1

OTCnet Presents: 

Introduction to CAIA 

 Dial-in to set-up audio 

Conference Line: +1 (804) 394-5686 Conference Code: 89018757#

We ask that you enter your questions throughout the presentation into the chat. There 

will be a 10-minute Question and Answer session at the end of the webinar. 

During the Question and Answer session, use the Teams chat box and direct your 

question to ‘Everyone’. Include your name, agency, bureau, and email address.

Please note this webinar will be recorded

We will begin shortly

?

To join today’s session:

Or

MS Teams Link: https://events.teams.microsoft.com/event/5eb8f118-a62d-4d98-8c7ba419e09f345f@d5fe813e-0caa-432a-b2ac-d555aa91bd1c
2

October 19, 2023

OTCnet Presents: 

Introduction to CAIA 
3

Introduction: The OTCnet Team

Valya Nikolova

Training Lead 

Tiffany Maynard

Marketing & 

Communications Lead

Nabil Lothae

Senior Specialist
4

Timing Topic

10 minutes Overview to CAIA 

5 minutes User Authentication through 

PIV/CAC and ID.me 

7 minutes User Provisioning Workflow

4 minutes Other Updates, Key Takeaways and 

What’s New

10 minutes Question & Answer Session 

2 minutes Closing Remarks

Agenda
5

CAIA Overview

The Fiscal Service-led initiative focuses on standardizing the way users register and log in to applications. In 

Release 4.6, the Common Approach to Identity Assurance (CAIA) takes over Treasury Web Application 

Infrastructure (TWAI’s) IBM Security Identity Manager (ISIM) to manage user registration and user 

provisioning in SailPoint Identity IQ (IIQ) and OTCnet.

• Allows users to authenticate using PIV/CAC or ID.me

• Allows PLSAs and LSAs to register users and request OTCnet access for them in SailPoint IIQ

• Allows users to obtain fine-grained user access in OTCnet with the assistance of HLAS, PLSAs and 

LSAs
6

Key Updates for End Users

Modernized Identity 

Management with 

SailPoint

User Management & 

Provisioning in SailPoint 

and OTCnet

Temporarily Freeze Data in 

OTCnet Security Reports 

 

CAIA Overview, Continued
7

Poll Question

1. Are you a PLSA or LSA OTCnet User? 

o Yes

o No

o Not sure
8

Key Updates for PLSAs/LSAs 

Adding or Removing User 

Access in SailPoint

Adding or Removing an 

Endpoint/Role for a User in 

OTCnet

Approving or Denying User 

Access Requests in 

SailPoint

CAIA Overview, Continued

Approving or Rejecting 

Endpoint/Role Requests in 

OTCnet
9

User Authentication through PIV/CAC 

and ID.me 

(5 Minutes)
User Authentication, Continued

Users with PIV/CAC linked to their FS accounts 

go to OTCnet to log in. 

https://otcnet.for.fiscal.treasury.gov
11

Poll Question

3. Do you have an active account with ID.me? 

o Yes

o No

o Not sure
User Authentication, Continued

OTCnet
User Authentication, Continued

OTCnet
User Authentication, Continued

OTCnet
User Authentication, Continued

For more information, refer to the

Treasury and ID.me site. 

Also, refer to the Job Aid on how to

Create An OTCnet Account Through ID.me. 
16

Resources for User Help Support

ID.me Support 

• Help Page (no log in required): 

https://help.id.me/hc/en-us

§ Includes a chat bot

• Help Center (log in required): https://help.id.me/hc/enus/p/contact_support

§ Includes a chat bot and an option to open a Help 

Ticket

Additional Resources
17

User Provisioning Workflow in SailPoint 

and OTCnet

(7 Minutes)
18

User Provisioning Workflow

Step High-Level Actions

Step 1 The PLSA or LSA receives an authorized/approved request to add a new user (from their 

organization) to OTCnet.

Step 2 The PLSA or LSA logs into SailPoint IIQ, selects Manage User Access, and searches for 

the email address of the new user from the request in step 1.

• If the email address is not found, the PLSA or LSA selects Manage Identity and Create 

Identity from the menu options. They enter the authorized user’s email address and 

select Submit. 

• If the email address is found, the PLSA or LSA continues with step 3.

Step 3 The PLSA or LSA adds the authorized role/HLO or role/Financial Institution (FI)

combinations to the identity. Another PLSA or LSA approves (or denies) the request. Then 

the requestor PLSA/LSA notifies the user to log into OTCnet. 

Step 4 The user logs into OTCnet and sees the following message: “Thank you for logging into 

OTCnet. You have completed the steps to request access to the application”. 

The user is prompted to contact their PLSA or LSA requesting for them to set up their 

OTCnet endpoint(s) and role(s).

