Skip to main content
HonestMOS
●InvestigationsCongress made VA disability claims free to file. An entire industry charges veterans anyway — and nobody can stop them.→
←Back to 5821 Criminal Investigator — overview, pay, training, civilian translation, reviews
5821E1-E3

Criminal Investigator

E-1 to E-3 (Junior Enlisted) · Marines

E1–E3E-4E-5E-6E-7E8–E9
HEADS UP

Article 31b is not Miranda. It is the UCMJ equivalent — but it applies to military members in a way Miranda does not, and the jurisdiction and applicability rules are different. You will be reading rights to Marines before their first cup of coffee. Get the advisement framework wrong once, in front of a defense attorney at an Article 32 hearing, and the case you spent four months building is suppressible. Learn it cold before your first day in the field office.

The Honest MOS Read
The CITP graduate who walks into a USMC Criminal Investigation Division field office is not a rookie cop. You have twelve-plus weeks of federal investigative tradecraft from FLETC Glynco behind you — the same curriculum the Secret Service, IRS-CI, and ATF rookies sat through — and a badge that carries federal investigative authority on DoD installations. What you do not have yet is a case. Not a real one, not your own, not one where the outcome belongs to your judgment. For the first six to twelve months, the senior agent is your operating system. You observe and assist. You document what you see, write summaries of what the senior agent demonstrates, and produce the background work — witness canvasses, evidence logs, information-system queries — that keeps the case moving. The cases are not training exercises. A Pvt or LCpl 5821 may assist on a sexual assault investigation, a homicide, a drug trafficking network with a dozen subjects, or a financial fraud case with consequences the command would rather not acknowledge. The facts are real. The subjects are real. The victims are real. Your documentation and your chain-of-custody discipline are the foundational layer on which the entire prosecution stands. The Article 31b framework is the first and most critical legal distinction you will learn. It is not Miranda — it is a UCMJ statutory requirement that runs differently from the Fifth Amendment protections your civilian counterparts work with. Under Article 31b, a person subject to the UCMJ who is suspected of an offense must be advised of the nature of the offense, their right to remain silent, and the right to counsel before any interrogation. The operative word is 'suspected' — not arrested, not in custody. A senior NCO asking a junior Marine questions in a casual setting can trigger Article 31b if the NCO reasonably suspects the junior Marine of an offense. As a CID agent, you will give this advisement before every subject interview, and you will document that you gave it, what specific offense was articulated, and that the subject acknowledged and waived or invoked. The defense attorney will test every element of that documentation at the Article 32. The agent who treats the advisement as a formality to be completed quickly before the interview gets to the good part is the agent who loses the suppression argument. Crime scene discipline is the other non-negotiable. The photography sequence — overview, midrange, close-up, with scale, before any item is moved — is not a suggestion. The evidence marking protocol, the chain-of-custody documentation from collection through evidence-vault intake, the packaging standards for each evidence category are procedures you execute the same way every time, on every case, regardless of how obvious the facts appear. A fingerprint lifted correctly and logged continuously through trial is worth the same in court as one lifted perfectly. A fingerprint lifted correctly and then transferred between evidence containers with a two-hour gap in the custody log is worth nothing. The MCIO case management system is where your professional reputation lives. Case notes entered contemporaneously, as events occur, are your documentation shield. Notes reconstructed after the fact — even accurately — are the ones the defense attorney attacks as convenient after-the-fact narratives. The dispatch log, the case system timestamps, and the physical evidence logs are compared against each other by every attorney in the chain. The investigator whose contemporaneous notes are complete, timestamped, and consistent with everything else in the file is the investigator the trial counsel goes to the Article 32 with confidence. By eighteen months, the senior agent stops co-signing every action. Lower-complexity cases start routing to you directly — smaller-dollar theft matters, clear-cut drug possession cases, minor assault complaints that need a clean investigation before disposition. You carry these files to closure. The senior agent reviews the final package, but your judgment drove the investigation. That is when the probationary phase actually ends.
Career Arc
  • 01FLETC CITP completion at Glynco, GA — 12-plus-week federal investigative program; graduation is the entry credential for every CID billet in any branch.
  • 02Report to USMC CID field office — assigned to senior agent as probationary investigative assistant; first 60 to 90 days are observation, documentation support, and evidence-management fundamentals.
  • 03First supervised witness interview — typically 60 to 120 days in, with the senior agent present for observation and debrief; the contemporaneous notes are yours to own.
  • 04First solo witness interview on a secondary complainant — typically month six to nine, after the senior agent has assessed your Article 31b discipline and your documentation standard.
  • 05First independent case file on a low-complexity matter — theft, minor drug possession, simple assault — where you are the case agent from complaint intake through the final investigation report; senior agent reviews but does not rewrite.
  • 06Corporals Course — mandatory for Cpl promotion; schedule this before the cutting score window tightens; the CID billet tempo is not an exemption from the NCO milestone.
  • 07FitRep cycle one — the senior agent's report on your first year assesses case file quality, Article 31b discipline, evidence handling, and report writing standard; this is the file the MCIO regional office reads when your name comes up for a senior agent billet.
Common Screwups
  • ×Any Article 31b violation — failing to advise a subject before a custodial or non-custodial interrogation, misidentifying the offense at advisement, or failing to document the advisement's specific content. One suppression ruling voids the statement, and the case either rebuilds from scratch or dies at the Article 32. The agent's name is in the suppression motion.
  • ×Chain-of-custody break — one unlogged transfer, one unsealed bag at intake, one evidence item that was documented in your notes but does not appear in the vault log. Defense attorneys receive the entire chain-of-custody documentation in discovery. They find every gap. The gap becomes the closing argument.
  • ×OPSEC violation involving case details or subject identity — texting case details, posting anything case-adjacent on social media, discussing a subject by name with anyone outside the investigative chain of custody. NCIS and MCIO both conduct service-member account reviews; the special agent in charge gets the alert before you realize the post is still live.
  • ×Letting the TS/SCI clearance slip — undisclosed financial obligation, late foreign contact report, missed periodic reinvestigation trigger. The clearance is the credential without which the billet does not exist. The administrative process that follows a clearance revocation at LCpl or Cpl is not a remediation process; it is a separation process.
  • ×Barracks incident — DUI, fight, drug use — as a plain-clothes federal law enforcement agent with active case files and a security clearance. The NJP is the beginning, not the end. The UCMJ action triggers a security review that reopens the clearance, and the CID billet goes with it.

