What is FICAM?

The safe, secure, and uninterrupted operation of the federal government is paramount. Thus, it is vital to protect the government’s many resources including federal facilities and physical spaces as well as digital assets, systems, networks, and more.

Identity, Credential, and Access Management (ICAM) processes are the tools, policies, and systems that an agency uses to ensure that only the right individual can access the right resource, at the right time, for the right reason in support of federal business objectives.

Federal ICAM, or FICAM, is the term used to describe how the federal government implements ICAM. FICAM encompasses an enterprise approach for designing, planning, and executing ICAM processes. It includes four program elements that work synergistically:

1. FICAM Architecture and Playbooks: The FICAM Architecture provides an overall guide for meeting federal ICAM requirements in an efficient and secure way. It focuses on enterprise identity processes, practices, policies, and information security disciplines. Playbooks offer stakeholders overarching strategies and tactical approaches for implementing technical FICAM topics.
2. Interagency Forum and Subcommittee: The Federal Chief Information Security Officer (CISO) Council is a primary resource for identity management, secure access, authentication, authorization, credentials, privileges, and access lifecycle management. The ICAM Subcommittee aligns identity management activities of the federal government and supports collaborative government-wide efforts.
3. Approved Products Lists (APL): The Federal Information Processing Standard 201 (FIPS 201) Evaluation Program not only tests commercial products for use in Personal Identity Verification (PIV) credentialing systems, physical access control systems (PACS), and public key infrastructures but also publish APLs. Federal acquisition professionals rely on these APLs to purchase commercial products that fully comply with federal ICAM mandates.
4. Federal Public Key Infrastructure (PKI): The Federal PKI is a network of certification authorities (CAs) that issue PIV credentials and person identity certificates; PIV-Interoperable credentials and person identity certificates; and other person identity certificates. CA-issued digital certificates, which employ cryptography, close security gaps in user identification and authentication, encryption of sensitive data, and data integrity.