The military Common Access Card, or CAC, is the Department of Defense’s standard photo ID and smart card. Its embedded chip does three jobs: it opens gates and doors on military installations, it authenticates you onto DoD computer networks and signs your official email, and it serves as your Geneva Conventions identification if you are captured in armed conflict. If you are active duty, in the Selected Reserve or National Guard, a DoD civilian, or an eligible contractor, this is the card you carry.
Who Qualifies for a CAC
The CAC is issued to active-duty service members, Selected Reserve members, National Guard personnel, DoD civilian employees, and eligible contractor personnel.1DoD Common Access Card. Common Access Card It also covers several non-DoD groups whose work supports the department: U.S. Coast Guard and National Oceanic and Atmospheric Administration personnel and their contractors, state employees supporting the National Guard, Intergovernmental Personnel Act employees, and non-DoD federal employees working in support of the DoD.
Every applicant has to be registered in the Defense Enrollment Eligibility Reporting System (DEERS) by a sponsor before any card can be issued.2DoD Common Access Card. Getting Your CAC For military members and DoD civilians, sponsorship happens automatically through a data feed from human resources. Contractors take a different route: a Mission Partner Affiliation Sponsor registers them in the Mission Partner Identity, Credential, and Access Management (MP-ICAM) system, which confirms the contractor’s company has an active agreement with the DoD and that the individual needs access to government systems.3DoD Common Access Card. Getting Your Common Access Card (CAC): For Contractors
Background Investigation
Every applicant must complete a favorably adjudicated background investigation. The minimum for most positions is a Tier 1 investigation, which replaced the older National Agency Check with Inquiries in 2015.4Defense Counterintelligence and Security Agency. Implementation of Federal Investigative Standards for Tier 1 Higher-level positions require deeper vetting. If a favorable determination is later lost, CAC privileges are revoked.
What to Bring to Your Appointment
You need two valid forms of identification from the federally approved list, and at least one must be a government-issued photo ID such as a passport or driver’s license. A DD Form 1172-2, the application for enrollment, needs to be in the system before you arrive. For military and civilian applicants, that form is generated automatically through the sponsorship feed. Contractors should confirm with their Mission Partner Affiliation Sponsor that the MP-ICAM registration is complete and the DD Form 1172-2 has been submitted. Showing up without either the documents or the paperwork in place is the fastest way to waste a trip.
Getting the Card Issued
Appointments are booked through the ID Card Office Online portal at idco.dmdc.osd.mil, which finds the nearest Real-Time Automated Personnel Identification System (RAPIDS) site.5Defense Manpower Data Center. ID Card Office Online Walk-ins are sometimes accepted, but availability is inconsistent and busy offices can run weeks out.
At the appointment, staff verify your two identity documents, then collect digital fingerprints and a photograph. Both are stored in DEERS and linked to your record. You then pick a six-to-eight-digit Personal Identification Number, which you’ll use every time you log into a DoD system or digitally sign a document.6Department of the Navy Chief Information Officer. Introducing the Next-Generation Common Access Card The card is printed on the spot, and the Public Key Infrastructure (PKI) certificates that make it functional for network access and encrypted email are loaded onto the chip.
What the Card Actually Does
Scanning the chip at gates and building readers gets you into installations and controlled areas. Inserting the card into a computer’s reader and entering your PIN authenticates you through the PKI certificates on the chip, and those same certificates let you sign email digitally and read encrypted messages. A digitally signed email proves who sent it and confirms the message was not altered, which is why many commands require it for official correspondence.
The card also functions as your Geneva Conventions ID. It shows your name, rank, service branch, DoD ID number, and date of birth.7Department of Defense. Identification (ID) Cards Required by the Geneva Conventions (DoDI 1000.01) Cards for medical and religious personnel carry a red emblem noting protected status. Civilians receive a Geneva Convention category (I through IV) tied to grade equivalency, which determines their treatment as a prisoner of war. Under Article 17, a capturing authority may inspect the card but cannot confiscate it.
Renewing Before It Expires
Renewal opens roughly 30 days before the expiration date printed on the card. Don’t wait until the last day. Once the card expires, you lose network access immediately and may have trouble entering installations that require CAC entry. TRICARE eligibility is not affected, because health benefits ride on your DEERS record rather than the physical card.
Renewal runs through the same steps as initial issuance: book at the ID Card Office Online portal, bring two IDs, and have new biometrics and certificates loaded at a RAPIDS site. After the new card is in hand, you’ll go through a workstation-level key recovery so you can still open previously encrypted emails.
Certificates Can Expire Before the Card Does
The PKI certificates on the chip sometimes expire before the printed date on the card. When that happens, you can still badge into a building but can’t log in or sign email. Check your certificate dates in your computer’s certificate manager. If they are running out while the card is still otherwise valid, go to a RAPIDS site to have them refreshed rather than waiting for the card’s expiration date.8DoD Common Access Card. Managing Your Common Access Card
PIN Lockouts
Three wrong PIN entries in a row lock the card, and every system that depends on it stops working. There is no remote reset. You have to visit a RAPIDS site in person, verify your identity by matching your fingerprint against the one stored in DEERS at original issuance, and choose a new PIN.8DoD Common Access Card. Managing Your Common Access Card A coworker can’t reset it for you, and no help desk can unlock it over the phone. At a remote site far from a RAPIDS office, that means days offline. Pick a PIN you’ll remember under stress.
Replacing a Lost, Stolen, or Damaged Card
A lost or stolen CAC is a security incident. The card authenticates to classified networks and controlled facilities, so report the loss to your local security office or CAC sponsor as your first step. You’ll need documentation of that report; it gets scanned into DEERS, and without it no RAPIDS site will issue a replacement.9DoD Common Access Card. Managing Your Common Access Card – Section: Replacing Your Card
At the RAPIDS office, staff invalidate the missing card’s certificates so it can no longer authenticate anywhere. They then print a new card with fresh biometrics, a new PIN, and new certificates. There is no published fee, but repeated losses can draw attention from your chain of command.
A damaged card that you still have is simpler. Bring it in, and staff verify the chip data or your fingerprint against DEERS and print a replacement. The security reporting step generally doesn’t apply when you can surrender the old card. The card remains U.S. government property and has to be returned when you separate from service, when a contract ends, or when any other event ends your DoD affiliation.
Photocopying the Card
Unauthorized reproduction of the CAC is a federal offense under 18 U.S.C. ยง 701, punishable by up to six months in jail, a fine, or both.10Office of the Law Revision Counsel. 18 USC 701 – Official Badges, Identification Cards, Other Insignia DoD regulations allow photocopying only for a short list of purposes: processing medical care, cashing checks, voting, tax matters, compliance with the Servicemembers Civil Relief Act, and administering other military-related benefits.11eCFR. 32 CFR 161.6 – Procedures When possible, the card should be electronically authenticated rather than photographed. A hospital billing office or an on-base bank can copy your card for the listed reasons. A retailer offering a military discount cannot, and you’re within your rights to decline.