A Day in the Life

  • 0530PT — either with the field office's PT formation or independently. CID agents maintain the USMC fitness standard; the field office schedule does not always align with a garrison unit's PT formation. Personal accountability.
  • 0700–0730Hygiene and transit. You arrive in civilian clothes at the field office — CID agents work in plain clothes from day one. Maintain the appearance standard appropriate for a federal investigative agent; no unit to enforce a dress code, which means the standard is internal.
  • 0730–0800Daily case review with the senior agent. What is active on each case file, what actions are pending today, what is the priority sequence. As a probationary agent, the senior agent may also brief you on the day's interview plan or scene work and your role in it.
  • 0800–1200Primary investigative work — this is the operating window for witness interviews, scene processing, evidence collection, digital forensics support, or law enforcement information system queries. If an interview is scheduled, the morning window is the standard. If a scene was called in overnight, you may have been at it since before 0600.
  • 1200–1300Midday. The CID field office does not run a scheduled chow formation. Eat when the case allows it. If you are between investigative actions, this is the window for case-management system updates on the morning's activity — enter contemporaneously, not at end of day.
  • 1300–1600Report writing and case documentation. Investigation reports are drafted in this window for events that occurred in the morning. The senior agent's availability for review varies; have a draft ready before you ask for review time. Digital forensics coordination, evidence vault transactions, and coordination calls to the trial counsel's office also run in this window.
  • 1600–1700Senior agent debrief. What happened on your assignments today, what documentation was produced, what is pending for tomorrow. The senior agent's critique of any draft reports runs here. Take notes on every markup — the pattern of corrections tells you exactly where your report-writing standard is weak.
  • 1700–1800End-of-day case log update. Every case file is current before you leave. If an active investigation had a development today, the case-management system entry is timestamped today. The agent who lets the log fall a day behind is the agent who reconstructs from memory — the documentation problem CITP warned you about.
  • After hours — on-call rotationThe CID field office runs an on-call rotation for after-hours complaints — assault reports from the PMO, death investigations, discovered evidence — that cannot wait for morning. As a probationary agent you are typically on call with a senior agent as backup, not primary. When the phone rings at 0200, you go. The scene is processed on the same standard it would be at 1000 on a Tuesday.
  • Field operation — search warrant executionThe clock does not apply. The search-warrant execution window is set by the authorization and the operational plan. You are supporting the senior agent on the entry team, managing the property inventory during the search, photographing the scene, and maintaining chain-of-custody documentation on every item collected. Brief with the senior agent beforehand on your specific role; don't freelance during the execution.

