The Department of War has set a final deadline of Sept. 30, 2027, to fully decommission its decades-old, paper-based System Authorization Access Request process.
All systems must transition to automated identity, credential and access management workflows to modernize how access is requested, authorized and provisioned, the Department of War’s chief information officer said Feb.19, citing a December 2025 memorandum from the DOW chief information security officer.
As agencies retire legacy infrastructure, the Potomac Officers Club’s 2026 Digital Transformation Summit on April 22 will convene top officials and executives to discuss the deployment of advanced AI, cybersecurity and enterprise IT capabilities. Don’t miss this opportunity to align with the strategies and partnerships shaping the future of the public sector. Register now.
What Is Driving the Shift to Automated Workflows?
The directive replaces the DD Form 2875 SAAR process, which relies on manual routing and static documentation that no longer scales to enterprise operational demands.
The new framework, detailed in the ICAM Workflow Implementation Guide, aligns access management with zero trust principles by shifting from manual signatures to attribute-driven decisioning. Under this model, access is granted based on real-time authoritative data, such as official personnel records, security clearance status and completion of required training.
While low-risk requests can be approved automatically based on these attributes, higher-risk or privileged access will require system-enforced attestation from supervisors or data owners.
A primary driver of this transition is the requirement for automated “joiner, mover, and leaver” management. To reduce insider threat risks, user accounts must now be disabled within 24 hours of a separation notification.
Furthermore, the system will generate immutable audit logs for every stage of the access lifecycle — from request to deprovisioning — to strengthen oversight and support defensive cyber operations.
What Is the Road Map to Automation?
Phase 1: Setting the Digital Foundation
The first six months focus on infrastructure readiness. Organizations must audit their existing system inventories and establish technical bridges to approved ICAM providers. Success in this stage is defined by successful pilot tests and the formalization of automated attestation matrices for high-risk data.
Phase 2: Scaling Enterprise Performance
From early 2026 through mid-year, the focus shifts to production and rapid expansion. After a “first wave” of prioritized systems establishes baseline benchmarks for provisioning speed, the department will scale toward a 50 percent adoption target. This period marks the transition from simple role-based access to more sophisticated, data-driven permissions.
Phase 3: Final Integration and Operational Steady-State
Leading up to the September 2027 deadline, the final systems will migrate away from the legacy SAAR ecosystem. This phase is less about deployment and more about decommissioning; manual PDF processes are retired and legacy records are archived. Once the transition is complete, the program will pivot from an implementation project to an operational service.
