Common Access Card (CAC)

The Common Access Card (CAC) is the Department of Defense's standard identity credential, a smart card containing the cardholder's photo, personal information, and cryptographic certificates, issued to active duty military, reserve personnel, DoD civilian employees, and eligible defense contractors to enable both physical access to military installations and logical access to DoD computer systems.

What is a CAC?

The CAC serves as the primary identity credential across the DoD ecosystem. It contains a microchip that stores Public Key Infrastructure (PKI) certificates used for authentication to DoD networks, digital signing of emails and documents, and encryption of communications. When a contractor employee is issued a CAC, they can authenticate to DoD information systems, access classified and unclassified DoD networks (depending on their clearance), and enter controlled facilities using automated reader systems at entry points. Obtaining a CAC requires identity proofing, sponsorship by a DoD-affiliated entity (such as the contractor's program office), and enrollment at a DoD Real-Time Automated Personnel Identification System (RAPIDS) site. Contractors whose employees need CACs are sponsored by their government program management office, and the cards are issued in the contractor's name with a specific expiration tied to the contract or employment period. For contractors working on-site at DoD installations or accessing DoD networks, CAC issuance is a prerequisite to beginning work.

Why CAC matters for government contractors

CAC issuance can be a significant onboarding timeline factor for cleared or on-site contractors. If a contract requires network access from day one, delays in CAC processing can delay productive work. Program managers should coordinate with their government sponsors to initiate CAC requests early in the contract award and employee onboarding process. See our guide on security clearances for the broader access picture.

Example

A newly hired IT systems administrator joins a defense contractor supporting a Navy installation. The program manager coordinates with the Navy's RAPIDS site sponsor to initiate the contractor's CAC enrollment. Two weeks later, the contractor receives their CAC at the RAPIDS office, enabling them to badge into the facility and authenticate to the classified SIPRNET and unclassified NIPRNET networks required for their role.

Frequently Asked Questions

Can contractor employees get CACs?

Yes. Defense contractors whose employees require access to DoD installations or networks can be sponsored for CAC issuance. The sponsoring DoD organization initiates the process through the DEERS (Defense Enrollment Eligibility Reporting System) and coordinates with the contractor employee for RAPIDS enrollment.

How long is a CAC valid?

CAC validity periods vary by cardholder type. Contractor CACs are typically issued for periods aligned with the contract period of performance, often one to three years, and must be renewed before expiration to maintain access. Military and civilian employee CACs typically have longer validity periods.

What happens to a CAC when a contractor's assignment ends?

CACs must be returned to the issuing RAPIDS site when a contractor's assignment ends or the contract period expires. Retaining a CAC after authorization ends is a security violation. Contractors must establish off-boarding procedures to ensure timely CAC return.

What is the difference between a CAC and a PIV card?

A PIV (Personal Identity Verification) card is the federal civilian equivalent of the CAC, it serves the same dual authentication purpose (physical and logical access) for civilian federal employees. Both are HSPD-12 compliant identity credentials, but CAC is the DoD-specific implementation while PIV is the broader federal standard used across civilian agencies.