Revision Date: 07/31/2023

NONCONFIDENTIAL // EXTERNAL

SAM

CAIA Onboarding Guide

(Common Approach to Identity Assurance)
 Revision Date: 07/31/2023

NONCONFIDENTIAL // EXTERNAL

Introduction

CAIA (Common Approach to the Identity Assurance) provides a consistent user experience for multifactor 

authentication to the Fiscal Accounting applications. The CAIA solution is similar to the existing Treasury

Single Sign-On system to allow users to authenticate to Treasury applications, however the IBM Security 

Identity Manager (ISIM) username and password will no longer be utilized. ISIM will be replaced with SailPoint 

IdentityIQ for application permission management.

The Fiscal Accounting applications listed below will be migrating to Common Approach to Identity Assurance 

(CAIA) and a Cloud Infrastructure. Multifactor authentication (MFA) and Cloud technology will enable Fiscal 

Service applications to provide enhanced security, scalability, and resilience. 

The Treasury mandate for CAIA is to be implemented before the end of “Q3 2023” (calendar year) for all Fiscal 

Accounting applications. 

Applications

• Q3 Shared Accounting Module (SAM)

• Q3 Central Accounting Reporting System (CARS)

• Q3 Intra-Governmental Transactions (G-Invoicing)

• Q3 Intra-Governmental Payment and Collection (IPAC)

• Q2 Government wide Treasury Account Symbol Adjusted Trial Balance System (GTAS)

Why Migrate 

Executive Order 14028: Improving the Nation’s Cybersecurity & OMB Zero Trust Strategy require Fiscal 

Service to implement multi-factor authentication (MFA) and Cloud Infrastructure. 

All application users will be required to authenticate with an identity that supports multifactor authentication. 

Username and password will no longer be accepted. CAIA will support one of the following MFA methods.

1. PIV/PIV-I, CAC 2. ID.me.

3rd Party Credential Service Provider (CSP)

If you have an existing personal account with ID.me, you will need to add your work email address to your 

existing account. ID.me will require your work email address to be listed as your Primary email address.

If you do not have a PIV/PIV-I/CAC card and are not able to obtain a PIV, PIV-I/CAC card, please register with 

the 3rd Party Credential Service Provider (CSP) via SailPoint IIQ. Additional information about ID.me 

https://help.id.me/hc/en-us/articles/4416509221271-Treasury-and-ID-me

https://iiq.fiscal.treasury.gov 

New Login Screen

Once applications have migrated to CAIA, the new login screen will provide users with the methods to 

authenticate to access the applications: 1) PIV Card 2) ID.me
 Revision Date: 07/31/2023 

NONCONFIDENTIAL // EXTERNAL

Existing Application Login Experience New Login Experience 

SAM Frequently Asked Questions (FAQ)

What do I need to do to prepare for these changes?

A: Validate that your email address is current. 

1. Log on to the IBM Security Identity Manager (ISIM) 

2. Access the My Profile section, click View or Change Account

3. Click on the “Contact” tab to review your email address 

• Update the email address if needed, then click OK. Click on “View My Requests” to 

confirm the request completed successfully. Return to the home screen, then log off.

• If no changes, click cancel to return to the home screen and then log off.

How will I know when SAM is cutting over to CAIA? 

A: SAM will be unavailable Thursday, September 14, 2023 for CAIA migration starting at 11:00 am ET. 

SAM will be available by 8:00 am ET September 15th, where users will access the application using 

their PIV/PIV-I, CAC card or ID.me. Please refrain from accessing the application during the migration. 

Please monitor this guide for additional updates.

Will there be any additional changes required if I have a PIV,PIV-I, CAC card already? 

A: If you have linked your existing PIV, PIV-I or CAC there is no further action needed at this time.

How can I maintain access once CARS migrates to CAIA?

A: Users will need to log in to CARS every 120 days to maintain access. If users exceed 120 days, 

application access will be removed, and users will need to recomplete the enrollment process to gain 

access. 

Will I be able to use my existing test account in CAIA?

A: Test accounts with fake email addresses will no longer be supported. Please link your existing card 

to your account in the pre-prod QA environment if you are using your real email address. If you do not 

have a PIV/CAC card to link, please reach out to GWA@stls.frb.org to request test certificates from the 

application team.

Will there be any changes required to access the application when migrating to CAIA? 

A: Information is provided in this document to establish a CSP account if you currently do not have a 

PIV, PIV-I or CAC card. Additional details on how to provision access to each application will be added 

here soon: Central Accounting Reporting System - Getting Started (treasury.gov)

Will automated “system IDs” used for APIs or automated file transfers be changing for CAIA? 

A: No changes are expected at this time. 

Will there be any changes required to access the application after migrating to the Cloud? 

A: The transition to Cloud is expected to have minimal impact to users, however if there are any 

changes to the “system ID” for API or automated file transfers, more information will be provided.