Weekly Cadence

Monday is the reset. Active case files get a status review with the senior agent — what has moved, what is stalled, what new complaints came in over the weekend. The field office does not run a Monday-morning garrison-style formation; the operational environment does not pause for the week. New complaint assignments for the week land in this window, and the senior agent previews what investigative actions are scheduled for the week so you know where you are needed and in what role. Tuesday through Thursday is the investigative window. Interviews are typically scheduled mid-week to avoid weekend availability problems and to ensure the documentation cycle can run before the week ends. Evidence processing, digital forensics coordination, and trial-counsel coordination calls also run in this window. The probationary agent's week is structured around whatever the case requires — not a garrison training calendar. If a search warrant is authorized and the execution plan runs Thursday afternoon, your Thursday afternoon is a search warrant execution. Friday is the documentation catch-up and FitRep preparation window. All case-management system entries from the week's work should be current. Any draft reports handed to the senior agent for review should be in the senior agent's inbox before end of day Friday. If you have a firearms qualification or a formal PT test scheduled this week, the timing fits into the schedule wherever the case allows it — the CID field office does not pause investigations for PT.

Key Skills — How to Drill Each

  1. 01
    Conduct a witness or subject interview using structured investigative techniques — cognitive interview methodology, proper Article 31b advisement documented contemporaneously — under senior agent supervision.
    Study the cognitive interview methodology from your CITP curriculum and reread the MCIO interview standards before every live interview for the first year. Practice the advisement language verbatim until you can deliver it without looking at a card — because the moment you read it off a laminated card in front of a nervous subject, the credibility of the interaction shifts. After each supervised interview, debrief with the senior agent: what the subject disclosed, what the non-verbal signals were, what the documentation captured, what you missed. The agent who debriefs honestly — 'I missed the follow-up on his account of the timeline' — is the agent who does not miss it again. Build a habit of contemporaneous documentation: as soon as the interview room door closes behind you, sit with your notebook and reconstruct the sequence from your notes before doing anything else.
  2. 02
    Process a crime scene: photography sequence, evidence marking and collection, fingerprint lifting, chain-of-custody documentation from collection through evidence vault intake.
    The photography sequence has a non-negotiable order: installation shots establishing context, midrange shots establishing the scene's relationship to fixed reference points, close-up shots of each item before it is moved, close-up shots with a scale marker, and post-collection documentation showing the cleared collection point. Practice this on any training opportunity — even mock scenes during downtime — until the sequence runs automatically. For chain of custody, the standard is that every person who touches the item is documented, in sequence, with times. Build the habit of sealing and initialing evidence packaging before it leaves your hands. One unsealed transfer is the gap defense counsel finds. Fingerprint lifting is a perishable skill — request time with the forensics team at your field office to maintain technique between actual scenes.
  3. 03
    Write an investigation report to the MCIO format standard — factual, first-person, time-accurate, with supporting evidence indexed and referenced — that the senior agent signs without a substantial rewrite.
    Read every report the senior agent has written in the last year that is available to you. Understand the structure: the factual summary leads with the offense, the complainant, the subject, and the date-time-location before any narrative context. Every factual assertion is sourced — interview summary citation, evidence item number, system query result. Nothing evaluative appears in the investigation report; evaluation lives in the cover memorandum. Read your own draft three times before handing it to the senior agent: first pass for factual accuracy, second pass for timeline coherence, third pass for citation completeness. The report the senior agent can sign without a rewrite is the report where every fact has a number behind it.
  4. 04
    Operate law enforcement information systems at the credentialed user level: NCIC/TCIC terminal access, wants-and-warrants checks, DoD criminal history database queries.
    Know your user policy before you run your first query. NCIC terminal access policies prohibit personal-curiosity checks and require a documented law-enforcement purpose for every query. The audit log for every terminal access is reviewed on a regular cycle by NCIC compliance officers and the FBI; an unauthorized query shows up months after the fact during a routine audit. Keep a query log in your case file: what you ran, when, the case number it served. The DoD criminal history systems have their own access policies — read the authorized-use guidance before your first session. The agent who runs a clean terminal history is the agent whose clearance review is a formality.
  5. 05
    Maintain a current TS/SCI clearance — polygraph current, foreign contact reporting accurate, financial obligations documented.
