Every login attempt at a state regulatory agency carries the question: does this person deserve access to what they’re asking for? A citizen renewing a professional license, an inspector pulling up a facility record from a job site, a board member reviewing confidential complaint files from home. Each scenario demands proof of identity, a defined boundary around what that identity unlocks and a record of what happened next.
NASCIO’s State CIO Top Ten Policy and Technology Priorities for 2026 names Identity and Access Management (IAM) the seventh priority among state technology leaders, spanning citizen digital services, workforce access, access control, authentication, credentialing and digital standards. IAM also lands at #4 on NASCIO’s list of priority technologies for the year, right behind AI, application modernization and cloud. State CIOs increasingly treat identity as infrastructure, not an afterthought added to a login page.
This article continues a 10-part series on NASCIO’s 2026 priorities for state regulatory agencies. Each installment examines how pairing advanced technology with disciplined operations helps agencies meet rising expectations with the staff and budgets they actually have.
NASCIO groups six related disciplines under this one priority:
| Data point | Why it matters for agencies |
|---|---|
| 22% of confirmed breaches start with stolen credentials | Credentials remain a top attack path into government systems |
| 88% of basic web application breaches involve stolen credentials | Public licensing portals fall directly into this attack category |
| MFA blocks 99%+ of account compromise attempts | One control delivers outsized protection for both citizen and staff logins |
| Organized fraud rings target stolen identities across state benefit programs | Any portal that unlocks money, licenses, or personal data draws the same risk |
Three factors push IAM up the priority list:
A licensee’s first experience with a portal shapes their opinion of the whole agency. GL Suite’s self-service portal features demonstrate what a well-built portal delivers:
Identity and access work together. A verified credential, not a shared password sitting in an inbox, determines what a user reaches.
Internal access control carries equal weight to citizen-facing security. Consider what a typical week looks like:
The Alabama Home Builders Licensure Board moved from scattered desktop databases and spreadsheets to a centralized system with single sign-on and automated audit trails. The shift cut password-related help desk calls and gave the agency traceable records of who touched which file, and when.
GL Solutions CTO Ryan Pedersen describes the goal directly in GL Solutions’ podcast on future-proofing state technology: role-based access and audit trails “ensure that only authorized personnel view sensitive data and ensure the tracking of each action for accountability.” He calls security “a continuous improvement mindset” rather than a project with an end date.
Read the full Alabama Home Builders Licensure Board case study for more detail.
The Arizona Medical Board migrated hosting to a FedRAMP-certified cloud environment and layered role-based configuration controls on top, letting staff adjust fields, screens, and reports without waiting on developers, while every change stays tracked and attributable.
Read the full Arizona Medical Board case study to learn more.
NASCIO’s 2026 Top Ten defines Identity and Access Management (IAM) as the combination of citizen digital services, workforce access, access control, authentication, credentialing and digital standards — the full set of systems that verify identity and control what that identity reaches.
Stolen credentials drive a large share of data breaches, and state agencies hold sensitive licensing, health and financial data behind every login. Tight IT budgets and staffing also push agencies toward automation that reduces manual identity-verification work.
Multi-factor authentication (MFA). Research shows MFA blocks the large majority of account compromise attempts, making it one of the highest-return security investments available.
Regulatory agencies verify two identities at once: the person logging in and the credential (a license, certification or permit) that person holds. A strong IAM strategy treats both as connected parts of the same identity problem.
Modern licensing management software like GL Suite strengthens identity and access management by supporting multi-factor authentication, role-based access control, secure citizen self-service portals, comprehensive audit trails and standards-based authentication. These capabilities help state regulatory agencies improve security while providing a better experience for applicants, licensees, inspectors and board members.
Identity and access management underpins nearly every other item on NASCIO’s 2026 list. AI initiatives depend on knowing exactly which systems and data an AI tool reaches. Modernization projects hinge on migrating access controls cleanly. Digital government efforts succeed only when citizens trust that their information stays protected behind the login screen.
State regulatory agencies that treat identity as foundational infrastructure, rather than a checkbox on a procurement form, position themselves to meet nearly every other 2026 priority with far less friction. GL Solutions helps agencies achieve that goal with GL Suite, a configurable AI-powered regulatory licensing software platform that combines strong security, role-based access control, audit trails and modern government licensing software capabilities to support secure digital government services.
Renee Moseley joined GL Solutions in 2016 with an educational and professional background in research and writing, along with software documentation. At GL Solutions she produces informative content to help regulatory agencies stay current on news and information that supports their success.
