OMB M-22-09 Federal Zero Trust Strategy Guide: Requirements, Deadlines and Current Status

OMB Memorandum M-22-09 is the document that turned zero trust from an architecture concept into a dated list of things every US federal civilian agency had to do, yet most summaries of it stop at "phishing-resistant MFA" and miss the device, network, application and data actions that agencies and their suppliers are still measured against. Issued on 26 January 2022 as "Moving the U.S. Government Toward Zero Trust Cybersecurity Principles", it implements Executive Order 14028 and set specific goals to be met by the end of Fiscal Year 2024. This guide sets out every action in the memo pillar by pillar, the full deadline schedule, what has changed since (including the May 2026 rescission of the logging memo it relies on), how compliance has been assessed in practice, and what the memo means for service accounts, workloads and other non-human identities. It is for federal CISOs and zero trust leads, contractors and cloud providers selling to agencies, and private sector architects who use the memo as a benchmark. Status was checked on 13 November 2026. For the maturity model that agencies score themselves against, see the CISA Zero Trust Maturity Model Guide.

Key takeaways

• It is a list of actions, not a framework. M-22-09 sets concrete goals across five pillars (Identity, Devices, Networks, Applications and Workloads, Data) that map to the CISA Zero Trust Maturity Model, with a deadline of the end of FY2024 for the strategic goals.
• Phishing-resistant MFA is mandatory for the workforce. Staff, contractors and partners must use it; PIV and WebAuthn/FIDO2 are the named examples, and SMS, voice, one-time codes and push notifications do not meet the bar for routine access.
• Some instructions surprise people. Agencies had to drop special-character and periodic-rotation password rules, treat every application as internet-accessible, and make at least one FISMA Moderate system reachable from the internet.
• The memo still stands, but its logging anchor does not. As of November 2026 no rescission of M-22-09 is shown by the federal identity programme, while M-26-14 of 22 May 2026 rescinded M-21-31, the logging memo that M-22-09 cites for its EL-1 deadline and Data pillar logging.
• Non-human identities are where agencies still fall short. The memo's identity language is written for people, but its principles (enterprise-managed identity, no network-level trust, device signals, logged key use) apply directly to service accounts, workload credentials and AI agents.

What M-22-09 is and where it sits

M-22-09 was issued by the Office of Management and Budget (OMB) to the heads of executive departments and agencies. OMB published a draft for public comment in September 2021 before the final memo. Its core instruction is that agencies stop relying on perimeter defences and "trusted networks" and instead verify every user, device, application and transaction continuously. It covers agencies as defined in 44 U.S.C. 3502, focuses mainly on internal enterprise security, and also reaches some public-facing systems such as those handling background investigations or contractor financial data.

The memo is one piece of a set. It depends on other OMB memoranda and CISA programmes, and reading it alone gives a misleading picture of the work involved.

The five pillars: every required action

Section III of the memo groups its actions into five pillars. The table below lists each action as the memo frames it, with the practical work behind it.

The memo sets no numeric thresholds for MFA coverage, password length or inventory completeness. Agencies and assessors therefore define their own measures, which is why the metrics in this guide matter.

Deadlines and task matrix

Appendix B of the memo is a task matrix. Days run from the memo date of 26 January 2022.

One inconsistency is worth knowing if you audit against the text: the body asks for an FY24 budget estimate, while Appendix B refers to FY23 to FY24.

Current status as of November 2026

• M-22-09 itself: the federal identity programme's page for the memo (idmanagement.gov) lists no item rescinding it, and the OMB/CISA site zerotrust.cyber.gov still presents it as the Federal Zero Trust Strategy. The end of FY2024 deadline has passed, so the memo now works as the standing baseline that agency zero trust maturity is measured against rather than as a project with a future deadline.
• Logging dependency changed: OMB M-26-14, "Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats", dated 22 May 2026, states that M-21-31 is rescinded effective immediately. It does not mention M-22-09. It tasks CISA with a Logging Reference Architecture that "will align with the Zero Trust Maturity Model", and sets new maturity deadlines counted from that architecture's publication, with retention of at least 6 months searchable and 1 year retrievable. Read every M-22-09 reference to M-21-31 and EL-1 against M-26-14 now.
• Executive orders: Executive Order 14306 of 6 June 2025 amended Executive Orders 14144 and 13694; it did not amend or revoke EO 14028, the order M-22-09 implements. EO 14306 adds a requirement for agencies to support TLS 1.3 or a successor no later than 2 January 2030, which sits naturally with the memo's HTTPS-everywhere action.