Step 5 The PLSA or LSA logs into OTCnet and adds the authorized endpoint(s) and role(s) to the 

user. Another PLSA or LSA approves (or rejects) the request. Then the user is informed 

that their OTCnet provisioning is complete.
19

User Provisioning Workflow, Continued

Requesting User Access in SailPoint 

1

2

Creating User Identity in SailPoint 

Entering a User Email Address for the Identity 
20

User Provisioning Workflow, Continued

Requesting Access in SailPoint, Continued

3

4

SailPoint, Manage Access

SailPoint, Review and Submit 
21

User Provisioning Workflow, Continued

5

6

Approving User Access in SailPoint 

SailPoint Home Page, Approval Awaiting the Approver's Action 

SailPoint, Approvals
22

User Provisioning Workflow, Continued

Adding an Endpoint/Role for a User in OTCnet 

7

OTCnet, Search User Directory

8

OTCnet, Manage User Account
23

User Provisioning Workflow, Continued

Adding an Endpoint/Role for a User in OTCnet, Continued 

9

OTCnet, Manage User Account, Add Endpoint/Role

10

OTCnet, Access Approval Request
24

Training Resources 

For more information, refer to the Printable Job Aids on the 

OTCnet Training Site.

Printable Job Aids for SailPoint IIQ Printable Job Aids for OTCnet

Self-Register/Create an Account Log in to OTCnet Online

Request Your Access Add an Endpoint/Role for a User 

Create a User Identity Remove an Endpoint/Role for a User

Add User Access Approve or Reject an Endpoint/Role 

Remove User Access 

Approve or Deny User Access 

Requests 
25

Training Resources, Continued 

For an immersive user experience, refer to the 

YouTube videos on the OTCnet Training Site.

YouTube Videos for SailPoint IIQ

Request OTCnet Access for Yourself 

Request OTCnet Access for Users

Remove OTCnet User Access

Approve or Deny OTCnet User Access Requests 
26

• Frequently Asked Questions (FAQ):

https://fiscal.treasury.gov/files/otcnet/introduction-to-caiafaq.pdf

• System Requirements Guide: 

https://www.fiscal.treasury.gov/files/otcnet/otcnet-sysreq.pdf

Additional Resources
27

Other Updates, Key Takeaways and 

What’s New

(4 Minutes)
28

Treasury General Account (TGA) 

25-by-25 Initiative

Purpose

• The Treasury General Account (TGA) landscape has changed as a direct result of the banking 

industry’s growing trend to reduce their physical footprint supporting brick and mortar banking 

centers, and banks are leaving the TGA network. 

• In assessing this changing market and striving to meet the needs of their customer agencies 

while maintaining operational stability in federal revenue collection, Fiscal Service has set a 

goal to reduce the volume of deposit processing vouchers across the TGA network 25% by 

2025. 

Action Needed

• Fiscal Service has established June 30, 2025, as the expected transition end date of your 

agency’s paper-based collections to one or more of Fiscal Services’ many electronic solutions 

(such as ACH Credit, Credit/Debit Card Processing, Mobile, Digital Wallet, Online Bill Payment, 

and/or Pay.gov).

• The OTCnet Deployment team is ready to assist with your agency’s transitions and provide 

further information on our various electronic solutions. 

• This initiative is in support of the Bureau’s No Cash No Check Policy, and we encourage 

your agency to adopt this policy in full or in part as we move toward the goal of an allelectronic Treasury!
29

Key Takeaways

• CAIA takes over ISIM to manage user registration and user 

provisioning in SailPoint and OTCnet. 

• All users will authenticate using PIV/CAC or ID.me.

• PLSAs and LSAs will register users and request OTCnet 

access for them in SailPoint IIQ.

• Prospective users will obtain fine-grained user access in 

OTCnet with the assistance of HLAS, PLSAs, and LSAs.
30

What’s New? 

Multi-Factor Authentication (MFA) in OTCnet Offline

• Users can use MFA in OTCnet Offline to be compliant with 

Cybersecurity Executive Order (EO) 14028.

Offline to Online Authentication Password

• Check Capture Administrators can create passwords for online 

authentication into Offline to continue to perform functions in OTCnet 

Offline.

Extending Session Timeout to 30 Minutes in OTCnet Offline

• The session timeout in the Offline application is being extended to 30 

minutes which prevents unnecessary timeouts due to inactivity.
31

Question & Answer

(10 Minutes)
32

Closing Remarks

(2 Minutes)
33

A copy of this presentation as 

well as other resources will be 

sent to you by email.

For the most up to date OTCnet 

news, check out the 

OTCnet Home Page

Additional Information and Upcoming 

Webinars 

Upcoming Session

Ø November 7th, 2023
34

The OTCnet Customer Support Team 

(866) 945-7920 

DSN: (510) 428-6824, option 2 

Fiscalservice.OTCChannel@citi.com

Contact Us for 

Support

Customer Support