How to Fill Out and Submit the SAAR-N Form (DD Form 2875)

The SAAR-N form, DD Form 2875, is the System Authorization Access Request that every Navy user completes to get access to a DoD information system. To fill it out correctly, mark every page “CUI,” complete Part I with your CAC digital signature, hand it to your supervisor for Part II, route it to your Security Manager for Part III, and submit the finished PDF by encrypted email to your command’s Information Assurance Manager within 60 days of your signature date. The current fillable PDF is available from the DoD Executive Services Directorate at esd.whs.mil or through your IAM.

Most rejected SAAR-Ns fail on small things: an unmarked page, a mismatched email, a signature applied in the wrong order. Work through the form in the sequence below and those problems don’t happen.

What to Gather Before You Open the PDF

Missing any of the following will stall your request or bounce it back:

A valid Common Access Card with current certificates. The email certificate on your CAC must match the email you enter in Block 5.¹
Your Cyber Awareness Challenge completion certificate. All DoD information system users must complete the course before initial access and again each fiscal year.²
The exact name of the system you need — NMCI, a specific LAN, or another named system. You will enter this in Blocks 13 and 15.
Your supervisor’s or government sponsor’s information. They sign the form after you, so coordinate first.
The dates of your most recent background investigation. If those dates fall outside a five-year window, the request will be disapproved.¹

Contractors also need their company name, contract number, and contract expiration date for Block 16a.¹

Mark Every Page CUI Before You Start Typing

The SAAR-N must be marked “CUI” (Controlled Unclassified Information) at the top and bottom of every page. Marking it “UNCLASSIFIED” or leaving the marking off gets the form rejected before anyone reads the content.¹ Handle this first, because it’s easy to forget once you’re focused on the data fields.

Part I: Your Information and Signature

Part I is your section. Work through the blocks in order:

Block 1: Last name, first name, middle initial, following your command’s naming convention.
Block 2: Current command or organization.
Block 3: Office symbol or department.
Block 4: DSN number, or your commercial number if DSN is unavailable.³
Block 5: The email address tied to your CAC certificate. This must match the email that appears when you sign Block 11. Mismatches are disapproved.¹
Block 6: Civilian job title and grade (for example, “Systems Analyst, GS-14”), military rank, or “CONT” for contractors.
Block 7: Your official mailing address at your duty station.
Block 8: Citizenship — US, FN, or OTHER.³
Block 9: Military, Civilian, or Contractor.
Block 10: The date you completed the Cyber Awareness Challenge.

Block 11 is your CAC digital signature. Click the field and sign; do not personalize or alter the digital signature, because customized signatures cause the form to be returned.⁴ You must sign first. If your supervisor signs before you, the form is rejected.¹

Part II: Supervisor Endorsement

Part II is where your supervisor, or your government sponsor if you’re a contractor, verifies that you have a legitimate need for the requested access. They are formally taking responsibility for monitoring your system activity going forward.

Block 13 is the justification for access. Write a brief statement covering the system name and why the access is required for your duties.¹ If you need remote or VPN access for telework, state it here. The form has no separate remote-access checkbox, so Block 13 is the place to make that case. Block 21 (Optional Information) can hold additional technical details that don’t fit in Block 13.³

For a Navy SAAR-N, three boxes must be affirmatively marked or the form is rejected:

Block 14 (Type of Access Required): “Authorized.”
Block 15 (User Requires Access To): “Unclassified” for standard network access.
Block 16 (Verification of Need to Know): checked by the supervisor.¹

Contractors fill Block 16a with company name, contract number, and contract expiration date. If the access period is less than one year, also enter the access expiration date here.³

Your supervisor then prints their name in Block 17, provides contact information, and applies their CAC digital signature. The same email-matching rule applies: the email in Block 17a must match the email on the signing certificate in Block 17d, or the form is disapproved.¹

Part III: Security Manager Verification

You don’t fill out Part III. After you and your supervisor sign, the form goes to your command’s Security Manager, who verifies your background investigation and clearance status through the Defense Information System for Security (DISS).⁵

The Security Manager records the type of your last background investigation. The federal system uses a tiered structure: Tier 1 for non-sensitive positions (replacing the former NACI), Tier 3 for non-critical sensitive positions eligible for Secret (replacing the former ANACI), and Tier 5 for critical sensitive positions eligible for Top Secret (replacing the former SSBI).⁶ Investigation dates in Blocks 22a and 22b must fall within a five-year window. If yours is older, the SAAR is disapproved until security requirements are resolved.¹

The Security Manager also records your clearance level and IT-level designation, then signs. Once Part III is complete, the form is ready for the IAM.

If You Need Classified System Access

Access to a classified network like SIPRNet uses the same DD Form 2875 — there is no separate form. In Block 15, select “Classified” instead of “Unclassified” and specify the category of classified access required.³ Your clearance level must match the classification of the system. Secret supports SIPRNet; Top Secret or TS/SCI requires a Tier 5 or Tier 5+ investigation. Expect additional scrutiny and longer processing.

Foreign National Requests

Foreign nationals use the same DD Form 2875 and select “FN” in Block 8. The form itself does not list specific supplementary documents. Its instructions note that the “prescribing document is as issued by using DoD Component,” meaning your command sets the additional requirements.³ Use Block 21 for any extra details your command needs.

Access for foreign nationals is heavily restricted when export-controlled technical data is involved. Under the International Traffic in Arms Regulations, providing access that enables a foreign person to view unencrypted technical data counts as a “release” and requires explicit authorization from the State Department’s Directorate of Defense Trade Controls. Talk to your command’s export control officer before submitting a SAAR for any foreign national who may touch systems with controlled technical data.

Submitting the Completed Form

Once all three parts are signed, transmit the completed PDF by encrypted email to your command’s IAM or local Security Manager. Do not send it over unencrypted channels — the form carries your personal information and is marked CUI.

Before sending, verify each of the following:

“CUI” is marked at the top and bottom of every page.
Every block is filled in and locked. Any blank or unlocked block triggers disapproval.
You signed first, then your supervisor.
Email addresses match their corresponding digital signature certificates.
The form is less than 60 days old from your signature date. After 60 days it expires and must be redone.¹

After the IAM approves, the form goes to the system administrator for account provisioning. Processing time varies by command and network complexity. You’ll typically hear about activation by email or through your IT help desk.

Annual Revalidation

Initial access is not the end of the paperwork. Part IV of the DD Form 2875 covers annual revalidation and has fields for the revalidation date and the name and signature of whoever recertified the account.³ You also must complete a new Cyber Awareness Challenge each fiscal year. The course version is tied to the fiscal year, so a prior year’s completion does not carry over.²

If your access expiration passes or your annual training lapses, your account may be suspended until the requirements are current. Put the fiscal year training deadline on your calendar so a lockout isn’t your reminder.

Penalties for False Entries

Everything you enter on the DD Form 2875 is a statement to a federal agency. Deliberately providing false information about your identity, your training completion, or your need for access carries criminal penalties under federal law, including fines and up to five years of imprisonment.⁷

1
MyNavyHR. DD Form 2875 SAAR-N DoD Form
2
United States Marine Corps. Annual Cyber Awareness Training and Cyber Awareness Challenge Training Compliance Reporting
3
Department of Defense. DD Form 2875 – System Authorization Access Request
4
MyNavy HR. DD Form 2875 SAAR-N DoD Form
5
Defense Counterintelligence and Security Agency. Defense Information System for Security (DISS)
6
National Institutes of Health Office of Research Services. Understanding U.S. Government Background Investigations
7
Office of the Law Revision Counsel. 18 U.S.C. 1001 – Statements or Entries Generally