To get a Personal Identity Verification (PIV) card, you need agency sponsorship, two current identity documents, a completed background-investigation questionnaire, and an in-person enrollment appointment where a registrar verifies your identity and captures your fingerprints and photograph. Once your card is printed, you return to activate it and set a PIN. The credential is valid for up to six years, though the digital certificates loaded on the chip usually need to be refreshed after about three. Meeting the PIV card requirements is a condition of most federal civilian employment and of contractor work that lasts longer than six months.
Who Has to Get a PIV Card
If you accept a federal civilian job, or a contractor position that requires recurring access to government buildings or information systems, you will need a PIV card. For contractors, the trigger is an engagement lasting more than six continuous months. Anyone whose affiliation extends past that mark is treated as a long-term credential holder and goes through the full PIV enrollment process.1U.S. Office of Personnel Management. Credentialing Standards Procedures for Issuing Personal Identity Verification Cards under HSPD-12 Seasonal employees who work six months or more on a recurring basis fall into the same category even if their schedule is intermittent.
Short-term hires under six months sit in a gray zone. Agencies can either put those individuals through standard PIV vetting or issue a more limited alternative credential with extra restrictions.1U.S. Office of Personnel Management. Credentialing Standards Procedures for Issuing Personal Identity Verification Cards under HSPD-12 In practice, most short-term visitors receive escorted access or a facility-specific badge instead.
One boundary is worth noting: active-duty military personnel and many Department of Defense contractors carry a Common Access Card (CAC) rather than a PIV card. The CAC serves the same purpose but is managed through the DoD’s own identity system. If you work in a defense setting, your agency will tell you which credential applies.
Identity Documents You Need to Bring
Before your enrollment appointment, gather two forms of current, original identification. At least one must be a primary document. Photocopies and expired documents are not accepted.2General Services Administration. Bring Required Documents
Primary documents include:
- U.S. passport or passport card
- Permanent resident card (Form I-551)
- Foreign passport with a temporary I-551 stamp
- Employment authorization document with a photo (Form I-766)
- REAL ID-compliant state driver’s license or ID card
- U.S. military ID card or military dependent’s ID card
Watch out for one detail that trips people up. A state driver’s license that is not REAL ID-compliant no longer counts as a primary identity document.2General Services Administration. Bring Required Documents If your license carries a “not for federal identification” marking, bring a passport or another primary document instead.
Two primary documents will cover you. Otherwise your second must be a secondary document such as an unlaminated Social Security card, a birth certificate with an official seal, a voter registration card, or another government-issued photo ID. The names on both documents have to match. If they don’t match because of a marriage or legal name change, bring the linking paperwork, like a marriage certificate or court order, that connects the old name to the new one.2General Services Administration. Bring Required Documents
The Background Investigation Questionnaire
Alongside document preparation, you complete a personal-history questionnaire through a secure online system. Which form you fill out depends on the sensitivity of your position. Standard Form 85 (SF-85) covers non-sensitive, low-risk roles and asks about residence history, employment, education, and references. Standard Form 86 (SF-86) applies to positions that require a security clearance and goes further into foreign contacts, financial history, mental health treatment, and prior drug use.3U.S. Office of Personnel Management. SF 86 – Questionnaire for National Security Positions
Forms are submitted through the government’s investigation management platform. The Defense Counterintelligence and Security Agency (DCSA) handles investigations for most of the executive branch, and its National Background Investigation Services (NBIS) system has been replacing the older e-QIP platform.4Defense Counterintelligence and Security Agency. Case Types and Forms Your agency’s security office will point you to the correct system.
Accuracy on these forms matters. Every date of residence, every employer, every reference gets cross-checked. Omitting required financial or legal history, even unintentionally, can delay or derail your credential. The information you enter must line up with the physical identity documents you present at enrollment.
Enrollment and Biometric Capture
Once your sponsoring agency approves you and your investigation is underway, you schedule an enrollment appointment at a designated credentialing center. A registrar verifies your identity documents against the sponsorship request and collects your biometrics.
