1

Updated October 20, 2023

CAIA Introduction 

Frequently Asked Questions 

Introduction to CAIA: Frequently Asked Questions

Please find frequently asked questions and answers below to assist you in the transition to 

CAIA.

1. How are passwords reset? 

Users will login with their PIV/CAC card or ID.me credentials. ID.me password resets will be 

conducted through ID.me. PIV/CAC card users have a PIN, so if it needs to be reset the agency 

user should contact their local card office that issued the card. Therefore, password resets are 

not applicable for PIV/CAC card users because they use PINs.

2. What method can I use for validating my identity?

The default email address associated with an OTCnet account is required for verification, but a 

user can also use the Authenticator App or Short Message Service (SMS) as an extra layer of 

security. 

3. Where can I find help on how to link my PIV or CAC card to OTCnet? 

Please see the guide referenced below for linking a PIV/CAC card to an OTCnet account. 

Converting to PIV/CAC Authentication for OTCnet Guide

4. Do I need to use my PIV/CAC card to login the OTCnet Bridge also? 

No, users will not need to use a PIV/CAC card to login to the OTCnet Local Bridge. An OTCnet 

user can access the OTCnet Bridge and login using OLB credentials. Check capture and 

processing users will need to continue to log in to the OLB using their OLB profile credentials.

5. Do I need to use my PIV/CAC to Login to the OTCnet Test Environment? 

OTCnet test environment users do not have to link their PIV or CAC credentials. Users accessing 

a test environment (e.g., QAiC) will continue to log in using their testing username and password.

6. If I have a PIV/CAC, do I also have to create user identity in ID me?

If you have been able to successfully link your PIV/CAC card, there is no need to also create an 

ID.me account which is primarily needed for non-Agency users without an issued PIV/CAC. 

7. What is SailPoint used for?

If you are a new user, your PLSA/LSA will register you in SailPoint and request high level 

organization and role(s) for you in SailPoint. 

After an access request is made in SailPoint, another PLSA/LSA will receive a notification that 

there is an access request pending their review. PLSA/LSAs will then login to SailPoint to 

approve or deny the requested High-Level Organization (HLO) or roles. Please see the Printable 

Job Aid below for the steps of approving (or denying) requests in SailPoint.

Approve or Deny User Access Requests in SailPoint IIQ Guide
2

Updated October 20, 2023

CAIA Introduction 

Frequently Asked Questions 

8. Do PLSAs/LSAs direct users to SailPoint to register or do the PLSAs/LSAs create their 

accounts for them?

In SailPoint, there is a self-request feature where the user can request OTCnet access 

themselves by selecting their HLO and role. However, SailPoint has a delegated user feature

where a security administrator (PLSA/LSA) can request OTCnet access on behalf of a 

user. Currently, this is the preferred method for registering users in SailPoint (with the assistance 

of PLSAs/LSAs). 

In OTCnet, the user cannot give themselves access, their security administrator (PLSA/LSA) 

must finish the process by making fine-grained selections for the user to be able to access certain 

endpoints with certain roles and that must be approved by another PLSA/LSA.

9. Will SailPoint self-service work at the HLO level, or the ‘children’ level when a new user 

makes a request?

Select your organization before selecting your role. SailPoint will only have the HLO, while the 

lower-level endpoints (i.e., children level organization) will be selected in OTCnet. 

10. Will I still keep my same user role in OTCnet?

Yes. And if you experience issues, please contact your PLSA/LSA.

11. Who do I contact if I have questions regarding SailPoint?

Customer Support Team is the Point of Contact for SailPoint questions and issues. 

The OTCnet Customer Support Team 

Toll free phone: 866-945-7920 

DSN phone: 510-428-6824, Option 2 

E-mail: Fiscalservice.OTCChannel@citi.com

12. What are the best browsers to access SailPoint and OTCnet?

The recommended browsers for accessing SailPoint and OTCnet are Microsoft Edge and Google 

Chrome. 

13. After I authenticated my PIV/CAC or ID.me credentials, I got this notification that “An 

entitlement request has been submitted to enable privileged access to OTCnet. An email 

will be sent to [user email address] once your entitlement request has been processed.”

What does this mean?

This means that a request for an HLO and role(s) for you has been submitted by your PLSA/LSA 

or HLO in SailPoint. Then another PLSA/LSA will approve the request. At that time, you can login 

to OTCnet, and your information will be searchable in the OTCnet database. 

Then notify your PLSA or LSA, and they will login to OTCnet to assign you an endpoint/role by 

searching for your email address in OTCnet. The PLSA/LSA will notify you when they have 

assigned you an endpoint/role. 

14. My PLSA/LSA made me a new user account in SailPoint and provisioned it, but it is not 

showing up in OTCnet for the PLSA/LSA. Is there a delay?

The process should be instant. However, the new user should log into OTCnet and then the 

PLSA/LSA can view them in OTCnet and complete the user provisioning.
3

Updated October 20, 2023

CAIA Introduction 

Frequently Asked Questions 

15. Who is my PLSA/LSA?

If you aren’t sure who your PLSA or LSA is, please reach out to the Customer Support Team and 

they can have your PLSA/LSA contact you.

The OTCnet Customer Support Team 

Toll free phone: 866-945-7920 

DSN phone: 510-428-6824, Option 2 

E-mail: Fiscalservice.OTCChannel@citi.com

16. I currently have the LSA role assigned for my organization. Why can’t I manage users in 

SailPoint?

Our intention for SailPoint is for only the top level (HLO/FI) PLSA and LSAs to use SailPoint to 

manage OTCnet identity access. If the Manage User option is not available to you in SailPoint, 

but you know you possess an LSA role, this likely means your LSA role exists at a local level 

(child organization) within your HLO. 

Although you will not be able to submit or approve access within SailPoint, you will be able to 

submit and approve endpoint (ALCs, or Agency Location Codes)/role requests for users within 

your organization in OTCnet. SailPoint is designed to allow the HLO/FI PLSA and LSAs to submit 

and approve user access requests to grant a user access to their organization, while local LSAs 

will submit and approve user access requests to grant a user access to organizational endpoints 

(ALCs)/roles in OTCnet. If you are not sure of your current access level for your LSA role, the 

OTCnet Customer Service Team can confirm your access level for you.

17. I changed my email address, and I can’t login to OTCnet. What should I do? 

There are a few steps that should be performed: 

● Validate the user using their old email address that they used for login in. 

● Add the HLO roles in SailPoint to the new user identity.

● Notify the OTCnet Customer Support Team of the email address associated with the 

PIV/CAC as well as any other email address for the user. They will update the Database 

in OTCnet to reflect the email address currently associated with the PIV/CAC or ID.me 

credentials. They will notify the CAIA team to delete or invalidate the account with the old 

email address.

The OTCnet Customer Support Team 

Toll free phone: 866-945-7920 

DSN phone: 510-428-6824, Option 2 

E-mail: Fiscalservice.OTCChannel@citi.com