    Treat the clearance as a standing obligation with its own administrative calendar. Know when your polygraph is due; do not let it run past expiration because the investigation workload was heavy. Foreign contact reporting is triggered by any meaningful contact with a foreign national outside a professional context — know your reporting threshold and err toward reporting, not toward deciding the contact was not reportable. Financial obligations: a delinquent account that goes to collections is reportable on the next Periodic Reinvestigation. Address financial problems early and through the Command Financial Specialist or legal assistance — not by hoping the investigation misses it. The clearance revocation process is not an appeals-friendly process at the LCpl or Cpl level.
  6. 06
    Qualify on assigned firearms to the USMC CID LE standard — documented as a permanent carry responsibility.
    The CID qualification standard is not the PMO qualification standard, and it is not the infantry standard. Know the CID-specific course of fire and the documented standard for each. Build a dry-fire practice routine in the barracks — 15 minutes per day minimum during your probationary year. The agent who shows up at the qualification range having not touched the pistol since the last qualification cycle will post scores the special agent in charge documents. Range discipline also includes administrative handling: you are a full-time concealed carrier, and the administrative safety practices — draw discipline, holster discipline, chamber check discipline — are the ones that prevent a negligent discharge that ends the billet and the clearance on the same day.

Manuals & References — What Chapters Matter

  • DoD Instruction 5505.3 — Defense Criminal Investigative Organizations and DoD Law Enforcement Organizations
    This is the joint DoD framework that defines CID investigative jurisdiction, coordination requirements with NCIS, and the reporting protocols that govern every case the USMC CID opens. Read the jurisdiction tables before opening any case that might involve NCIS primacy — the instruction spells out which offense categories require NCIS lead and which require coordination. The agent who opens a case inside NCIS primacy without reading DODI 5505.3 first is the agent explaining to the NCIS resident agent in charge why the case file needs to be transferred and why the investigation timeline was wasted.
  • Article 31b, Uniform Code of Military Justice (10 U.S.C. § 831)
    Memorize the four elements of a valid Article 31b advisement: (1) the nature of the accusation or suspected offense, (2) the right to remain silent, (3) that any statement may be used against the subject in trial by courts-martial, (4) the right to consult counsel. The statutory requirement applies to any person subject to the UCMJ who is questioned about an offense — not only to a formal arrestee. The agent who understands the applicability trigger can determine in real time whether to advise before asking the first question. The agent who guesses will lose the suppression motion.
  • MCO 5580.2 — Marine Corps Law Enforcement Program
    This is the authority structure under which every CID field action is taken — search and seizure authority, arrest authority, coordination with civilian law enforcement, and evidence handling standards. Read the CID-specific appendix, not just the PMO sections. The probationary agent who understands the authority structure can answer the command's questions about why a specific investigative action was or was not taken without escalating to the senior agent every time.
  • Manual for Courts-Martial (MCM) — Military Rules of Evidence, particularly Mil. R. Evid. 304 (Confessions and Admissions) and Mil. R. Evid. 311–316 (Search and Seizure)
    You do not need to pass the bar to be an effective CID agent, but you need to understand the evidentiary rules that will be applied to your case file at the Article 32 and at trial. Mil. R. Evid. 304 governs when a confession or admission is suppressible — the Article 31b violation lives here. Mil. R. Evid. 311–316 govern search and seizure admissibility — the authorization requirements, the exceptions, and the plain-view doctrine. Read these sections before your first case opens, then reread the relevant sections before every major investigative action.
  • NAVMC 1200.1 — MOS Manual (5821 description, CITP pipeline requirements, and billet qualification criteria)
    This is the official description of what the 5821 billet requires, what qualifications are mandatory, and what the MOS specialty career progression looks like. The probationary agent who reads the MOS manual in the first 30 days understands the lane they are in and the standards they are being measured against. The qualification criteria in the MOS manual are what the special agent in charge uses to structure the first-year evaluation.
  • MCO 1610.7 — Performance Evaluation System
    You are receiving a FitRep annually from day one. Read this order before your first FitRep cycle so you understand what the senior agent is evaluating — which attributes, which performance categories, what the relative value placement means. The probationary agent who understands how the FitRep is structured can have an informed counseling conversation with the senior agent about where their performance stands rather than waiting for the annual rating to find out. Attribute sections relevant to the CID billet: mission accomplishment, professional knowledge, initiative, and leadership.