Every applicant provides two types of biometric data: fingerprints and an electronic facial image. At least two fingerprint templates are stored on the card’s chip for off-card comparison, and a full set of fingerprints is captured for the background check. Agencies may also collect iris images, though that step is optional.5National Institute of Standards and Technology. FIPS 201-3 Personal Identity Verification of Federal Employees and Contractors Your facial photo goes onto the chip alongside the fingerprint templates.
After enrollment, the card is printed and shipped to the credentialing facility. You will get a notification when it’s ready for pickup.
Activation and PIN Setup
Pickup is a separate appointment. When the card arrives, you typically receive an email from the USAccess system directing you to schedule an activation visit. Bring the same identity documents you used at enrollment.
Activation itself is quick. For unattended activation, you insert your card into a reader, enter the temporary password from the notification email, scan a fingerprint, and set the six-digit PIN you’ll use going forward.6General Services Administration. Get Appointment Help If your email did not include a temporary password, someone on-site walks you through it. Once you set the PIN and accept the card, you’re responsible for safeguarding it.
Using the Card for Buildings and Computers
Physical access is the simple part. You hold or tap the card near a reader at a building entrance, secure door, or interior checkpoint. The reader talks to the chip to confirm your permissions for that area. Higher-security zones often require a PIN or fingerprint scan at the reader on top of the card.
Logical access replaces the password on your workstation. Insert the card into a desktop reader and enter your PIN. The system checks your authentication certificate against the agency’s directory. This two-factor approach, something you have plus something you know, is far harder to compromise than a password alone. The same mechanism authenticates you when you connect to a virtual private network from a remote location.
Two other functions live on the chip. You can digitally sign documents and emails, producing a verifiable record that the content came from you and hasn’t been altered. And you can send and receive encrypted email with other federal employees and authorized partners, so sensitive material stays readable only to the intended recipient.
Expiration and Certificate Updates
A PIV card is valid for a maximum of six years from the date of issuance.5National Institute of Standards and Technology. FIPS 201-3 Personal Identity Verification of Federal Employees and Contractors The digital certificates on the chip expire sooner, typically every three years.7IDManagement.gov. Personal Identity Verification Card 101 That means you will likely need a certificate refresh midway through the life of the card, even though the plastic itself is still good.
USAccess generally sends notification emails at 90, 60, 30, 14, and 7 days before certificates lapse. Don’t ignore them. Expired certificates block you from logging into your workstation, signing documents, or decrypting email. The refresh usually means a short visit to a credentialing office, where a registrar loads new certificates onto the same card. You keep the card, and your PIN doesn’t change.
At the six-year mark, you go through full re-enrollment, including new biometrics, new document verification, and a new physical card.
Lost, Stolen, Damaged, or Revoked Cards
If your card goes missing or the chip fails, report it right away. Most agencies require notification to your supervisor and the credentialing office within 24 hours. A missing PIV card is an active security vulnerability until the credential is revoked in the system.
For a card that reads intermittently, try a different reader first. Chip-read failures are sometimes a reader problem rather than a card problem. If the card fails on several readers, contact your badging office to schedule a replacement. Replacement involves new biometric capture and identity verification, much like the original enrollment. A stolen card is different: report it to your security office so the credential can be revoked, and expect an entirely new card rather than a reactivation.
Your credential can also be suspended or revoked independently of your employment. Grounds include suspected involvement in activities threatening federal facilities or systems, unauthorized access to classified or protected information, violent acts or threats in a federal workplace, and attempting to bring a weapon into a federal building.8U.S. Department of State. 12 FAM 520 Credentialing Suspension is a temporary hold during an investigation and can be reversed if you’re cleared. Revocation is permanent.
Returning the Card When You Leave
PIV cards are government property. When you resign, retire, or your contract ends, return the card on or before your last day. Your agency’s checkout process should include a step where you hand the card over and the credentialing office disables it. Some agencies collect cards earlier, when an employee goes on administrative leave, so access is restricted before the formal separation date. Contractors have the same obligation, and the contracting agency’s security office should collect the credential when a contract ends or an assignment is terminated early. Failing to return the card doesn’t preserve any access, because the credential gets revoked either way, but it does create an audit finding for the agency.