Policy in this area has changed often since 2025. Confirm the current position with OMB, CISA or your agency CIO before relying on a specific deadline.

How compliance is assessed in practice

There are no fines. M-22-09 is enforced through OMB concurrence on agency implementation plans, budget oversight, CISA programme data (CDM, EDR, external scanning) and inspector general audits. The Treasury Inspector General for Tax Administration report 2023-20-039 of 10 July 2023 is a useful public example of what auditors check:

• Plan and roles: the plan met OMB's deadline, but auditors recommended defining roles and responsibilities explicitly.
• Budget: the FY2024 budget estimate OMB required had not been prepared.
• Pillar balance: work concentrated on Identity, Devices and Applications, and auditors found it would not also satisfy the Networks and Data pillars.
• Coverage claims: EDR had been deployed to servers only, which matters because the memo expects wide deployment.
• Self-scoring accuracy: the agency rated 10 of 19 controls differently from an independent contractor, which rated it lower on 8 of them; auditors concluded maturity had not been assessed accurately.
• Roadmap quality: the roadmap was high level, without a completion schedule, gap analysis or pillar-by-pillar activities.

The lesson for any organisation using M-22-09 as a benchmark: evidence beats narrative. See the FISMA Guide for how these results feed annual reporting.

Phishing-resistant MFA: what qualifies

The Identity pillar is where most effort goes. CISA's fact sheet "Implementing Phishing-Resistant MFA" (October 2022) gives the operational reading.

The Twilio Breach 2022 shows the gap in practice: attackers texted staff links to fake SSO pages, captured credentials and one-time codes, and Twilio responded by moving its workforce to FIDO2 keys. CISA's rollout advice is to protect email, file servers, remote access and identity servers such as Active Directory first, start with administrators and help desk staff, and begin with services that already support FIDO, such as hosted mail and SSO. For mobile and derived credentials see the Derived PIV Credentials guide, and for the method choice the Phishing-Resistant MFA Guide.

Where non-human identities fit

M-22-09 talks about staff, contractors, partners and the public. It does not set rules for service accounts, API keys or workload credentials, yet its principles fail if machines are left out, because a workload with a static password and network-based trust is exactly the perimeter assumption the memo tells agencies to abandon.

• Enterprise-managed identity for workloads: the equivalent of "one enterprise identity per person" is one owned, inventoried identity per service, issued from a central identity system, not a shared account or a key in a configuration file. See the Non-Human Identity (NHI) Guide.
• Phishing resistance for machines: the nearest equivalent is short-lived, cryptographically bound credentials (federated tokens, managed identities, X.509 certificates) instead of long-lived secrets. See the Cloud Workload Identity Guide.
• Application-layer enforcement: service-to-service calls should be authorised on the calling workload's identity, not on source IP or network zone, which is what "MFA at the application layer, not the network layer" means for machines.
• Immutable workloads: redeploying instead of logging in removes standing administrator credentials to production, but moves the privilege into CI/CD pipelines, whose deployment identities then need the same scrutiny.
• Exclusions: MFA policies often exempt service accounts. Each exemption is a place where the memo's controls do not apply. See How to Find Accounts Excluded From MFA and Conditional Access.

The Colonial Pipeline Ransomware Attack 2021, in May 2021, the same month EO 14028 was signed, began with an unused VPN account without MFA: the same failure class as an orphaned service account.