Standards — How to Hit Each

  • FLETC Criminal Investigator Training Program (CITP) graduate — no CITP, no CID billet.
    CITP completion is a pipeline prerequisite, not a post-assignment evaluation — you arrive at the field office as a CITP graduate. The standard worth focusing on after arrival is maintaining the investigative tradecraft CITP instilled: the interview methodology, the evidence-handling protocols, the documentation standards. The agents who let CITP habits atrophy in the first year because 'that is not how the field office does it' are the agents whose case files require the most senior-agent correction. Ask the senior agent how the field office's local protocols align with CITP training — and where they differ, understand why.
  • TS/SCI clearance with polygraph on the required DoD cycle — lapse means billet removal, not remediation.
    Build a clearance calendar in the first week at the field office: when the last polygraph occurred, when the next Periodic Reinvestigation is due, what the foreign contact reporting trigger is for your clearance level. Set a personal reminder 90 days before each due date. The Periodic Reinvestigation is not a surprise inspection — it runs on a predictable schedule and requires updated SF-86 information. The agent who maintains the administrative calendar and updates the SF-86 on time never has a lapse conversation with the MCIO regional security officer.
  • Annual LE firearms qualification to the USMC CID standard — Expert is the expected floor.
    Know the CID qualification course of fire for your duty weapon at the start of each training year. Expert is the documented expectation; qualifying below Expert requires a documented remediation plan from the special agent in charge. Build a dry-fire routine between qualification cycles — the pistol skill degrades without regular maintenance. The agent who qualifies Expert every cycle without remediation is the agent the SAC brings on warrant service and arrest operations without a second thought.
  • Case file acceptance rate — reports approved without substantial senior-agent rewrite — is the primary e1-e3 FitRep metric.
    Before submitting any report draft to the senior agent, run a self-review against three criteria: (1) Is every factual assertion supported by a cited source — interview summary, evidence number, system query? (2) Does the timeline hold together when read against the case-management system timestamps and the dispatch log? (3) Is any evaluative language — 'the subject appeared to be lying' — removed and replaced with documented observable behavior — 'the subject changed his account of the timeline when confronted with the surveillance footage (Exhibit C)'? Reports that pass the three-criteria self-review clear the senior agent's markup cycle consistently.
  • 1st-Class PFT and CFT under MCO 6100.13 — the badge does not waive the fitness requirement.
    1st-Class is the standard. The CID field office is a small community; every performance data point is visible. A plainclothes agent who posts a 2nd-Class PFT is an NCO who posted a 2nd-Class PFT, and the fitness report records it. Build a fitness routine that does not depend on unit PT — CID operational schedules do not always align with the battery or platoon's PT formation. Own the schedule personally. The CFT events — ammunition can lift and maneuver under fire — translate more directly to the physical demands of warrant service and arrest operations than running volume alone does.

