The US Treasury Department’s award of a $145 million identity and access management implementation contract is the kind of procurement that rarely attracts public attention but says a great deal about how large institutions are approaching identity governance. The scope covers implementation of a cloud identity security platform at federal scale, and the size of the award reflects something more than licensing: it reflects the cost of migrating a complex, long-lived entitlement estate into a governed model without interrupting the mission.
Large public sector identity programmes fail for predictable reasons. The entitlement data is poor, because it has been assembled across decades of systems that were never designed to interoperate. Ownership is diffuse, because roles outlast the people who created them and no single office holds an authoritative view of who approved what. Service accounts and integration identities proliferate because legacy systems require them and nobody has an incentive to retire them. Add a regulatory obligation to demonstrate least privilege to auditors and inspectors general, and the governance workload becomes substantial before any modernisation work begins.
The award also sits at an interesting moment for the identity governance market. Vendors are consolidating capabilities, buyers are consolidating platforms, and the definition of what falls within scope of IGA keeps expanding. A contract of this size is a multi-year commitment to a platform architecture, which makes the underlying design choices more consequential than they would be in a commercial deployment where change is cheaper.
The discovery phase carries most of the risk. In practice, the majority of the value in a programme like this is created or lost in the first phase, when the estate is inventoried and reconciled. An implementation that begins with policy design before establishing an accurate inventory tends to produce controls that fit the policies rather than the environment. The organisations that succeed invest disproportionately in discovery: reconciling directory accounts against application entitlements, mapping cloud roles to business functions, and identifying which service accounts have human owners and which do not. That work is unglamorous and hard to compress, and it is the phase most likely to be under-resourced when timelines tighten.
Identity lifecycle management at federal scale means automation with exceptions handled deliberately. The volume of joiner, mover and leaver events in a department of this size makes manual processing untenable, but full automation across a heterogeneous application estate is rarely achievable immediately. A pragmatic sequencing is to automate the high-volume, well-understood flows first, then maintain a governed exception queue for systems that cannot yet integrate. The critical control is that exceptions have named owners and ageing metrics, so the residual manual population shrinks rather than becoming a permanent shadow process.
Privileged and machine identities deserve early scope. It is tempting to sequence a large IGA programme around human access certification, because that is what auditors ask about first. The greater concentration of risk, however, usually sits in privileged accounts and non-human identities, which are frequently outside the reach of standard review cycles. Bringing service accounts, integration credentials and administrative roles into the governance model early prevents a situation where the programme delivers strong controls over the population least likely to cause a material incident.
Sustainability depends on ownership after go-live. Platform implementations of this scale are often judged at the point of delivery rather than at the point of steady state. The durable measure is whether the organisation can sustain an accurate view of entitlements eighteen months later, once the implementation partner has left and the programme team has dispersed. Building internal capability to operate the governance model, rather than only to accept delivery of it, is what separates programmes that hold their ground from those that decay back toward their starting state.