Market Intelligence Request Updated 7 Jan.docx

Market Intelligence Request Exploring Next-Generation Digital Identity, Authentication, and Navigation on VA.gov Issued: January 2, 2026 Background The Department of Veterans Affairs (VA) delivers digital services and benefits to Veterans through VA.gov and the VA Health and Benefits mobile application. VA leadership has identified persistent challenges that prevent some Veterans from easily authenticating, signing in, and navigating VA digital services. These challenges relate to identity verification, multi-factor authentication (MFA), post-authentication navigation, accessibility, and varying levels of digital literacy and connectivity.

VA has built an enterprise digital experience platform that now supports more than 16 million unique users per month across VA.gov and the VA Health and Benefits mobile application, with over 10 million secure user authentications each month via Login.gov and ID.me. Despite this progress, login and authentication remain significant pain points, particularly for older Veterans, those with limited technology access, and those who encounter difficulties with remote identity proofing processes.

VA currently offers two credential options for accessing VA digital services: Login.gov (provided by the U.S. General Services Administration) and ID.me. Both meet federal requirements under OMB Memorandum M-19-17 and comply with NIST SP 800-63-3 for IAL2 and AAL2. These modern credentials represent a major improvement over legacy knowledge-based authentication (KBA), which exposed Veterans to account takeover and fraud. However, the security controls that make these systems trustworthy can introduce friction, especially for Veterans with thin credit files, expired identification, limited digital skills, disabilities, or constrained connectivity.

The digital identity ecosystem is evolving rapidly. Technologies such as mobile driver's licenses (mDL), FIDO2 passkeys, digital wallets, and verifiable credentials now offer promising ways to enhance both security and usability. VA seeks to understand how these and other innovations can be applied to VA.gov and related digital services to deliver dramatically easier and more inclusive experiences without compromising strong security.

Purpose of This Request This Request is issued to gather market intelligence on available ideas, capabilities, patterns, and emerging approaches that could help Veterans more easily access and use VA.gov and related VA digital services, with a particular focus on digital identity, authentication, and post-login navigation.

VA seeks insights from industry, academia, and other stakeholders on delivering a fundamentally improved digital identity experience for Veterans—one that is seamless and frictionless to use while maintaining or exceeding current security standards.

Specifically, VA is interested in approaches that could achieve:

· Near-universal identity proofing success, approaching 100 percent of Veterans successfully completing identity verification (compared to commonly reported industry averages of approximately 70–80 percent for fully remote IAL2 proofing).

· User experiences that are dramatically easier, where Veterans can access their VA accounts as intuitively as unlocking their phones.

· Security that meets or exceeds current standards, complying with or surpassing NIST IAL2 and AAL2 requirements.

VA is also interested in understanding:

· What solutions exist today.

· What approaches are emerging.

· What has worked or failed in similar environments.

· What tradeoffs exist between security and usability.

VA further seeks guidance on how different Veteran actions and services should align to different levels of identity and authentication assurance, including which activities may be appropriate for lower-assurance access (for example, viewing information) and which require full identity proofing and higher assurance (for example, making changes or submitting claims).

This request is issued solely for market research and information-gathering purposes and is not a solicitation for proposals or an invitation for bids.

Who VA Is Trying to Serve VA is interested in approaches that work for the full Veteran population, including Veterans who may experience:

· Aging-related usability challenges

· Cognitive or memory impairments

· Physical limitations affecting vision, hearing, or dexterity

· Low digital literacy or limited familiarity with digital services

· Rural or low-bandwidth connectivity constraints VA serves Veterans of all ages, abilities, and circumstances, including those living overseas, those in long-term care facilities, those without smartphones, and those with thin or nonexistent credit histories. Approaches should avoid creating solutions that work well for some Veterans while leaving others behind, and should explicitly address inclusion and accessibility across diverse populations.

Industry should assume that many Veterans may have limited patience for complex workflows, limited familiarity with authentication tools, and limited access to high-speed internet or newer devices. Solutions should minimize cognitive load, reduce unnecessary steps, and support a wide range of devices, assistive technologies, and connectivity environments.

What VA Is Interested in Learning VA is interested in learning about:

· Identity verification and sign-in experiences that can achieve very high identity proofing success rates while maintaining IAL2 security.

· Reducing MFA and authentication friction while maintaining AAL2 security and phishing resistance.

· Secure and simple account recovery, including for lost devices, forgotten credentials, or failed proofing.

· Post-login navigation and task completion, including information architecture, task-based journeys, and experience design that reduce confusion.

· Accessibility and usability, including support for assistive technologies, plain language, and error-tolerant workflows.

· Low-bandwidth and intermittent connectivity, including offline-tolerant or bandwidth-efficient approaches.

· Voice, hands-free, and assisted access, including compatibility with operating-system-level accessibility tools, voice-guided navigation, and conversational interfaces, while remaining compliant with privacy, security, and accessibility requirements.

VA invites respondents to describe what is feasible today, what limitations exist, and where future improvements may be possible.

Scope, Objectives, and Key Outcomes Through this Market Intelligence Request, VA seeks information on solutions, technologies, and approaches that can fundamentally improve the digital identity experience across the full identity lifecycle.

Areas of Interest Identity proofing innovation

· Novel approaches to dramatically increase the percentage of Veterans who successfully complete IAL2 identity verification.

· Methods may include new evidence types, hybrid remote and in-person models (leveraging VA's in-person footprint), or use of authoritative data sources.