Technical Mistakes — Concrete Consequences

  • Conducting any substantive interview — witness or subject — without first giving the Article 31b advisement when required.
    The resulting statement is suppressible under Mil. R. Evid. 304. If the admission was the case's load-bearing evidence, the prosecution's theory may not survive. The defense counsel files the suppression motion, the agent's training record comes into discovery, and the special agent in charge explains to the MCIO regional director why an agent with a CITP certificate failed the most basic legal prerequisite. The case may survive if other evidence supports it; the agent's relationship with the SAC does not survive easily.
  • Breaking chain of custody on a single piece of evidence — one unlogged transfer, one unsealed bag, one missing vault-intake signature.
    Defense counsel receives the complete chain-of-custody documentation in discovery and identifies every gap. A chain-of-custody break does not automatically exclude the evidence, but it becomes a central argument in closing — 'the government cannot establish the item you are convicting my client on is the same item collected at the scene.' The agent who created the gap is named in the closing argument and in the appellate record if the case is appealed.
  • Writing investigation reports reconstructed from memory after the fact rather than contemporaneously as events occur.
    The case-management system timestamps the entries. The dispatch log timestamps the events. When the reconstruction is a day or more after the event, the gap between the log timestamps and the report entry date is visible to every attorney in the discovery process. The defense counsel argues at the Article 32 that the contemporaneous notes — the gold standard — do not exist, and that the report represents the agent's post-hoc interpretation of events. That argument does not have to succeed to cost the prosecution credibility.
  • Posting anything case-adjacent on social media — case facts, subject identity, investigative activity.
    NCIS and MCIO conduct regular service-member account scans. The post is identified, the special agent in charge is notified, and the notification arrives before the agent realizes the post is visible. The OPSEC violation triggers an MCIO review, a possible security clearance notation, and a counseling entry. If the post disclosed subject identity before charges, there may be a government-liability exposure the MCIO regional director has to address. The agent's probationary standing makes this a career-ending event, not a counseling moment.
  • Letting a clearance-required financial obligation — delinquent account, foreign-asset undisclosure, unlisted debt — go unreported during a Periodic Reinvestigation.
    The Periodic Reinvestigation's financial check runs against credit agencies and uses information the subject did not provide. The omission is discovered, the clearance investigator notes the discrepancy between the SF-86 submission and the credit record, and the issue becomes an intentional omission rather than a financial problem. Intentional omission on a federal security clearance form is a disqualifying adjudication in most cases. The clearance is revoked, the billet is gone, and the separation basis is not clean.

Career Decisions at This Rank

  • Pursue Corporals Course as a working CID agent vs. deferring to let the caseload stabilize
    The USMC promotion system has no CID exemption. The Corporals Course slot is a prerequisite for NCO authority and a gate on the Sgt cutting score. The probationary agent who defers the Corporals Course slot because the case tempo is high is the agent who misses the cutting score window because the slot was gone by the time the tempo allowed it. Work the Corporals Course scheduling through the field office NCOIC and the special agent in charge — they have managed this before and the solution is typically a three-week absence plan where another agent carries the active files. Get the slot. The CID billet is built on the NCO foundation, not around it.
  • Stay in 5821 through the first reenlistment window vs. EAS after the first contract
    The FLETC CITP credential and the TS/SCI clearance with polygraph are legitimate civilian law enforcement credentials. The FBI, DEA, ATF, HSI, NCIS civilian, and dozens of federal and state agencies recruit CITP graduates with military CID experience. The honest calculation: a LCpl or Cpl with one or two years of CID experience and a clearance has federal LE options at reenlistment that a non-CID Marine does not. The counter-argument is that the 5821 billet's trajectory — from probationary to journeyman to senior agent to supervisory agent — takes four to six years to develop the case complexity and courtroom credibility that makes the post-service market genuinely competitive. Agents who EAS after the first contract often find themselves re-entering the federal LE training pipeline at lower clearance levels than they left. The reenlistment decision at LCpl or Cpl should weigh where in the trajectory the agent actually is, not where the brochure says they could be.
  • Maintain the TS/SCI polygraph vs. requesting a downgrade conversation with the security officer
    This is not a real decision — it is a framing reminder. The clearance level is set by the billet requirements and the MCIO security program, not by personal preference. The agent who thinks the polygraph maintenance requirement is negotiable is the agent who learns otherwise during the first Periodic Reinvestigation. The value of the conversation with the security officer is not to negotiate the requirement but to understand the administrative calendar clearly, report anything that might be construed as a financial or foreign-contact concern before the PI cycle, and get ahead of anything that could cause a clearance issue. Use the security officer as a resource, not as a gatekeeper to avoid.

