For a growing number of states, a single account that carries a resident through every government service is no longer aspirational. It’s built. Some states report enterprise identity systems already supporting millions of constituent accounts across dozens of agencies.
And yet, for many residents, online government services can still feel like a maze of separate logins, passwords, and identity checks that don’t quite talk to each other. Only 13 per cent of state CIOs say they have a fully implemented citizen identity solution, according to NASCIO’s newest survey of state technology leaders. Most fall somewhere in between, with the platform live but adoption still catching up.
Funding is a significant piece of this. Seventy per cent of the leaders NASCIO surveyed cite inadequate funding as a top barrier to enterprise identity, and residents feel it as a modern login for one service and something older and clunkier for the next. But funding is just the visible edge of a deeper issue. Until agencies agree on who holds the keys (who owns identity, whose data is authoritative, who’s accountable when something goes wrong), residents are the ones who feel it first.
One Login, Meant to Work Everywhere
The vision behind enterprise identity is fairly simple. A resident signs in once and moves between unemployment benefits, vehicle registration, and business licensing without re-proving who they are each time. Individual agencies keep their own program rules, while the identity layer underneath is shared across all of them.
That shared layer doesn’t get built overnight. It takes sustained investment, and not every state has secured enough of it yet. NASCIO found that many states already have their enterprise identity service up and running, but individual agencies haven’t fully migrated onto it, often because funding for that migration hasn’t kept pace with the platform itself. The front door is built. Not every hallway leads to it, at least not yet.
This isn’t really a failure of planning. It’s simply how large, decentralized organizations tend to modernize, a little at a time, agency by agency, budget cycle by budget cycle. The tradeoff is that the resident experience stays uneven throughout the transition. Some services feel modern and seamless. Others still run on an account created years ago, tied to a system nobody’s quite ready to retire, or funded to replace.
Bringing Old Accounts Into the New System
One challenge states keep raising gets little attention outside the CIO’s office, namely what happens to the identities that already exist.
Every resident who’s interacted with a state government before the new platform arrived already has some kind of digital footprint, whether that’s an old DMV login, a benefits portal account, or a licensing credential. Enterprise identity doesn’t erase that history. It has to be reconciled. Linking legacy accounts to a new, unified identity tends to be slower and messier than building the new system in the first place, and it’s rarely the part of the project that gets budget attention up front.
Skip it, and the front door ends up working against itself. It becomes a shiny new entry point that still asks residents to create yet another account, undercutting the entire point of consolidation.
Keeping It Secure Without Leaving People Behind
The instinct to secure a unified identity with stronger verification (multifactor authentication, device-based checks, identity proofing) makes sense. It’s also where things can get harder for the people the front door is meant to help most.
Stronger verification tends to assume residents have a personal device, reliable connectivity, and the digital literacy to get through the process without help. Not everyone does, and NASCIO’s research is candid about the consequences. Some residents abandon identity creation partway through, get locked out, or fall back on phone calls and in-person visits, the exact friction the digital front door was meant to remove.
That’s the balance every state is working through in real time. Identity systems need to be harder to fake and easier to use at the same time, for a population with very different levels of comfort with digital tools.
Staying Ahead of a Changing Threat
The identity challenge is also evolving because the tools attackers use are evolving. States told NASCIO they’re increasingly concerned about synthetic identities, deepfake-enabled impersonation, automated account abuse, and more sophisticated phishing, all of which put pressure on the login process the digital front door depends on.
Rather than treating this as an entirely new security discipline, most states are extending the identity proofing, fraud prevention, and cybersecurity tools they already have. That means layering in behavioral analytics, anomaly detection, and continuous monitoring to catch suspicious activity beyond the login screen.
Readiness varies widely. Some states already run layered defenses that bring identity data, fraud analytics, and threat intelligence together. Others are still evaluating tools or working out how AI-driven identity threats should be handled internally, and several acknowledged that formal playbooks and governance models for this specific risk haven’t been built yet. For residents, that unevenness matters just as much as any funding or migration gap. A login that feels secure and seamless with one agency may not hold up the same way with another.
Looking Ahead
The pattern across these findings is quite consistent. What shows up as a resident experience problem is frequently rooted in unresolved questions about ownership, authority, and trust between agencies that were never built to share a resident’s identity in the first place. Closing that gap isn’t only a design exercise, it’s a governance exercise that has to happen alongside any platform decision, not after it.
NASCIO’s report also looks beyond the idea of a single state account, pointing toward reusable, verifiable credentials that could reshape how residents’ digital identities are used and shared across services. But that future still depends on getting the basics right first. States have to retire legacy systems, secure sustainable funding, establish governance, and bring agencies along, work that, for many, is still very much in progress.
That’s also why citizens’ confidence matters as much as agencies’ agreement. Recent research on digital government adoption found that 80 per cent of citizens say they feel confident in the protective measures behind digital government services when strong encryption and multi-factor authentication are visibly part of the experience, a reminder that the governance decisions made behind the scenes shape public trust just as much as the interface residents actually see.
That’s precisely where a purpose-built citizen identity and access management layer earns its keep. A platform like CitizenOne is designed to absorb this complexity centrally. It brings citizens and service providers together through a single entry point and verifiable credentials, so residents aren’t left managing a different profile, password, and verification process for every agency they touch. It also gives residents more control over how their information is used, while helping shield agencies from the fragmented, harder to secure systems that legacy identity sprawl tends to create.
Layering in CertifiO ID‘s high assurance verification, matched to the risk of each transaction rather than applied uniformly, gives states a way to scale scrutiny where it’s needed most without adding friction everywhere else. As the fraud tactics covered above continue to evolve, that combination of a unified identity foundation and risk calibrated verification is what lets defenses keep pace instead of constantly catching up. The front door only feels like one door when the work behind it, migration, reconciliation, access design, and fraud defense alike, is unified too.