CTEP Branches and Offices
NCI CTEP IAM User Access Update
The U.S. federal government has implemented new IT security requirements to improve data security. This next generation of technology and techniques is required to protect user credentials when accessing systems with confidential information in accordance with the Federal Information Security Management Act (FISMA). These mandate includes integration of Identity Proofing/Verification (IP) and Multi-factor Authentication (MFA) for all government IT applications. To ensure the security and safety of National Cancer Institute (NCI) systems, subjects, research staff, and all associated sensitive information, NCI has now incorporated IP and MFA into systems access. Identity proofing (IP) and multi-factor authentication (MFA) will be required for continued access to NCI systems. The US Government has established a deadline of September 30, 2024, for Federal IT systems, such as the NCI, to comply with this directive. Come this deadline date, users will no longer be able to access NCI systems using their CTEP-IAM login credentials.
NCI has partnered with ID.me, a nationally recognized identity platform that meets the highest federal standards for online identity proofing and authentication, in order to meet the enhanced Federal IT security standards established by NIST SP 800-63-3 Digital Identity Guidelines. ID.me also meets European Union (EU) standards and is now compliant with the General Data Protection Regulation (GDPR). The NCI database includes patient and proprietary information, and therefore requires level 2 IP in accordance to NIST guidelines. Level 2 IP requires the collection of a unique identifier such as a social security number, U.S. tax ID, or passport number; and an additional primary document (ex. Driver's license). However, since partnering with ID.me, NCI has gained insightful data on the reluctance within our research communities to share the type of information necessary for level 2 identity proofing that would potentially jeopardize participation on NCI research trials.
With this new understanding, the NCI has secured a 'waiver' to the NIST level 2 IP requirements. NCI will still be implementing cybersecurity enhancements but without the stringent NIST requirements. The NCI will be implementing an alternative approach to identity verification called Knowledge Based Authentication (KBA). The methods of IP and MFA will vary based on a user's resident country. By implementing alternative IP and MFA options, NCI aims to significantly enhance IT security without causing unnecessary disruption to your continued support of the NCI clinical research program. Please see below for more details on these changes.
| U.S.-Based CTEP USERS | Canadian-Based CTEP USERS | Other International-Based CTEP USERS |
|
|---|---|---|---|
| Identity verification requirement |
Must verify identity with email address, a personal phone number, OR a government-issued photo ID (Driver’s License, Passport, Passport Card, or State ID). | Alternative IP procedures are being considered. May continue to use IAM until a more suitable identity proofing solution is identified. | Alternative IP procedures are being considered. May continue to use IAM until a more suitable identity proofing solution is identified. |
| Multi-factor authentication requirement | Must set up MFA | Able to set up MFA | Able to set up MFA |
| Deadline to complete IP/MFA | September 30, 2024 | September 30, 2024 | September 30, 2024 |
Background
Identity Proofing (IP) is the process of verifying a user’s digital identity using official, secure documentation such as a driver’s license or passport. The goal of identity proofing is to ensure that a user's claimed identity matches their actual identity. Digital Authentication is the process of verifying a user or device’s identity to enable access to a secure digital service (website, application, etc.). There are multiple ways to verify a user’s electronic digital identity. Single-Factor Authentication is the use of a single authenticator, traditionally a password, to verify user identity. MFA is a digital authentication method that requires a user to provide two or more authentication factors to gain access to a protected system. Also known as Two Factor Authentication (2FA), this method ensures that user accounts and system data remain secure even when a user’s password becomes compromised.
Affected Systems
Updated authentication requirements apply to all systems utilizing CTEP-IAM, including:
- NCI systems such as CTEP ESYS, CTSU ESYS, THERADEX, CIRB, and NCORP SYS applications
- Any other systems, including LPO websites, that use CTEP-IAM for federated authentication purposes
Affected Users
The new authentication requirements apply to all new and currently registered system users (all those with a CTEP-IAM account), including NCI, LPO, contractors, site staff, and international users.
International Users
All research staff will be expected to onboard with ID.me for MFA. For identity verification, an alternative streamlined approach for international users will soon be established. This new process will NOT require international staff to provide any personal information above and beyond what has traditionally been provided to the NCI (ex. Name, DOB, contact info, medical license). Provision of verification documentation, such as a passport or driver's license, will NO LONGER be required. Additional details regarding this streamlined process will be provided in the upcoming months.
NIH Account Holders
Users with NIH accounts are not required to onboard with ID.me. NIH accounts already meet the IP/MFA requirement to access federal systems. For continued access to CTEP applications, users should instead link their NIH credentials/PIV cards to their existing or newly created CTEP-IAM accounts using the below instructions.
Timeline for Users
July 8, 2022: The ID.me IP/MFA process has now been introduced for all system users. Existing CTEP-IAM account credentials will allow access until users have authenticated using ID.me and linked their credentials.
August 10, 2023: Alternative identity verification methods will be introduced for CTEP-IAM users.
January 1, 2024: Migration to ID.me IP/MFA is expected to be completed for U.S.-based users.
September 20, 2024: IP/MFA must be established for continued access to Federal IT applications. Come this date, users will no longer be able to access NCI systems using their CTEP-IAM login credentials.
All NCI application users must complete IP and onboard with ID.me for MFA set-up. After which, users must link their ID.me credentials to their CTEP-IAM accounts. This process must be completed directly through the CTEP-IAM application site. Once an ID.me account has been linked, only ID.me credentials (username and password, plus the selected MFA option) will allow a user to access NCI systems. CTEP-IAM credentials will no longer allow access.
Webinars:
Live webinars on the CTEP-IAM & ID.me implementation will be hosted to provide users with helpful and hands-on information. Please see the scheduled sessions and registration link below.
| Webinar Schedule (All users) – Webex Registration Link |
|---|
| October 18th - 1pm EST |
| November 15th - 11 am EST |
| December 13th - 1pm EST |
| January 17th - 11 am EST |
| February 7th - 1pm EST |
| March 13th - 11 am EST |
| Where you can find detailed instructions: | Existing CTEP-IAM user SOP | New CTEP-IAM user SOP |
|---|---|---|
| Where you can find a training video: | Existing CTEP-IAM user creating a new ID.me account- training video and transcript Existing CTEP-IAM user linking existing ID.me account- training video and transcript |
New CTEP-IAM user creating a new ID.me account- training video and transcript |
Help/Additional Resources
Additional communication will be provided through various methods to include email broadcasts, newsletters, and training videos. Be sure to return to this page for updates on the NCI and ID.me integration and help resources.
For frequently asked questions, click here
For more information on the NCI and ID.me integration, please visit NCI & ID.me.
For more information on ID.me’s privacy policies please visit ID.me Privacy Policy
For questions about the NCI and ID.me authentication process, please contact the CTEP Help Desk at ctephelpdesk@nih.gov.
For questions about your ID.me account or the ID.me verification process, go to ID.me Help Center.