How the Seat Varies by Unit Type

  • USMC CID field office — large installation (Camp Pendleton, Camp Lejeune, Camp Foster Okinawa)
    The large-installation field office runs a high case volume, typically with eight to fifteen agents at varying experience levels. The probationary agent at a large office has more senior-agent exposure, more diverse case types, and a formal caseload-management structure. NCIS presence is co-located or immediately adjacent; coordination is a daily operational feature rather than an event. The density of the environment also means more oversight — the SAC, the MCIO regional director, and in some cases the NCIS resident agent in charge are visible stakeholders in how the field office performs. High visibility, high volume, faster skill development.
  • USMC CID field office — smaller installation (Marine Corps Air Station, smaller support installation)
    The smaller-installation office may run three to six agents. The probationary agent here has less coverage from senior agents on every case action, which accelerates independence faster than the large-installation environment but also means errors go further before someone catches them. Case volume is lower but case diversity is similar — major offenses occur at all installation sizes. The NCIS relationship may be less co-located; coordination calls rather than walk-down collaboration are the norm. The closer relationship with the PMO and installation SJA is a feature of the small-office environment that the large-installation agent develops more slowly.
  • OCONUS CID billet — Okinawa, Korea, Germany (USMC installations)
    OCONUS CID billets involve Status of Forces Agreement (SOFA) jurisdiction complexities that do not exist in CONUS. A crime committed by a U.S. service member on a SOFA installation may involve Japanese, Korean, or German prosecutorial jurisdiction depending on the offense type and location. The agent at an OCONUS billet learns the SOFA jurisdiction framework in addition to the standard UCMJ investigative framework. This is genuine complexity — the probationary agent at an OCONUS office is developing skills the CONUS-only agent does not acquire at the same rank. NCIS coordination is present at most OCONUS Marine installations. Liberty risk from the SOFA environment is also part of the caseload reality — off-base incidents involving service members create jurisdictional questions the agent has to navigate.
  • Deployed CID billet — forward operating environment with a Marine Expeditionary Force or MEU
    The deployed CID agent operates in a forward environment where the physical infrastructure of the CONUS field office does not exist. Evidence storage, chain-of-custody documentation, digital forensics support, and legal coordination with the deployed SJA all run in a constrained environment. The probationary agent who deploys — typically with senior agent accompaniment at this tier — develops an adaptability in evidence management and case documentation under field conditions that the garrison-only agent cannot replicate. Case types in a deployed environment may include combat-related investigations, inter-unit violence, and economic crimes involving local national interaction, in addition to standard UCMJ felony offenses.

What Good Looks Like at This Rank

The good probationary 5821 is the one the senior agent stops following into interview rooms by month nine. Not because the senior agent is absent or indifferent — because the agent's Article 31b advisements are clean, the contemporaneous notes are consistent with the case-management system, and the witness summaries come back in a format the senior agent can sign without a second pass. The senior agent knows this agent's documentation is right because the first fifty reports were reviewed and came back with corrections that went from ten items to three to one, and the last fifteen came back unchanged. The evidence vault knows this agent's name for the right reason: the chain-of-custody documentation is complete and the vault staff never has to chase a missing signature. Every collection is packaged, initialed, and logged before it leaves the scene. The photography sequence on every scene has the overview, midrange, close-up, and scale-marker photos in order because the agent learned the sequence in CITP and kept it as a standing habit rather than a range-day routine. By month eighteen, the special agent in charge is routing lower-complexity cases — manageable theft matters, clean drug-possession complaints, single-subject assault cases with cooperative witnesses — directly to this agent's queue. The agent closes these files without a rewrite. The trial counsel's office receives the final investigation package and approves it without a coordination call asking for supplemental reports. The agent's name is not famous in the MCIO regional office yet, but the resident NCIS agent who worked two joint cases with this field office already knows which agent from USMC CID did not create problems on the documentation side. That is the reputation that converts to the journeyman billet in the next cutting score cycle.

