The Marine Corps just put out interim guidance on who gets access to civilian Human Resources Information Systems (c-HRIS) and how that access is controlled, audited, and revoked. This is primarily an administrative and cybersecurity policy aimed at HR staff and their supervisors. A full Marine Corps Order is coming; this MARADMIN holds the line until then.
Heads up: Commanders are explicitly responsible for ensuring all Marines and civilians under them are aware of these changes.
Who it affects
This applies to the Total Force, meaning active, reserve, and civilian personnel. In practice, the people who need to act are:
- Supervisors of anyone with c-HRIS access
- HR Directors and HR staff
- Commanders, who own the awareness requirement
If you don't have a c-HRIS account and don't supervise anyone who does, this is background awareness.
What you need to do
The action items break down by role:
If you're a supervisor:
- Confirm anyone you supervise with c-HRIS access has a legitimate need to know.
- Make sure they've completed annual security awareness and PII training.
- Submit a request to deactivate any account within 24 hours when someone's status changes (separation, job change, termination).
If you need c-HRIS access:
- Complete annual security awareness and PII training.
- Submit a System Authorization Access Request (SAAR) form (DD Form 2875, or an approved equivalent) for access approval.
If you're an HR Director:
- Audit c-HRIS accounts at least semi-annually.
- Revoke access for anyone who hasn't completed required training or no longer has a valid reason to be in the system.
If you're a commander:
- No system action required, but you own the awareness piece. Make sure your Marines and civilians know this policy exists and is in effect now.
Key dates
- Effective immediately (as of 29 April 2026): all guidance in this MARADMIN is in effect.
- Semi-annually: supervisors and HR Directors must review and audit accounts on this cycle.
- Annually: all c-HRIS users must complete security awareness and PII training to maintain access.
- Within 24 hours: supervisors must request account deactivation when a user's status changes.
- This MARADMIN cancels itself once folded into a permanent Marine Corps Order (no date given).
The official version
Full text: MARADMIN 202/26
References are DoDI 1400.25 (civilian personnel management IT policy) and DoDI 8510.01 (Risk Management Framework for DoD systems).
POC: Carlamae Aguinaldo, MRA (MPC), at carlamae.aguinaldo@usmc.mil or the mailbox smb_mpc30@usmc.mil. Phone: 703-432-9423 / DSN 378-9423.
This is written by a reservist, for reservists. It is not an official publication of HQMC or MARFORRES. Always verify guidance with your command or unit S-1 before acting on any article or summary.