Justification for the De Minimus Changes (IT Modification)

Status: Original and derived artifacts are available for this document.

Download: docx | pdf | html

Justification for the De Minimus Changes for 
Social Security Administration’s Public Credentialing and Authentication Process
 20 CFR 401.45 & 20 CFR 402
OMB No. 0960-0789
Since its establishment in May 2012, SSA uses the Social Security Administration’s Public Credentialing and Authentication Process (hereafter-called “eAccess”) to provide a secure, centralized gateway to Social Security’s public-facing electronic services.  Currently, eAccess allows users to choose a lower level of authentication when creating an account, allowing users to access most online services at a baseline assurance level (IAL1), but informs the user that they may choose to request a higher level of authentication (IAL2) at any time to access higher‑risk online services.
To remind users of the higher-level authentication option, SSA is implementing a Progressive Proofing initiative into the my Social Security platform.  Progressive Proofing is an identity verification approach that reminds users who previously authenticated at a baseline assurance level (IAL1) that they will need to request a higher level of authentication (IAL2) to access high‑risk transactions, including messages/notices that contain sensitive information.  By implementing Progressive Proofing, users will experience a simpler verification process for most activities, while maintaining strict security standards for sensitive interactions.
SSA plans to implement this new feature on October 31, 2026.  Therefore, we are asking for OMB’s approval of this De Minimus IT modification as soon as possible, to ensure we can implement this change on time.

Revisions to the Collection Instrument

    • Change #1:  We are adding message screens for users that need to verify at a higher level of authentication when they attempt to access higher-risk services as part of our Progressive Proofing initiative.

Justification #1:  This change reminds users to update their accounts to a higher level of authentication, if they have not already done so, when they choose to access an online service that requires a higher-risk transaction.

Future Plans
Due to the agile nature of our projects, we expect to make more enhancements in the future to strengthen our electronic access authentication posture. Currently, we are still finalizing our IT modernization plans for these changes. We expect to submit another change request within one to six months to request approval for additional updates to the system, and potentially, update the burden again to include additional users, as we move more authentication requirements behind the eAccess portal.  We expect our next revision will include adding the Business Services Online (BSO) and Government Services Online (GSO) users to the eAccess platform in anticipation of using eAccess for authentication for both BSO and GSO.