Preview — The Next Rank

Cpl in the 5821 billet is not just a promotion. It is the transition from probationary agent — where your judgment is validated by a senior agent before it becomes a case action — to journeyman agent, where your judgment is the case action. The six to twelve active case files you carry at Cpl are yours to manage. The trial counsel is talking to you, not to the senior agent behind you. When the Article 32 hearing convenes and the defense attorney starts picking at your investigation timeline, you are the agent of record answering those questions from your own documented file. The case complexity at Cpl ramps. Sexual assault investigations with multiple potential subjects, drug trafficking cases with distribution-level evidence, aggravated assault cases where the physical evidence and the witness accounts conflict — these are the files on the Cpl agent's docket. You are expected to carry them from complaint to closure without structural rewrite. The senior agent is available as a resource; the SAC routes your files to trial counsel as your product, not as something to be filtered through senior-agent quality control first. The administrative burden also lands at Cpl. You write proficiency and conduct marks for any junior agents or MP support personnel who worked your cases. That is a FitRep responsibility in embryonic form — your ability to document another person's performance in formal language, specifically and accurately. The agents who treat the proficiency marks as a checkbox are the agents who struggle with Section A writing when the FitRep responsibility becomes fully theirs at Sgt.
FAQ

5821 E1-E3 — Frequently Asked Questions

Q01What does a E1-E3 5821 (Criminal Investigator) actually do?
You graduate the Criminal Investigator Training Program (CITP) at the Federal Law Enforcement Training Centers (FLETC) in Glynco, Georgia — 12+ weeks of federal investigative tradecraft shared with civilian law enforcement agencies — and report to a USMC Criminal Investigation Division (CID) field office.
Q02What's the most important thing to know as a E1-E3 5821?
Article 31b is not Miranda.
Q03What does a typical day look like for a E1-E3 5821?
Time-blocked day at the E1-E3 5821 rank tier: 0530 PT — either with the field office's PT formation or independently. CID agents maintain the USMC fitness standard; the field office schedule does not always align with a garrison unit's PT formation. Personal accountability, 0700–0730 Hygiene and transit. You arrive in civilian clothes at the field office — CID agents work in plain clothes from day one. Maintain the appearance standard appropriate for a federal investigative agent; no unit to enforce a dress code, which means the standard is internal,…
Q04What mistakes get E1-E3 5821 soldiers fired or relieved?
Any Article 31b violation — failing to advise a subject before a custodial or non-custodial interrogation, misidentifying the offense at advisement, or failing to document the advisement's specific content. One suppression ruling voids the statement, and the case either rebuilds from scratch or dies at the Article 32. The agent's name is in the suppression motion; Chain-of-custody break — one unlogged transfer, one unsealed bag at intake,…
Q05What career decisions matter most at the E1-E3 5821 rank tier?
Pursue Corporals Course as a working CID agent vs. deferring to let the caseload stabilize — The USMC promotion system has no CID exemption. The Corporals Course slot is a prerequisite for NCO authority and a gate on the Sgt cutting score. The probationary agent who defers the Corporals Course slot because the case tempo is high is the agent who misses the cutting score window because the slot was gone by the time the tempo allowed it.…
Q06What's next after E1-E3 for a 5821 (Criminal Investigator) in the Marines?
Cpl in the 5821 billet is not just a promotion.
Q07What manuals and regulations does a E1-E3 5821 need to know cold?
DODI 5505.3 — Defense Criminal Investigative Organizations and DoD Law Enforcement Organizations (the joint DoD framework governing CID investigative jurisdiction, coordination protocols, and reporting requirements).; MCO 5580.2 — Marine Corps Law Enforcement Program (the overarching USMC LE regulation; CID agents operate under its authority structure).; NAVMC 1200.1 — MOS Manual (5821 description, CITP pipeline requirements, and billet qualification criteria).

This playbook has no tips yet. Be the first to share what you know.

Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards