ExamWizardzExamWizardz
Start free
Security

What is CAC?

CAC (Common Access Card) is the US Department of Defense smart card ID that uses certificates and a PIN for building access and network sign-in.

What is CAC?

The Common Access Card (CAC) is the standard identification card of the US Department of Defense (DoD). It is issued to uniformed service members, DoD civilian employees and eligible contractors. On the outside it is a photo ID; on the inside it is a smart card whose embedded chip stores digital certificates and the private keys that go with them. The same card opens doors and signs the holder in to DoD computers, networks and websites.

A note on the name: the CompTIA A+ acronym list expands CAC as "Calling-card Authorization Computer." That expansion is not used in the industry. In IT security, CAC means Common Access Card, and the card is the concept to know.

How CAC authentication works

  1. The user inserts the card into a smart card reader, either a USB reader or one built into a laptop or keyboard.
  2. The computer reads the certificate on the chip and prompts for the card's PIN.
  3. The PIN unlocks the private key on the chip, which answers a cryptographic challenge to prove the card is genuine. The private key never leaves the card.
  4. The system checks that the certificate was issued by a trusted DoD certificate authority, has not expired and has not been revoked, then maps it to the user's account.

Because the user needs both the physical card (something you have) and the PIN (something you know), CAC sign-in is multifactor authentication built on public key infrastructure (PKI). Certificates on the card are also used to digitally sign and encrypt email.

CAC and PIV

Federal civilian agencies use the Personal Identity Verification (PIV) card. The CAC is built to the same federal standard, FIPS 201, so the two work the same way: a chip, certificates, a PIN, and use for both physical and logical access. If a question says DoD or military, the card is a CAC; if it says a civilian federal agency, it is a PIV card.

Common support issues

  • Reader not detected: check the USB connection, look for the device under Smart card readers in Device Manager, and update or reinstall its driver.
  • Certificates not visible: the smart card driver or required middleware may be missing, or the card may need to be reseated.
  • Wrong certificate chosen: a website may list several certificates from the card, and the user must pick the authentication certificate rather than an email signing or encryption certificate.
  • Locked card: too many wrong PIN entries lock the card, and an authorized ID office must reset it. The help desk cannot reset it like a password.
  • Expired certificates: sign-in fails until the certificates are updated or the card is replaced.

CAC on the CompTIA A+ exam

CAC is on the shared A+ acronym list; the authentication concepts behind it are mostly Core 2 material. Expect it as an example of a smart card or of multifactor authentication.

  • If you see "smart card plus PIN," think two factors: something you have and something you know.
  • If a question mentions a military or DoD ID card used to sign in to a computer, think CAC.
  • If the CompTIA expansion "Calling-card Authorization Computer" appears, treat it as the same acronym; the tested idea is the smart card ID.
  • A smart card reader is the hardware required, and the private key stays on the chip.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

Certificate-Based Authentication

Certificate-based authentication is a method of verifying a user's or device's identity by using a digital certificate, which is a file that contains cryptographic keys and other information that validates the identity of the certificate holder.

MFA

A security mechanism requiring users to provide two or more different types of verification evidence before gaining access to a system, account, or resource, significantly reducing the risk of unauthorized access even if one credential is compromised.

PIV

PIV (Personal Identity Verification) is the US federal smart card ID standard (FIPS 201), using certificates and a PIN for building and network access.

public-key cryptography

A cryptographic system that uses a pair of mathematically related keys—a public key for encryption and a private key for decryption—allowing secure communication and digital signatures without prior key exchange.

smart card

A smart card is a credit card-sized device that contains an embedded microprocessor or memory chip, used for authentication, secure data storage, and other applications.

← Back to the full CompTIA glossary