A subscriber using a CAC for identification must also provide a second form of ID to complete the 2842 form.

• A. True
• B. False
• C. Not required if CAC is used
• D. It depends on policy

Answer: (B)

A CAC can serve as a standalone form of identification because it carries the holder’s photo and trusted PKI credentials issued by a validated authority. When the CAC is valid and accepted by the verification system, it can fulfill the identification requirement by itself, so a second form of ID is not needed. This holds as long as the CAC can be read, is not expired, and the policy allows CAC-based verification. If the CAC cannot be used—for example, it’s expired, damaged, or unreadable—or if a higher-security scenario calls for extra proof, then additional identification may be required. In normal use for completing this form, CAC alone suffices.