How to Submit a Visit Authorization Request (VAR) Form in DISS

To submit a Visit Authorization Request in DISS, your Facility Security Officer builds the request in the Defense Information System for Security, adds you as a subject, and activates it so the hosting Security Management Office (SMO) receives the notification. You do not enter anything into DISS yourself. Your job is to give your FSO the right information; the FSO does the data entry and clicks Activate. The process is governed by 32 CFR Part 117, the National Industrial Security Program Operating Manual, which lists the elements every visit authorization must contain.¹

Who Can Submit the Request

Only certain DISS roles can create a visit request: Security Officer, Security Officer Admin (with the optional permission granted), Security Officer Visit Admin, or Security Manager.² In a cleared contractor setting, that means your FSO or a delegated security administrator. As the visitor, your part of the process is gathering documentation, confirming your clearance is on file in DISS, and giving the security office the host-side contact details.

Information to Give Your FSO

The NISPOM lists the specific elements that must appear on every visit authorization, and the DISS fields track those elements closely.¹ Have the following ready:

Your full legal name, date and place of birth, citizenship, and Social Security Number. DISS adds subjects by SSN.
Your employer’s name, address, telephone number, CAGE code, and facility clearance level.
Your personnel clearance level (Confidential, Secret, Top Secret, or TS/SCI) and any special access authorizations the visit requires. The clearance must already be recorded in DISS.
The host point of contact: first name, last name, and phone number. DISS requires all three.³
A clear statement of the visit’s purpose and why it cannot be accomplished without access to classified information.
Start and end dates, or the period a recurring authorization should cover.

Naturalized citizens and people born abroad should be ready to produce citizenship documentation such as a Certificate of Naturalization (Form N-550 or N-570), a Certificate of Citizenship (Form N-560 or N-561), or a Certification of Birth Abroad (Form FS-545 or DS-1350).⁴ Your FSO may ask for these up front so any citizenship question is resolved before the request goes out.

Building the Visit Template in DISS

Inside DISS, the FSO opens the SMO tab and selects Create SMO Visits. The first choice is whether the visit is at the FSO’s own facility (Current SMO) or somewhere else (Find Hosting SMO). For a visit to another organization, the FSO searches for the hosting SMO by name, CAGE code, service branch, or Unit Identification Code.³

After picking the hosting SMO, the FSO selects the facility location. Existing SMO locations appear in a list; a temporary location can be typed in manually with state and country. The Visitor Information screen then captures:

Visit Name, a free-text label such as the project or meeting title.
Start Date and End Date, entered by calendar picker or by hand.
Access Level, chosen from None, Confidential, Secret, Top Secret, or Top Secret SCI.
Visit Reason, chosen from Inspection, Meeting, Planning Conference, Seminar, Symposium, TAD/TDY, Training, or Other.
Visit Notes, optional, useful for the contract number or special instructions.
Point of Contact: first name, last name, and phone number, all required.

A confirmation screen follows. Clicking Save puts the visit in Created status, which means both the sending and hosting SMOs can still change the location or add and cancel personnel.²

Adding Visitors and Activating

With the template saved, the FSO adds each visitor as a subject. The fastest way is to type the SSN directly. Alternatively, the FSO can scroll through the personnel already associated with the SMO. For each subject, the FSO sets a start and end date, selects the owning or servicing SMO relationship, and decides whether the person’s existing access level applies or whether the hosting SMO will make that determination. If a visitor’s clearance level is lower than the access level set on the visit, DISS will not save the record until the FSO types an exception reason.³

Once every subject is loaded, the FSO clicks Visit Actions and chooses Activate Visit. A confirmation pop-up appears. Clicking Yes pushes the visit into active status and sends a notification to the hosting SMO. After activation, only the hosting SMO can modify the visit’s date and location.²

One-Time vs. Recurring Visits

The date window your FSO enters determines whether the request covers a single event or an ongoing arrangement. A one-time request has a narrow window, sometimes a single day, and expires when the end date passes. Recurring authorizations cover repeated trips, normally up to one year. For programs governed by an international agreement, contract, or license, the authorization can extend for the duration of that arrangement, subject to annual review and validation. Recurring authorizations should be requested at the beginning of a program. Once approved, individual visits can be arranged directly with the host facility’s security office with five working days’ advance notice.⁵ That five-day minimum is where the common “submit at least five days early” guidance comes from, and many host facilities add their own buffer on top.

After the Request Is Activated

Activation sends a notification to the hosting SMO. The host’s security office reviews the request and either accepts it or cancels it if the visit is not approved.² The visit also appears on each subject’s personnel record and in the Visit Report inside the reporting module.

Two responsibilities sit on the host side. The host contractor must verify the visitor’s clearance before releasing classified information, done by checking DISS directly. Separately, the person who will actually share the classified information — not the security office — decides whether the visitor has a genuine need-to-know, usually based on a contractual relationship between the two organizations.¹

Canceling or Ending the Visit Early

Either the visiting or hosting SMO’s security personnel can cancel individual subjects from a visit at any time, and the FSO on either side can cancel the entire visit. Completed and archived visits stay visible through the search function, so the audit trail is preserved.²

When a Written Visit Authorization Letter Replaces DISS

The NISPOM still allows a written Visit Authorization Letter when the CSA-designated database is unavailable, such as when the host facility lacks DISS access or during a system outage. The letter must contain the same elements as a DISS submission: contractor name, employee name, address, phone number, CAGE code, entity clearance level, visitor’s name, date and place of birth, citizenship, clearance certification, the name of the person to be visited, purpose and justification, and the dates it covers.¹ The FSO signs it and sends it straight to the host facility’s security office.

Foreign National Visits Use a Different System

DISS is not the channel for visits by foreign nationals. Those requests go through the Foreign Visits System, submitted by the visitor’s government embassy in Washington, D.C., or by the sponsoring international organization, and routed through the relevant military service’s Foreign Disclosure Office to the sponsoring unit for commander approval.⁶ If your situation involves a foreign national, do not try to run it through DISS.

Penalties for False Information

Every field on a visit request feeds into a federal security system. Submitting false information falls under 18 U.S.C. § 1001, which makes it a felony to knowingly make a materially false statement in any matter within federal jurisdiction. A conviction carries up to five years in prison and a fine, or up to eight years where the offense involves domestic or international terrorism.⁷ The statement need not be sworn, and the statute of limitations runs five years from the date it was submitted. A false statement on a security document also puts the individual’s personnel clearance at risk of revocation.

If DISS Isn’t Cooperating

Technical problems happen. A subject won’t add, a hosting SMO doesn’t turn up in search, a visit sits in Created status and won’t activate. The DISS Customer Call Center is at 1-800-467-5526; have a screenshot ready to send by encrypted email. The Joint Verification System and Reporting User Manual, reachable from the Help link in the upper-left corner of DISS, goes deeper than the short job aids.²

1
eCFR. 32 CFR 117.16 – Visits and Meetings
2
Defense Counterintelligence and Security Agency. DISS Visit Request FAQs Job Aid
3
Defense Counterintelligence and Security Agency. DISS JVS Job Aid – Creating Visit Requests
4
GSA. Bring Required Documents
5
eCFR. 32 CFR Part 117 – National Industrial Security Program Operating Manual
6
Washington Headquarters Services. DoD Directive 5230.20 – Visits and Assignments of Foreign Nationals
7
Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally