detection capabilities internally. In several responses, states described ongoing evaluations of emerging technologies and participation in cybersecurity information-sharing networks to stay informed about evolving attack methods and defensive practices. 

At the same time, the responses revealed substantial variation in preparedness and organizational maturity. Some states described layered enterprise approaches that integrate identity telemetry, fraud analytics, threat intelligence, governance and coordinated cybersecurity operations into broader digital identity strategies. Others indicated that they are still in exploratory phases, monitoring AI developments, piloting tools or beginning internal discussions about how to address emerging threats. 

Several respondents acknowledged that formal, AI-specific identity threat playbooks, governance models or operational frameworks have not yet been fully established. Some states indicated that responsibility for AI-driven identity risks remains diffused or is still being incorporated into broader cybersecurity modernization efforts. Others noted that foundational identity or cybersecurity capabilities are still under development, limiting their ability to fully address advanced AI-enabled attack scenarios at this stage. 

The responses collectively suggest that states increasingly recognize AI-driven identity threats as a significant and rapidly evolving challenge requiring both technical and organizational adaptation. Throughout the survey, respondents consistently portrayed identity security as shifting from a static authentication function toward a more continuous, intelligence-driven discipline focused on adaptive trust, behavioral monitoring and resilient fraud prevention. 

At the same time, the findings indicate that many states remain in the early stages of translating awareness into comprehensive operational strategy. While some states are implementing sophisticated, layered defenses and enterprise-wide monitoring approaches, others are still building the foundational governance, identity and cybersecurity capabilities necessary to respond effectively to AI-enabled threats over the long term. 

Emergent Strategies for Managing Citizen Digital Identity  

Survey responses indicate that states are increasingly moving toward a future vision in which citizen digital identity functions as foundational, statewide digital infrastructure rather than as a collection of isolated agency authentication systems. While implementation maturity varies significantly, respondents consistently described long-term strategies centered on enterprise identity platforms, stronger identity assurance, interoperable credentials, adaptive security controls and more seamless citizen experiences across government services. 

A dominant theme throughout the responses was the continued evolution toward enterprise-scale identity ecosystems governed through centralized standards and shared services models. Many states described future strategies focused on expanding statewide single sign-on capabilities, consolidating fragmented identity environments and establishing identity management as a formal enterprise service supporting multiple agencies and programs. 

Even among states pursuing federated approaches, respondents emphasized the importance of centralized governance, common standards and interoperable identity frameworks that allow agencies to retain operational flexibility while participating in a coordinated statewide ecosystem. Several responses described future identity environments built around shared platforms intended to provide consistency, scalability and operational sustainability across government services. 

Many respondents also demonstrated that states increasingly view digital identity as extending beyond authentication alone. Rather than focusing solely on login consolidation, several responses described broader “digital trust” visions in which identity becomes the foundation for secure data sharing, personalized service delivery, reusable credentials, citizen-controlled information management and integrated digital government experiences. 

Some states described future environments in which trusted identities enable residents to securely share verified information across programs and agencies, while maintaining greater visibility and control over how their data is used. Others emphasized the importance of reducing friction in service delivery while improving precision, interoperability and cross-program coordination. These responses suggest that states increasingly see citizen identity management as central to enabling more connected and citizen-centric digital government ecosystems. 

Security modernization and stronger identity assurance capabilities were also prominent throughout the responses. Many states identified expanded identity proofing, phishing-resistant authentication, risk-based access controls, fraud detection and adaptive authentication as core components of their future identity strategies. Several respondents referenced plans to strengthen multi-factor authentication through technologies such as FIDO2, WebAuthn, biometrics and continuous trust evaluation models. 

Respondents frequently described future architectures in which authentication decisions become more contextual and dynamic, with systems continuously evaluating behavioral, transactional and environmental risk signals rather than relying solely on static login events. This reflects a broader shift toward continuous trust and adaptive security models capable of responding to evolving fraud risks and AI-driven attack methods. 

A particularly significant emerging trend involved growing interest in reusable credentials, digital wallets and portable identity capabilities. Multiple respondents referenced future plans involving mobile driver’s licenses, verifiable credentials, shareable user profiles and interoperable digital wallet frameworks. Several states indicated that they are beginning to explore models that allow individuals to maintain greater ownership and portability of their digital identity information across services and potentially across jurisdictions. 

These responses suggest an important evolution in state thinking: moving beyond traditional account management toward citizen-centered digital identity ecosystems that support reusable trust relationships and privacy-preserving credential exchange. Several respondents also referenced decentralized identity concepts, provider-agnostic architectures and open standards-based interoperability models designed to reduce dependency on siloed platforms while supporting long-term flexibility. 

The responses additionally revealed increasing attention to privacy, accessibility and inclusion as core design principles for future identity systems. Some respondents emphasized the need for secure fallback options for individuals unable or unwilling to complete digital identity verification online, while others highlighted the importance of privacy-preserving verification approaches and citizen-controlled identity frameworks. This indicates growing recognition that future digital identity systems must balance security and fraud prevention with equity, usability and public trust. 

At the same time, respondents acknowledged substantial operational and governance challenges associated with realizing these future-state visions. Several states noted that legacy system retirement remains more difficult, expensive and time-consuming than originally anticipated. Others identified sustainable funding, enterprise governance, policy alignment and agency adoption as ongoing barriers to progress. 

A number of respondents emphasized that long-term success will depend not only on technology modernization, but also on establishing durable governance structures, enterprise funding models and policy frameworks that recognize citizen digital identity as a shared statewide capability rather than an agency-specific solution. Several states also noted that broader adoption strategies will be necessary to encourage participation across agencies, local governments and external partners. 

Finally, some of the most forward-looking responses demonstrated that a subset of states are already beginning to plan for next-generation identity environments shaped by emerging technologies and evolving digital interaction models. Respondents referenced concepts such as agentic identity, continuous authentication, privacy-preserving proofing, AI-aware trust models and digital identity ecosystems capable of supporting interactions initiated by autonomous software agents acting on behalf of individuals. 

These responses suggest that while many states remain focused on enterprise consolidation and modernization, others are beginning to position their identity strategies for a future in which digital trust, interoperability, automation and citizen-controlled credentials become increasingly central to government service delivery. 

Collectively, the responses portray a clear strategic trajectory: states are moving away from fragmented authentication systems toward more integrated, enterprise-scale, citizen-centered digital identity ecosystems. Across the survey, respondents consistently emphasized that the future of citizen digital identity will require stronger security, broader interoperability, adaptive trust models, reusable credentials and governance structures capable of supporting long-term digital transformation while maintaining public trust and accessibility. 

The Road Ahead and Recommendations 

This research project surfaces and emphasizes a number of insights, many of which are no surprise. Possibly this research validates what state CIOs already know. More work will be done in this area going forward as effective citizen identity management is critical to the delivery of state services. 

• Identity management is recognized as a cornerstone capability for security, privacy, digital service delivery and citizen experience. 
• Identity management must be a centralized capability for effectiveness, consistency within state government and for those connecting with state government. 
• Identity management architecture will continue to evolve. Future approaches will include things such as self-sovereign identity and digital wallets that address the necessity of centralized governance and the existing myriad of applications and program services. 
• Movement toward a centralized governance will require effective marketing and communication to gain support and adoption. 
• Multi-state collaboration should be orchestrated through ongoing roundtable discussions. 
• State government must prepare now for advances in technology that will create new challenges for effective identity management.