Authentication innovation

· Approaches that make authentication as simple as unlocking a phone while maintaining AAL2 security and phishing resistance.

· Examples include passkeys, biometrics, FIDO2, and hardware-based authenticators.

VA-specific opportunities

· Use of VA's in-person footprint, VHIC cards, enrollment records, and existing Veteran relationships.

· Concepts that establish strong identities during in-person interactions and enable frictionless digital access thereafter.

Key Success Criteria Proposed approaches should target:

· Identity proofing success rates approaching 100 percent (see Purpose for current baseline and target ambition).

· User-perceived ease comparable to unlocking a phone.

· Compliance with or superiority to IAL2 and AAL2.

· WCAG 2.1 AA and Section 508 conformance.

Security, Privacy, and Accessibility Considerations VA seeks to understand how industry balances usability with IAL2 and AAL2 security, including where friction occurs today and how it can be reduced without weakening protection.

Respondents should describe how accessibility is supported, including screen readers, keyboard navigation, captions, and assistive technologies, and how sensitive identity data is protected and governed in compliance with federal privacy laws.

VA is particularly interested in risk-based and adaptive authentication that adjusts assurance levels based on transaction sensitivity and fraud risk.

Future Threats and Resilience VA seeks insight on how identity solutions can remain resilient against:

· AI-generated synthetic identities

· Deepfake biometric attacks

· Large-scale credential theft

· Long-term cryptographic threats Respondents should describe how proposed solutions detect, mitigate, and withstand these threats while remaining usable and inclusive.

What Industry Is Asked to Provide VA welcomes responses that include:

· Descriptions of relevant ideas, capabilities, and approaches.

· Case studies or examples from similar environments.

· User journey workflows for identity proofing, sign-in, recovery, and navigation.

· Known limitations, risks, and tradeoffs.

· Lessons learned from past deployments.

· A clear identification of the specific tools, platforms, APIs, data integrations, and operational capabilities VA would need to have in place to operationalize the proposed identity, authentication, and navigation solutions, distinguishing between what VA must provide and what the respondent would deliver.

Responses may be informal and narrative; diagrams, visuals, and workflow illustrations are encouraged (attachments such as images or separate diagram files do not count toward the page limit).

What Is Not Required Formal security authorizations, detailed compliance artifacts, pricing, or final architectures are not required at this stage.

Follow-On Engagement VA may schedule follow-on discussions to better understand selected responses. Participation does not imply competitive advantage.

No Commitment to Procure This request does not obligate VA to pursue a procurement or award a contract.

How VA Intends to Use This Information Responses will inform planning, requirements development, and potential pilot efforts without committing VA to any specific action.

Response Instructions

· Submission deadline: 2pm ET on January 27, 2026. Any questions from industry are due by 12pm ET on January 20, 2026.

· Submission method: Responses due via email to Julia Renna, Contract Specialist at julia.renna@va.gov, and Evan Schlisserman Contracting Officer at evan.schlisserman@va.gov. File format: PDF preferred; Microsoft Word acceptable

· Page limit: Responses should not exceed ten (10) pages, excluding appendices, company overviews, past performance information, and attached visuals/diagrams.

The ten-page limit should be devoted to substantive, experience-focused responses to this request and should not be used for general corporate marketing, promotional content, or boilerplate company information.

Respondents are requested to include:

· Company or organization overview (name, location, and brief description of relevant capabilities).

· Relevant experience with similar challenges.

· Responses to the topics and questions in this request.

· Descriptions of relevant technologies and approaches.

· Any additional information relevant to VA's objectives.

Regulatory and Standards References

· OMB Memorandum M-19-17, "Enabling Mission Delivery through Improved Identity, Credential, and Access Management"

· Section 508 of the Rehabilitation Act and WCAG 2.1 AA accessibility standards

· The Privacy Act of 1974 and other applicable privacy laws

· FedRAMP requirements for cloud-based solutions Appendix A: Glossary of Terms AAL (Authenticator Assurance Level) A measure of the strength of an authentication process, as defined by NIST; AAL2 requires multi-factor authentication.

Credential An object or data structure that authoritatively binds an identity to a token possessed and controlled by a subscriber.

FIDO2

An authentication standard developed by the FIDO Alliance that enables passwordless authentication using public key cryptography.

IAL (Identity Assurance Level) A measure of the degree of confidence in the identity proofing process, as defined by NIST; IAL2 requires verification of the claimed identity through remote or in-person proofing.

Identity Proofing The process by which a credential service provider collects, validates, and verifies information about a person to establish that the person is who they claim to be.

KBA (Knowledge-Based Authentication) An authentication method that relies on the user answering questions based on personal information (for example, previous addresses or loan amounts).

mDL (Mobile Driver's License) A digital representation of a driver's license stored on a mobile device, compliant with ISO/IEC 18013-5.

MFA (Multi-Factor Authentication) An authentication method that requires the user to provide two or more verification factors (something you know, something you have, something you are).

Passkey A FIDO2 credential that enables passwordless sign-in using biometrics or device PIN, bound to a specific device or synchronized across devices, providing phishing-resistant authentication.

Phishing Resistance The property of an authentication mechanism that prevents attackers from tricking users into authenticating to fraudulent websites.

VHIC (Veteran Health Identification Card) A photo ID card issued by VA to Veterans enrolled in VA health care, used for check-in at VA medical facilities and as a potential identity artifact.

Verifiable Credential A tamper-evident digital credential whose issuer can be cryptographically verified, enabling trust without direct communication with the issuer.