Code of Federal Regulations Title 32. National Defense § 32.161.7 ID card life-cycle procedures

(1) The population categories and specific ID cards for which applicants are eligible are listed in Appendix 1 of this section. The majority of these populations are eligible to be sponsored for an ID card based on either their employment status with the DoD or their authorization to receive DoD benefits and entitlements. Examples of these population categories include, but are not limited to:  Uniformed services personnel;  DoD civilian employees;  military retirees;  certain DoD beneficiaries;  and the eligible dependents for these categories.

(2) Specific populations, listed in paragraph (c)(2)(ii) of Appendix 1 of this section who are eligible to submit for the “U.S. DoD/Uniformed Service ID Card” may only be sponsored if they meet additional criteria. Examples of these population categories include DoD contractors, non–DoD Federal civilians, State employees, and other non–DoD personnel that have an affiliation with the DoD other than through employment or contract. Eligibility for these approved population categories is based on the DoD Government sponsor's determination of the type and frequency of access required to DoD facilities or networks. For the populations described in this paragraph, the applicant's sponsor must confirm that the applicant meets one of the requirements in paragraphs (a)(2)(i) and (iii) of this section:

(1) For uniformed services personnel and DoD civilians, all submissions to DEERS must be made electronically via an authorized data source feed (e.g., Civilian Personnel Management Service). Data source feeds for additional population categories shall be approved and incorporated by the Office of the USD(P&R) (OUSD(P&R)) as they become available.

(2) The population categories that are not registered via an authorized data source feed will be registered in DEERS via the RAPIDS using the DD Form 1172–2 or via the TASS (formerly known as CVS, as described in § 161.8 of this subpart.

(1) A background investigation shall be initiated by the sponsoring organization before a CAC can be issued. The mechanisms required to verify completion of background investigation activities for DoD, military, and civilian CAC populations are managed within the DoD human resources and personnel security communities and are linked to the CAC issuance process. An automated means is not currently in place to confirm the vetting for populations other than DoD military and civilian personnel such as CAC–eligible contractors and non–DoD Federal civilian affiliates. When data is not available within the CAC issuance infrastructure on the background investigation status for an applicant, the sponsor shall be responsible for confirming that the required background investigation procedures comply with the DoD Instruction 5200.46 and FIPS Publication 201–2 before a CAC is authorized for issuance.

(2) Issuance of a CAC requires, at a minimum, the completion of the Federal Bureau of Investigation (FBI) fingerprint check with favorable results and successful submission of a NACI (or investigation approved in Federal Investigative Standards) to the Office of Personnel Management (OPM). Completed background investigations for CAC issuance shall be adjudicated in accordance with DoD Instruction 5200.46 and Office of Personnel Management Memorandum, “Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD–12” (available at http://www.opm.gov/investigate/resources/final_credentialing_standards.pdf).

(3) Except for uniformed services members, special considerations for conducting background investigations of non–U.S. nationals are addressed in DoD Instruction 5200.46. Non–U.S. person CAC applicants that do not meet the criteria to complete a NACI (e.g., U.S. residency requirements), must meet one of the criteria in paragraph (c)(3)(i) or (ii) of this section prior to CAC issuance. CACs issued to these non–U.S. persons shall display a blue stripe as described in appendix 2 of this section. Procedures for the acceptance of this CAC shall be in accordance with DoD Instruction 5200.46 and Office of Personnel Management Memorandum, “Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD–12.” The specific background investigation conducted on the non–U.S. person may vary based on governing international agreements. Non–U.S. persons must:

(1) Identity documents. Applicants for initial ID card issuance shall submit two identity documents in original form as proof of identity. A VO at a RAPIDS workstation shall inspect and verify the documents presented by the applicant before ID card issuance. The identity documents must come from the list of acceptable primary and secondary documents included in the FIPS Publication 201–2 PIV Identity Proofing and Registration Requirements, or, for non–U.S. persons, other sources as outlined within paragraph (d)(1)(ii) of this section. Copies of the identity documentation may be accepted so long as they are certified documents. In accordance with FIPS Publication 201–2 PIV Identity Proofing and Registration Requirements, the identity documents shall be neither expired nor cancelled. The primary identity document shall be a State or Federal Government-issued picture ID. The identity documents shall be inspected for authenticity and scanned and stored in the DEERS in accordance with the DMDC, “Real-time Automated Personnel Identification System (RAPIDS) User Guide” upon issuance of an ID card. The requirement for the primary identity document to have a photo cannot be waived for initial ID card issuance, consistent with applicable statutory requirements. Identity documentation requirements for renewal or re-issuance are provided in paragraph (e)(3) of this section. When it has been determined that a CAC applicant has purposely misrepresented or not provided the applicant's true identity, the case shall be referred by the relevant RAPIDS Service Project office (SPO) to the sponsoring DoD or other Uniformed Service Component organization. The DoD or other Uniformed Service Component organization concerned shall initiate an investigation or provide appeals procedures as appropriate. Exceptions to the identity documentation requirements for initial ID card issuance are provided in paragraphs (d)(1)(i) and (ii) of this section:

(2) Eligibility documents. ID card applicants may be required to provide documentation as initial verification of eligibility for benefits or proof of relationship to the sponsor. The eligibility documents shall be inspected for authenticity by the VO and scanned and stored in DEERS in accordance with the procedures in DMDC, “Real-time Automated Personnel Identification System (RAPIDS) User Guide.” Specifications and the types of documents and how they are utilized to verify eligibility for a member or dependent based on their status (e.g., Retired, Reservist, spouse, former spouse, child) shall be established by the uniformed services subject to the guidelines in this subpart. All documentation used to verify eligibility must be original or certified true copies. All documentation not in English must have a certified English translation. Eligibility documentation is not required when DEERS can verify eligibility via an authoritative source or process.

