More than 100 federal agencies will get their employee identity badges through a rebuilt system run by XTec. The General Services Administration has finalized the company's award for the next generation of USAccess, the shared Personal Identity Verification (PIV) credentialing service, Federal News Network reported Oct. 5. The 10-year deal carries a ceiling of $237.6 million and closes out a procurement that drew two protests, a corrective action and a re-award over roughly 10 months.
USAccess handles the HSPD-12 badges that civilian employees and contractors use to get into federal buildings and networks. Federal News Network says the program supports over 100 agencies and 1.15 million employees. Under the new contract, XTec will replace the legacy infrastructure and run services covering applicant sponsorship, enrollment, biometric submission, appointment scheduling, credential issuance and maintenance, and PIV enrollment record maintenance.
How the USAccess 2.0 Award Survived Two Protests
GSA issued the solicitation in December 2024. Federal News Network reports that the agency first awarded XTec the contract in November 2025. Biometric Update dates that initial selection to October 2025, when the award was valued at roughly $238 million. The two outlets disagree on the month.
IDEMIA National Security Solutions protested the first award, and GSA took corrective action in April 2026. According to Biometric Update, the original delivery order was stopped and terminated, and GSA issued a new order to XTec in June.
That re-award drew a second challenge, this time from Peraton, the incumbent. Peraton filed its protest with the Government Accountability Office on June 29. Biometric Update reports that "GAO records show the company withdrew its protest on September 8." XTec says GSA then completed another corrective-action review and selected its team again, and that the corrective action included a renewed evaluation of offerors and updated oral presentations.
Federal procurement records put the order's potential value at about $237.6 million, with performance running to June 2036, Biometric Update reports. GSA received four offers.
Why the $237.6M Ceiling Outpaces Peraton's 2017 Deal
Peraton won USAccess in 2017 on a 10-year, $166.5 million contract. Federal News Network notes that USASpending.gov shows GSA obligated about $71.6 million over the last nine years, well below that ceiling. The new ceiling is about $71 million higher than the 2017 contract's, though obligations under the old vehicle show how far actual spending on this program can fall short of a ceiling.
GSA procurement documents cited by Biometric Update say the program had issued more than 1.2 million PIV cards by 2022 and then supported more than 800,000 active cards across 105 agencies.
From Contractor-Owned to Government-Owned Infrastructure
The biggest structural change is ownership. Peraton's version of USAccess was contractor owned and operated. GSA now wants the government to own the infrastructure while a contractor runs the service.
"The government requires the contractor to build a contractor-operated service offering model. USAccess will own the core digital infrastructure while partnering with the awarded contractor to deliver and support appropriate microservices for the continuation and growth of the program," GSA stated in the performance work statement, as quoted by Federal News Network.
The work statement also asks for agile software development and integration services, covering discovery, user research, design, coding, security, accessibility, prototyping, testing and configuration. GSA flagged possible deployment of mobile credentials and integration of mobile driver's licenses into USAccess 2.0 workflows. It also wrote that "as federal policies evolve to include post quantum standards and similar concepts, USAccess and the contractor must remain nimble enough to incorporate new policies and technologies."
XTec says the core technology and platform operations will run on its AuthentX Cloud Platform, which Biometric Update reports is certified under FedRAMP at the High impact level. The FedRAMP Marketplace lists AuthentX Cloud as certified since August 2019.
"USAccess 2.0 is more than a contract award; it is an investment in the future of federal identity management," Kevin Kozlowski, XTec's president and CEO, said in a statement quoted by Federal News Network. He added that "XTec is committed to providing the secure foundation that enables trusted access across government."
Where USAccess Sits Inside GSA Now
GSA launched USAccess in 2007, when the Bush administration rolled out HSPD-12 across civilian agencies. The agency recently moved the program under the Office of Shared Services Delivery within the Federal Acquisition Service, according to Federal News Network. GSA has also partnered with the Postal Service to make badge enrollment easier, opening 25 locations in 2023 and 2024, and has begun an effort to update the Federal Identity, Credential and Access Management (FICAM) architecture.
What It Means for Contractors
For identity vendors, the award locks up one of the largest civilian credentialing programs until mid-2036. Firms that sell enrollment hardware, biometric capture, mobile credential software or post-quantum cryptography now have one prime to approach for subcontract work, and the government-owned model means GSA will hold the core infrastructure if it recompetes the operations work later.
The protest record also offers a lesson. Two different losing bidders challenged the award. Neither source reports a GAO ruling on the merits of either challenge. The first triggered corrective action and a terminated order; the second ended in a withdrawal followed by another corrective-action review. Federal News Network calls the effort a nearly two-year journey from solicitation to final award.
Incumbents should note the structural shift as well. With USAccess owning the core digital infrastructure, a future competition would center on who operates the service rather than whose platform it runs on. Bidders on similar shared-service recompetes at GSA should expect requirements for modular microservices, agile delivery and room for mobile and post-quantum credentials.
