The Common Access Card is the standard smart-chip identification credential issued by the Department of Defense to active-duty service members, Selected Reserve personnel, DoD civilian employees, and qualifying contractors. It works as both a physical ID for getting onto military installations and a login credential for secure government computer networks. Roughly 3.5 million people carry one at any given time, and losing access to it means losing access to almost everything on the defense side of the federal government.
Who Qualifies
Eligibility is set by 32 CFR Part 161, which spells out exactly who gets a CAC and under what conditions.1eCFR. 32 CFR Part 161 – Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals The eligible groups are:
- Active-duty service members from all branches, plus uniformed members of NOAA and the U.S. Public Health Service.
- Selected Reserve members of the Ready Reserve who drill regularly, including National Guard personnel in a paid status.
- DoD civilian employees, both appropriated-fund and nonappropriated-fund, on permanent or time-limited appointments of six months or more, whether full-time, part-time, or intermittent.
- Contractors whose work requires recurring physical access to DoD facilities, logical access to DoD networks, or both. The sponsor must confirm the role genuinely needs that level of access.
- Non-DoD government civilians such as state employees supporting the National Guard, Intergovernmental Personnel Act assignees, and employees of other federal agencies supporting DoD who don’t already hold a federal PIV card accepted by the sponsoring component.
Every applicant needs a sponsor who is a DoD government official or employee. The sponsor initiates the request through the Trusted Associate Sponsorship System, verifying that the person’s role requires a government credential. Without an active sponsorship record, the issuance office won’t process the card.
A background investigation is also required before a card can be issued. The current minimum standard is a Tier 1 investigation.2DCSA. Implementation of Federal Investigative Standards for Tier 1 At minimum, the process includes an FBI fingerprint check that must come back favorably before the card is produced.
Foreign Nationals
Foreign nationals working with the DoD can receive a CAC, but the screening is more involved. Applicants who cannot meet residency requirements for a standard Tier 1 investigation must satisfy alternative criteria: foreign military or government personnel need confirmed visit status and security assurances processed under international agreements, while foreign nationals hired directly or indirectly by DoD overseas must meet the investigative requirements recognized through those agreements. Every foreign national applicant must also clear an FBI criminal history fingerprint check and a name check against the Terrorist Screening Database before issuance. Cards issued to non-U.S. persons display a blue stripe.3eCFR. 32 CFR Part 161 Subpart B – Identification Cards for Uniformed Personnel, Their Dependents, and Other Eligible Individuals
What the CAC Is Not
Retirees, military dependents, Individual Ready Reserve members, Medal of Honor recipients, and 100-percent disabled veterans do not receive a CAC. They get a separate credential called the Uniformed Services ID card, which grants access to TRICARE, base privileges, and the commissary but does not contain the smart chip or PKI certificates that allow network login.4DoD Common Access Card. Next Generation Uniformed Services ID Card A USID gets you through the gate and into the pharmacy. It won’t log you into a government workstation or let you digitally sign documents. If your role requires network access, you need the CAC specifically.
What’s on the Card
The physical card is roughly credit-card sized and shows the holder’s legal name, branch of service or agency, pay grade or rank, and a photograph. Barcodes on the back are used for automated scanning during administrative and medical processing.
The real capability sits on the integrated circuit chip. It stores Public Key Infrastructure certificates that do two jobs: an identity certificate lets you digitally sign documents and emails with the legal weight of a handwritten signature, and an encryption certificate secures email communications so they can’t be intercepted in transit.5DoD Common Access Card. CAC Security The chip also talks to card readers at security checkpoints and on desktop computers, making the card both a physical key and a digital one.
Getting Your Card
Before you go anywhere, your sponsoring organization must register you in the Defense Enrollment Eligibility Reporting System and your sponsor must complete and sign DD Form 1172-2, the application that authorizes production. You’ll sign it as well. The form can be generated digitally through the ID Card Office Online portal, where sponsors can verify applicant information and submit it electronically.6Common Access Card. Instructions for Completion of DD Form 1172-2 Confirm your DEERS record is active and your sponsorship is current before you make the trip. Showing up with an incomplete record is one of the most common reasons applicants get turned away.
