How a SAAR moves today
A new analyst needs an account on a mission system. Someone emails her a fillable DD-2875. She completes Part I, attaches her cybersecurity awareness training certificate and sends it to her supervisor, who adds the justification and signs. Then it goes to the information owner, then the security manager to verify her investigation, then the ISSO or system administrator, each by email. Somewhere along the way a block is left blank, a signature field breaks, or the form sits in the inbox of someone on leave. She asks where it is. Nobody knows.
For a command handling a steady stream of these, the form isn’t the problem. The routing is, and the record of who approved what lives in a folder of PDFs.
The same form as a workflow
The requester signs in with a CAC. Name, organization, email and phone are filled from the directory. She picks the system and access type, enters the justification and uploads the training certificate. The form won’t submit with required blocks empty, and it flags a training date older than your policy allows.
Each approver gets their section, in order. The supervisor confirms need to know. The information owner approves the access level. The security manager validates investigation and clearance. Each signs in with their CAC, sees the request summarized with the earlier approvals, and approves or returns it with a comment. Reminders go out before a deadline, and requests escalate to an alternate after it.
Approved access goes to the people who grant it. For systems Kinetic is connected to, such as Active Directory, the account or group is created directly. For systems that need a person, the administrator gets a task with everything they need, and the request stays open until they confirm.
The record is complete. Requester, each approver, timestamps, changes, comments, attachments and the provisioning result are kept together. The requester sees which approval is pending at every step.
The form comes out as a PDF. Kinetic fills a form-fillable DD-2875 from the approved request. Where a command requires a digital signature on the PDF itself, the signer downloads it, signs it in Adobe Acrobat with their CAC and uploads it back to the request. Browsers can’t apply a CAC signature to a PDF securely, so that step happens on the desktop, and the workflow tracks it like any other.
After approval
Access granted on a DD-2875 is usually reviewed annually. Each approved request carries its review date, and when it arrives the supervisor and information owner get a task to revalidate or remove the access. Removals run through the same connections that granted it.
DD-2875 is often the first access workflow a command digitizes. Broader access request automation reuses its routing and connections for systems that don’t need a SAAR, and the records feed compliance and audit workflows. See security and deployment for IL5, CAC and air-gapped options.