Personnel Security System Access Request (PSSAR)

What is the Personnel Security System Access Request (PSSAR)?

The Personnel Security System Access Request (PSSAR) is DD Form 2962. With it a person asks for user roles and access to personnel security systems that the form names: the Defense Central Index of Investigations (DCII), Secure Web Fingerprint Transmission (SWFT), the Defense Information System for Security (DISS) and National Background Investigation Services (NBIS). Under its title the form names the Defense Counterintelligence and Security Agency (DCSA).

The blank on this page is the edition marked "DD FORM 2962, Vol 2, JAN 2020". This site has the same blank on a second page: DD Form 2962.

Who is the applicant?

Part 1 of the form is the applicant's personal information. In Item 13 the applicant marks one designation: Military, DoW Civilian, Industry or Non-DoW. Item 12, the CAGE code, is for contractors: the instructions say "Contractor only: CAGE code of Applicant."

In Part 2 the applicant marks, for each system requested, whether the request is initial, a modification or a deactivation, and the roles or permissions asked for. The block for DCII is marked "(GOVERNMENT ONLY)".

Which training certificates are attached?

Part 3 is headed "TRAINING (I have completed and attached training certificates for):" and names two courses: Cyber Awareness Training and Personally Identifiable Information Training. The instructions for these items say: "Mark in the box to certify training units completed and enter completion date for new accounts. Certificates must be submitted with PSSAR within one year of training completion date."

Who signs the request, and what does each person certify?

The form has three signature blocks.

• The applicant (Part 4) signs under a certification that begins: "I hereby certify that I understand that by signing this Personnel Security System Access Request, I am solely responsible for the use and protection of the account that I will be provided. I also understand that I am not authorized to share my account or logon credentials with any other individuals." The certification goes on to the use of all tools and applications "in accordance with the account management policy and security policy, as well as all applicable U.S. laws and DoW regulations" and to what follows a violation. The applicant signs in Item 22 and dates the form in Item 23.
• The nominating official (Part 5) signs under this statement: "I certify that the above named individual meets the requirements for access, has the appropriate need-to-know, and if applicable, meets the requirements for account management privileges. I am also aware that I am responsible for ensuring this individual will follow all account policies, security policies, and all applicable DoW regulations and U.S. laws. Furthermore, I certify that the named applicant requires account access as indicated above in order to perform assigned duties." The instructions say: "The Nominating Official must be a Key Management Personnel (KMP) listed in NISS, Facility Security Officer, or Security Officer/Manager. The Nominating Official CANNOT be the same as the Applicant unless it is a single person facility."
• The validating official (Part 6) signs under the statement: "I have verified that minimum investigative requirements for the above applicant have been met and the applicant has the necessary need-to-know to access the personnel security systems requested." The instructions for this part say: "Do not complete if self-nominating/validating." About the signature they say: "The Validating Official signature serves to affirm the information provided on the following lines (verify before signing): Eligibility/Access Level; Eligibility Issued By; Type of Investigation and Investigation Conducted By. For non-DoW government agency requests, the Chief of Security or designee must complete this section."

What does DCSA add for industry requests?

For industry requests DCSA publishes "PSSAR Industry FAQs", written for industry security management offices (SMOs) that need an initial DISS JVS Hierarchy Manager. They state requirements that the form itself does not print. Among them:

• Training certificates: "if either or both of these required training certificates are more than one year old at the moment DCSA begins to provision your account it will trigger an automatic disapproval." The FAQs also require courses provided by the Defense Information Systems Agency (DISA)/DoD Cyber Exchange or the Center for Development of Security Excellence (CDSE) for initial SMO Hierarchy Manager or Account Manager submissions to the DCSA DISS Industry Process Team. They limit service, company or agency approved course certificates to submissions to an already established SMO Hierarchy Manager or Account Manager for new user account provisioning.
• Nominating official: the FAQs require the nominating official to be an industry KMP on the most recent industry KMP list DCSA has.
• Part 6: "Leave Part 6 blank." According to the FAQs, DCSA performs the duties of the validating official.

This list is not complete. The FAQs go through Parts 1 to 6 of the form question by question and also say what goes into the request packet and how it reaches DCSA.

Where is the request sent?

The form says: "Return completed form to the appropriate Account Manager or DCSA Contact Center, as indicated in the instructions." For guidance on completing and submitting the form, the instructions point to the Account Management Policy of the system concerned, available from the DCSA website. For DISS, the DCSA page DISS Resources lists, under "Access Requests", the "DISS Account Request Procedure", the "PSSAR Form" and the "PSSAR Industry FAQs".