Discontinuation of Phone-Based (SMS) OTP for Supplier Access?
Regarding Phone-Based (SMS) One?Time Passwords?(OTP) please be aware Lockheed?Martin will no longer accept registration of Phone-Based OTP for any two-factor authentication via Exostar.?Please know that Phone OTP credentials will remain valid until your next renewal date, which may be as late as November 2026.
IMPORTANT: If you currently use a Phone OTP credential, you will receive an email from Exostar with a unique upgrade link instead of a standard renewal notice, allowing you to convert your existing credential to a FIDO2 Passkey, Hardware OTP, or Mobile ID, while keeping your current identity proofing.
Do not purchase NEW credentials on your own, as identity proofing cannot be transferred. If you've already purchased a new credential, you must revoke your Phone OTP before activating it.? To retain your original proofing, please contact the Exostar Support Team for assistance in merging your new purchase with your existing account.
For administrators performing mass renewals, please do not renew Phone-Based OTP subscriptions. Each affected user will receive their own unique upgrade link.?
This change aligns our security controls with U.S. Government standards and applies to existing applications (e.g. Exostar TPM, LM Procure to Pay, LM eInvoicing). Effective immediately Phone OTP will no longer be a renewal option for existing users.
Supplier users using Phone-Based?(SMS) OTP must transition to one of the following Exostar-provided 2FA credential types at each user’s next renewal to retain access, or sooner if they need access to any other Lockheed Martin application:
- Exostar Mobile ID + Proofing
- FIDO Passkey + Proofing
FIDO? security keys use FIDO2/WebAuthn public-key cryptography to verify you with a quick touch—no passwords to steal or phish. This works across major browsers and devices, enabling strong 2-factor authentication for faster, simpler, and more secure logins. Coupled with Identity Proofing requirements, this subscription offers superior protection against a multitude of cyber threats.
- OTP HW Token + Proofing
- Exostar Mobile ID + Hardware OTP Token + Proofing
- DOD Common Access Card (Third-Party Credential)
Individuals who require access to Export-Controlled Information (ECI) must also complete the U.S. Person Verification process with Exostar.