M-22-09 made the login phishing-proof and moved the weak point to enrollment and recovery
OMB’s zero trust memo told agencies to adopt authentication that phishing cannot defeat. Strong authenticators shifted attacker attention to how credentials are issued, replaced and reset, a process run by help desks the memo barely mentioned.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On January 26, 2022, the Office of Management and Budget issued memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles. It set specific goals for federal agencies to meet by the end of fiscal year 2024, organized around the pillars of CISA’s zero trust maturity model: identity, devices, networks, applications and workloads, and data. Agency staff, contractors and partners were to use enterprise-managed identities and phishing-resistant multifactor authentication, with the memo naming the federal PIV smart card and the WebAuthn standard. Public-facing systems were to offer phishing-resistant options. Agencies were also to keep complete device inventories, encrypt DNS and web traffic, and make at least one internal application available over the internet, protected by identity rather than network location. The memo told agencies to drop password rules requiring special characters or regular rotation. It followed the May 2021 executive order on improving the nation’s cybersecurity.
Most multifactor authentication in 2022 used one-time codes by text or app, or push approvals. Those methods stop password reuse, but an attacker running a convincing fake login page can relay the code in real time, and a user flooded with push prompts may approve one. M-22-09 required methods that bind the login to the genuine site, so a fake page gets nothing it can use. That closed the most common route into agency accounts. It also changed where a determined attacker would push next. If the login cannot be phished, the attacker targets the moments when a credential is created, replaced or reset. We look at three of those moments: issuing the authenticator, recovering a lost one, and the applications that cannot yet accept it.
Issuing the authenticator
A phishing-resistant credential is only as trustworthy as the process that put it in someone’s hands. For PIV cards, that process was mature: in-person identity proofing, background checks and controlled card issuance. The difficulty was coverage. Many people who touch agency systems do not hold PIV cards, including short-term contractors, some field staff, partners at state agencies and users of shared workstations. Others hold cards but use devices, such as phones and some cloud applications, where card readers do not work.
Security keys and platform authenticators based on WebAuthn filled those gaps. Each one needs an enrollment step that links the new authenticator to the right person. If enrollment means a user signs in with a password and a text code and then registers a key, the strong credential inherits the weakness of the weak one. An attacker who phished the old factors can enroll their own key and keep it. Agencies that did this well tied enrollment to an existing strong credential, such as the PIV card, or to supervised proofing, in person or by video with document checks. They logged every enrollment and alerted the user through a separate channel when a new authenticator appeared on their account.
Distribution has a cost. Shipping keys to remote staff, keeping spares, tracking which serial number belongs to whom and handling returns at offboarding is logistics, not configuration. Agencies that budgeted for it as a supply chain moved faster than those that treated keys as an accessory.
Recovering a lost one
People lose keys, replace phones and forget PINs. Each event sends them to a help desk, which must decide quickly whether the caller is who they claim to be and then issue a temporary credential. That decision is now the softest point in the system. A help desk agent who resets a privileged user’s authentication on the strength of a confident voice and a few facts from a social media profile undoes the whole investment.
Recovery procedures needed the same rigor as enrollment. Practical controls include a callback to a number already on file, manager or sponsor confirmation, video verification against the photo on record for privileged accounts, and a short, scoped temporary access pass rather than a reset to a password. Privileged accounts warrant a separate recovery path with more checks and a delay. Each recovery should generate an alert to the user and to security, since an unexpected reset is a strong signal of attack.
The trade-off is service time. Users locked out of their accounts cannot work, and help desks are measured on resolution speed. Agencies had to accept that recovery for high-risk accounts would take longer and to explain why. Issuing two authenticators at enrollment, so that losing one does not trigger recovery at all, reduced the volume.
Many agencies outsource their help desk, sometimes to a contractor serving several agencies at once. The recovery procedure then lives in a statement of work and a script the agency may never have read. Contract terms should spell out the verification steps for each account tier, require recorded calls for privileged resets, and give the agency access to reset logs. A monthly sample of resets, checked against the procedure, shows whether the script is followed when the queue is long.
The applications that cannot accept it
The third moment is quieter. Phishing-resistant authentication works through an identity provider that applications trust. Legacy applications with their own password databases, older protocols that send passwords directly, mainframe access and some commercial products could not be put behind modern single sign-on without changes. For those, agencies kept passwords and weaker factors alive, and attackers went looking for them.
The memo’s requirement to make at least one internal application available over the internet, protected only by identity and device checks, was a forcing function here. It made agencies prove, on one real system, that modern authentication could replace the network boundary. It also exposed how many applications were not ready. A practical path was to inventory every authentication route into each high-value application, including service accounts, application programming interface keys and legacy protocols, and to close or wrap them one by one. An application with modern single sign-on at the front door and a basic-authentication interface at the back is still exposed.
With hindsight
Agencies made uneven progress against the September 2024 deadline, with legacy applications, device inventories and funding commonly cited as obstacles. Phishing-resistant methods spread steadily, helped by passkey support across major operating systems and browsers. The shift of attacker attention to enrollment and recovery played out in public. In 2023, attackers used calls to IT help desks to reset credentials at major casino operators, and help desk social engineering remained a leading route into large organizations in 2024 and 2025. NIST’s revised digital identity guidelines, SP 800-63-4, finalized in 2025, gave more detailed treatment to account recovery and authenticator binding. By this point in 2026, regulators and insurers in finance and health care ask about phishing-resistant methods by name, and the better security reviews ask about the help desk in the same breath. M-22-09 named the login standard clearly. The recovery process needed the same clarity.