How to implement: a phased approach

1. Baseline (first 60 days): name an accountable lead, map every M-22-09 action to an owner and an evidence item, and score each against the CISA Zero Trust Maturity Model with an independent reviewer.
2. Inventories: reconcile device inventory (endpoint management, EDR, network discovery, procurement) and build the internet-accessible application inventory using external scanning. Add a non-human identity inventory alongside them.
3. Identity first: consolidate to one enterprise identity provider; pilot phishing-resistant MFA with administrators and help desk; expand ring by ring; add a device compliance signal to sign-in policy in report-only mode, then enforce.
4. Password policy: remove composition and forced-rotation rules, add banned-password checks and rotation on evidence of compromise.
5. Network: enable encrypted DNS on managed clients and resolvers; move internal web and API services to HTTPS; replace broad VPN access with per-application access for one application group at a time.
6. Applications: publish a vulnerability disclosure policy; put internet-accessible systems on a recurring test cycle; pick one moderate-impact application to expose directly through strong identity controls as the proof point the memo asks for.
7. Data: run automated labelling and access rules in report-only mode, review false positives, then enforce for the most sensitive categories; move cloud encryption keys to managed key services with logs stored outside the workload account.
8. Rollback plan for every enforcement step: keep break-glass accounts with phishing-resistant authenticators stored offline, allow a time-boxed exception path for devices that fail compliance, and switch conditional access or labelling policies back to report-only if error rates exceed an agreed threshold.

Decision guidance

• PIV versus FIDO2: PIV is the established federal credential and suits staff with managed card readers; FIDO2 platform authenticators and security keys suit cloud services, mobile access and contractors without PIV. Many agencies run both, with FIDO2 filling PIV gaps.
• Federal agency versus contractor: agencies are bound by the memo directly; contractors feel it through contract clauses, FedRAMP authorisation and agency access policies. Contractors should map each action to the evidence an agency customer will ask for. See the FedRAMP Guide.
• Small versus large organisations: a small agency or supplier gets most of the value from consolidated identity, phishing-resistant MFA, EDR everywhere and a disclosure policy. A large department needs the full inventory and segmentation work and should fund it pillar by pillar.

Detection and measurement

• Phishing-resistant coverage: share of workforce sign-ins completed with PIV or FIDO2, tracked separately for administrators.
• Device signal enforcement: share of application sign-ins evaluated against device compliance.
• EDR coverage: share of inventoried endpoints, servers included, reporting to EDR in the last 24 hours.
• Encrypted DNS and HTTPS: share of DNS queries over DoH or DoT and of internal services serving HTTPS only.
• Disclosure and testing: internet-accessible applications covered by the disclosure policy and tested in the last 12 months; median time to fix reported vulnerabilities.
• Non-human identity exposure: service accounts excluded from conditional access, and long-lived secrets still in use, trending down.

Common failure patterns

• MFA at the VPN only: the memo requires application-layer enforcement; a VPN challenge followed by password-only internal applications does not meet it.
• Push with number matching treated as done: it is an interim control in CISA's guidance, not phishing-resistant MFA.
• Optimistic self-scoring: as the TIGTA audit found, internal scores can diverge from independent assessment on half the controls.
• Service accounts exempted from every policy: the identity pillar looks complete while machine credentials still rely on static passwords and network location.
• Logging plans still citing M-21-31: since 22 May 2026, logging work should be planned against M-26-14 and the CISA Logging Reference Architecture.

Framework mapping

Practitioner checklist

• Every M-22-09 action has a named owner and a current evidence item.
• Maturity scores have been checked by someone outside the programme.
• Workforce sign-in to every application requires PIV or FIDO2, enforced at the application or SSO layer.
• Password policy has no composition or periodic-rotation rules.
• Access policy uses a device compliance signal, and exceptions are time-boxed.
• Device inventory and EDR coverage reconcile, servers included.
• Encrypted DNS and HTTPS-only internal services are measured, not assumed.
• A public vulnerability disclosure policy covers all internet-accessible systems.
• Service accounts and workloads are inventoried, owned and moving to short-lived credentials.
• Logging plans reference M-26-14, not the rescinded M-21-31.

Standards and references

• OMB: M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
• OMB and CISA: Federal Zero Trust Strategy
• OMB: M-26-14 Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats
• OMB: M-22-01 Improving Detection of Cybersecurity Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response
• CISA: Implementing Phishing-Resistant MFA
• GSA IDManagement.gov: M-22-09
• TIGTA: Actions Are Needed to Improve the Zero Trust Architecture Implementation
• The White House: Executive Order 14306

Related NHI Mgmt Group resources: CISA Zero Trust Maturity Model Guide · NIST SP 800-207 Zero Trust Architecture Guide · OMB M-21-31 Logging Maturity Guide · Phishing-Resistant MFA Guide. This guide summarises OMB Memorandum M-22-09 and is not legal advice.