You must bring two original forms of identity documentation, at least one with a current photograph. A primary photo document can be a U.S. passport, a state or territorial driver’s license, or a permanent resident card. The secondary document can be:
- U.S. Social Security card, but only if unrestricted; cards marked “NOT VALID FOR EMPLOYMENT” are not accepted
- Original or certified birth certificate bearing an official seal
- Voter registration card
- Certificate of U.S. Citizenship or Certificate of Naturalization
- Government-issued photo ID from a federal, state, or local agency
- Native American tribal document
The secondary document may come from the primary list, but it cannot be the same type as the primary.7Department of Homeland Security. DHS PIV Card Acceptable Identity Source Documents School IDs are not on the approved list.
Cards are produced at Real-time Automated Personnel Identification System (RAPIDS) offices, located on military installations and in some federal buildings. Find the nearest office and schedule through the ID Card Office Online portal.8ID Card Office Online. ID Card Office Online
At the appointment, a technician captures your biometrics: digital fingerprints of both index fingers and a facial photograph. Those biometrics go onto the chip and into DEERS, and they are what a technician will match against later if you ever need a PIN reset. You then choose a six-to-eight-digit Personal Identification Number, which you’ll use every time you insert the card into a computer to log onto a government network. Once your data and PKI certificates are encoded, the card is printed on the spot. The whole process runs roughly 20 to 30 minutes when your background check is complete and your records are in order. You can start using the card for building access and network login immediately.
PIN Lockouts, Renewal, and Replacement
If you forget your PIN or enter it incorrectly too many times, the card locks. There is currently no way to reset a locked PIN remotely. You must visit the nearest RAPIDS issuance site in person, where the technician verifies your identity by matching your fingerprint against the one stored in DEERS.9DoD Common Access Card. Managing Your CAC If the match succeeds, you select a new PIN and walk out with a functioning card. Plan around this. A locked CAC during a deployment or at a remote duty station can mean days without network access while you arrange a trip to the nearest issuance site.
CACs carry printed expiration dates tied to the holder’s service obligation or contract period. Civilian and contractor cards are issued for three years or less.1eCFR. 32 CFR Part 161 – Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals Military cards may align with enlistment dates, so durations vary. The PKI certificates on the chip can expire on a different schedule than the card itself, which means your card can still look valid while your ability to sign documents or encrypt email has already lapsed.
Start renewal before your expiration date. Plan for at least 30 days ahead, though contractor renewals may be processed up to 90 days out depending on the installation. An expired card locks you out of both facilities and networks.
If your card is lost or stolen, report it immediately to your security manager or supervisor so its network access can be disabled. You’ll need to provide a statement documenting the loss, typically through your local security office, before a replacement can be issued. The replacement appointment follows the same identity verification steps as the original. Bring your two forms of ID again.
Returning the Card When You Leave
The CAC is government property. You are required to return it when your affiliation with the DoD ends: separation from military service, retirement, termination of civilian employment, or expiration of a contractor agreement.1eCFR. 32 CFR Part 161 – Identification (ID) Cards for Members of the Uniformed Services, Their Dependents, and Other Eligible Individuals
Card collection is part of standard organizational checkout procedures. Your sponsor or sponsoring organization is responsible for retrieving the card, and once surrendered it must be returned to a RAPIDS issuance location for proper destruction. One narrow exception: DoD civilian employees transferring between DoD components may keep their card for up to 30 days during the transition. Everyone else turns it in before walking out the door.
Penalties for Misuse
Federal law treats misuse of government identification seriously. Under 18 U.S.C. § 701, anyone who manufactures, sells, or possesses a government badge or identification card without authorization faces up to six months in prison, a fine, or both.10Office of the Law Revision Counsel. 18 U.S. Code 701 – Official Badges, Identification Cards, Other Insignia That statute reaches colorable imitations, meaning a fake CAC that looks close enough to fool someone at a glance is enough.
More severe penalties apply under 18 U.S.C. § 1028, which covers fraud involving identification documents. Producing or transferring a fraudulent government ID carries up to 15 years in prison. If the offense connects to drug trafficking or a crime of violence, the ceiling rises to 20 years. Offenses tied to domestic or international terrorism carry up to 30 years.11Office of the Law Revision Counsel. 18 U.S. Code 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
The regulation governing CACs also warns that anyone who willfully alters, damages, lends, or counterfeits a card is subject to fine or imprisonment. Lending your CAC to someone else, even briefly, falls squarely within that prohibition. The card is tied to your biometrics and your identity. If someone else uses it and something goes wrong, the investigation starts with your name.