Who can enroll an Initial Issue Token on SIPR (the subscriber's first token)?

• A. Any Trusted Agent
• B. The DEERS office
• C. The RA or LRA office
• D. The CAC office

Answer: (C)

The key idea is that token issuance is handled by the Registration Authority and Local Registration Authority. These offices are responsible for verifying a person’s identity and initiating the PKI enrollment process, then issuing the initial token (and setting up the PIN) for SIPR. A Trusted Agent isn’t the issuing authority, and while they may assist, they don’t have the authority to enroll someone’s first token. The DEERS office deals with eligibility data, not PKI token issuance, and the CAC office issues the Common Access Card, which is a separate credential. So, the correct choice is the RA or LRA office.