The Department of War has issued new guidance expanding approved login options beyond the Common Access Card, allowing alternative authentication methods when CAC use is impractical or infeasible, Federal News Network reported Friday.
The policy is outlined in a recent memorandum titled “Multi-Factor Authentication (MFA) for Unclassified & Secret DoD Networks.” This clarifies when users may access War Department systems without CAC or public key infrastructure credentials and identifies approved non-PKI authentication tools by system risk level and use case.
What Does the New Memo Change?
The memo formalizes the use of non-CAC, non-PKI multi-factor authentication across a defined set of scenarios, addressing long-standing ambiguity around which login technologies are authorized and when they may be used.
According to the guidance, the CAC remains the department’s primary credential, but alternative authenticators may be used for limited access scenarios, particularly when users do not yet have CACs or cannot reasonably use one.
The policy also acknowledges newer authentication technologies, including Fast Identity One-based passkeys, and provides direction on how such tools should be protected and deployed.
Who Can Use Non-CAC Authentication?
The memo highlights several practical use cases, including:
- Early-stage recruits, who may access limited DOW resources using basic login methods.
- Low-risk training environments, where employees, contractors and partners without CACs may authenticate using DOW-approved non-PKI MFA after identity verification.
The department identified more than 20 approved use cases, noting the list will evolve as mission needs and technologies change.
How Does the CAC Memo Align With Existing DOW Access Policy?
The update builds on prior access management guidance issued by the DOW Office of the Chief Information Officer, which established department-wide policy for managing access to IT systems and identity, credential and access management platforms.
Notably, the new memo does not require phishing-resistant authenticators, even as Congress and federal cyber leaders continue to push the department to phase out vulnerable login methods.