(3) DEERS verification. The VO shall utilize DEERS to verify affiliation and eligibility for benefits as described in subpart C of this part.

(4) Biometrics. In accordance with DoD Instruction 1000.25, ID card applicants shall provide two fingerprint biometric scans and a facial image, to assist with authenticating the applicant's identity and to bind the information maintained on that individual in DEERS and to the ID card issued by RAPIDS. These requirements shall be integrated into the ID card issuance processes in the following manner:

(1) Cross-servicing. The uniformed services agree to cross-service the issuance of ID cards when affiliation and eligibility can be verified in DEERS. When eligibility cannot be verified through DEERS, presentation of documentation shall be required. The uniformed services shall restrict cross-servicing for verification of the DD Form 1172–2 and eligibility documentation to the parent uniformed service for the categories in paragraphs (e)(1)(i) through (viii) of this section:

(2) Expiration dates—

(3) Renewal and reissuance. Consistent with applicable law, the applicant for ID renewal or reissuance shall be required to surrender the current DoD ID card that is up for renewal or reissuance except as indicated for lost and stolen ID cards in paragraph (e)(3)(iii) of this section. To authenticate renewal or reissuance applicants, the VO shall visually compare the applicant against the facial image stored in DEERS. For applicants who have fingerprint biometrics stored in DEERS, live fingerprint biometrics samples shall be checked against the applicant's DEERS record. If the biometric check confirms the identity of the renewal or reissuance applicant then no additional documentation is required to verify identity other than the ID card that is being renewed or reissued (documentation may still be required to verify or re-verify eligibility as described in paragraph (d)(2) of this section). As a general practice for renewal or re-issuance, two fresh fingerprint biometric captures may be stored for applicable personnel through the initial procedures in paragraph (d)(4)(ii) of this section to support DMDC's biometric update schedule.

(4) Temporary cards—

(5) Multiple cards. Individuals shall be issued a separate ID card for each population category for which they qualify as described in Appendix 1 of this section. In instances where an individual has been issued more than one ID card (e.g., an individual that is eligible for an ID card as both a Reservist and as a DoD contractor employee), only the ID card that most accurately depicts the capacity in which the individual is affiliated with the DoD should be utilized at any given time.

(1) Access. The granting of access privileges is determined by the facility or system owner as prescribed by the DoD.

(2) Accountability. CAC holders will maintain accountability of their CAC at all times while affiliated with the DoD.

(3) PKI. Using the RAPIDS platform, DoD PKI identity and PIV authentication certificates will be issued on the CAC at the time of card issuance in compliance with OPM Memorandum, “Final Credentialing Standards for Issuing Personal Identity Verification Cards under HSPD–12.” Email signature, email encryption, or PIV authentication certificates may also be available on the CAC either upon issuance or at a later time. If the person receiving a CAC does not have an organization email address assigned to them, they may return to a RAPIDS terminal or use milConnect to receive their email certificate when the email address has been assigned. To help prevent inadvertent disclosure of controlled information, email addresses assigned by an organization shall comply with DoD Instruction 8500.2, “Information Awareness (IA) Implementation” (available at http://www.dtic.mil/whs/directives/corres/pdf/850002p.pdf).

(4) milConnect. DoD has a self-service Web site available that allows an authenticated CAC holder to add applets to the CAC, change the email address, add/update Email Signature and Email Encryption Certificates, and activate the Personal Identity Verification (PIV) Authentication certificate. This capability can be utilized from any properly configured UNCLASSIFED networked workstation. The milConnect Web site is https://www.dmdc.osd.mil/milconnect.

(5) CAC Personal ID Number (PIN) Reset. DoD has manned workstations capable of resetting the PINs of a CAC holder with a locked card or forgotten PIN. These workstations are intended to provide alternative locations for CAC holders to service their cards other than RAPIDS issuance locations. To authenticate cardholders, live biometric samples shall be checked against the biometrics stored in DEERS prior to resetting CACs. This process requires the presence of a CPR trusted agent (CTA) or TASM or RAPIDS VO or SSM.

(1) CACs shall be retrieved as part of the normal organizational or command-level check-out processes. The active status of the CAC shall also be terminated in special circumstances (e.g., absent without leave, unauthorized absence, missing in action) in accordance with organization or command-level security policies.

(2) The DoD sponsor or sponsoring organization is ultimately responsible for retrieving CACs from their personnel who are no longer supporting their organization or activity. CAC retrieval will be documented and treated as personally identifiable information, in accordance with DoD Regulation 5200.1–R, and 32 CFR part 310 and receipted to a RAPIDS site for disposition in a timely manner.

(3) Upon loss, destruction, or revocation of the CAC, the certificates thereon are revoked and placed on the certificate revocation list in accordance with Assistant Secretary of Defense for Networks and Information Integration Certificate Policy, “X.509 Certificate Policy for the United States Department of Defense” (available at http://jitc.fhu.disa.mil/pki/documents/dod_x509_certificate_policy_v9_0_9_february_2005.pdf). All other situations that pertain to the disposition of the certificates are handled in accordance with Assistant Secretary of Defense for Networks and Information Integration Certificate Policy, “X.509 Certificate Policy for the United States Department of Defense” as implemented.