DoD 8140 Certifications
DoD Manual 8140.03 replaced the DoD 8570 program in February 2023. Instead of IAT and IAM levels, DoD 8140 qualifies personnel for DoD Cyber Workforce Framework (DCWF) work roles at Basic, Intermediate, or Advanced proficiency. A certification is one of several ways to meet a work role's foundational qualification, alongside education and DoD or commercial training.
How Qualification Works
- +Foundational qualification: one option at the required proficiency level, from education, DoD or military training, commercial training, or a personnel certification. Experience can serve as a conditional alternative.
- +Options aligned to a higher proficiency level also qualify for the lower levels.
- +Residential qualification: on-the-job qualification is always required, and components can add environment-specific requirements.
- +Deadlines: foundational qualification within 9 months of assignment, residential qualification within 12 months.
- +Maintenance: at least 20 hours of continuous professional development per year, and every certification kept current under its provider's rules.
DoD 8570 vs DoD 8140
- +DoD 8570 set baseline certifications for three levels in the IAT, IAM, and IASAE categories, plus Cybersecurity Service Provider specialties.
- +DoD 8140 uses DCWF work roles that cover defensive, offensive, intelligence, data and AI, and software engineering work, each with Basic, Intermediate, and Advanced proficiency.
- +There is no crosswalk between the two. A certification earned under 8570 carries over only if it is current and listed for the work role and proficiency level of the position.
- +"Good for life" certifications are not valid under DoD 8140.
- +DoDM 8140.03 requires contracted support personnel to meet foundational qualification requirements when they start cyberspace work. The DFARS Part 239 class deviation in effect since 1 February 2026 no longer includes clause 252.239-7001, which had tied contractor personnel to DoD 8570.
Approved Certifications
59 total| Certification | Provider | Work roles | Proficiency levels |
|---|---|---|---|
| GSEC GIAC Security Essentials | GIAC | 22 | Intermediate |
| Security+ CompTIA Security+ | CompTIA | 19 | Intermediate |
| SecurityX / CASP+ CompTIA SecurityX | CompTIA | 17 | Intermediate, Advanced |
| CCSP Certified Cloud Security Professional | ISC2 | 14 | Intermediate, Advanced |
| Cloud+ CompTIA Cloud+ | CompTIA | 14 | Intermediate |
| GCSA GIAC Cloud Security Automation | GIAC | 14 | Intermediate, Advanced |
| GSLC GIAC Security Leadership | GIAC | 13 | Advanced |
| CISM Certified Information Security Manager | ISACA | 12 | Advanced |
| SSCP Systems Security Certified Practitioner | ISC2 | 12 | Basic, Intermediate, Advanced |
| GICSP Global Industrial Cyber Security Professional | GIAC | 11 | Intermediate, Advanced |
| CCISO Certified Chief Information Security Officer | EC-Council | 10 | Intermediate, Advanced |
| CISSO Certified Information Systems Security Officer | United America Technoloiges, LLC | 10 | Intermediate, Advanced |
| CISSP Certified Information Systems Security Professional | ISC2 | 10 | Advanced |
| CFR CyberSec First Responder | Logical Operations, Inc. dba CERTNEXUS | 9 | Intermediate, Advanced |
| CISSP-ISSEP Information Systems Security Engineering Professional | ISC2 | 9 | Advanced |
| CND Certified Network Defender | EC-Council | 9 | Basic, Intermediate |
| GFACT GIAC Foundational Cybersecurity Technologies | GIAC | 9 | Basic, Intermediate, Advanced |
| PenTest+ CompTIA PenTest+ | CompTIA | 9 | Intermediate, Advanced |
| RCCE Level 1 Rocheston Certified Cybersecurity Engineer Level 1 | Rocheston LLC | 9 | Intermediate, Advanced |
| CySA+ CompTIA Cybersecurity Analyst | CompTIA | 8 | Intermediate, Advanced |
| GCLD GIAC Cloud Security Essentials | GIAC | 8 | Basic, Intermediate, Advanced |
| CEH Certified Ethical Hacker | EC-Council | 7 | Basic, Intermediate, Advanced |
| FITSP-M Federal IT Security Professional-Manager-NG | Federal IT Security Institute | 7 | Intermediate, Advanced |
| GCIA GIAC Certified Intrusion Analyst | GIAC | 7 | Advanced |
| GISF GIAC Information Security Fundamentals | GIAC | 7 | Basic, Advanced |
| CISA Certified Information Systems Auditor | ISACA | 6 | Advanced |
| GCIH GIAC Certified Incident Handler | GIAC | 6 | Basic, Intermediate, Advanced |
| GDSA GIAC Defensible Security Architect | GIAC | 6 | Basic, Intermediate, Advanced |
| CC Certified in Cybersecurity | ISC2 | 5 | Basic |
| CGRC/CAP Certified in Governance, Risk and Compliance | ISC2 | 5 | Intermediate |
| FITSP-A Federal IT Security Professional-Auditor-NG | Federal IT Security Institute | 5 | Intermediate, Advanced |
| GCFA GIAC Certified Forensic Analyst | GIAC | 5 | Advanced |
| Network+ CompTIA Network+ | CompTIA | 5 | Basic |
| CCNP Security Cisco Certified Network Professional Security | Cisco | 4 | Advanced |
| CISSP-ISSAP Information Systems Security Architecture Professional | ISC2 | 4 | Advanced |
| CSSLP Certified Secure Software Lifecycle Professional | ISC2 | 4 | Intermediate |
| FITSP-D Federal IT Security Professional-Designer-NG | Federal IT Security Institute | 4 | Intermediate, Advanced |
| FITSP-O Federal IT Security Professional-Operator-NG | Federal IT Security Institute | 4 | Intermediate, Advanced |
| GCED GIAC Certified Enterprise Defender | GIAC | 4 | Intermediate, Advanced |
| GMON GIAC Continuous Monitoring Certification | GIAC | 4 | Intermediate |
| A+ CompTIA A+ | CompTIA | 3 | Basic |
| CEH(P) Certified Ethical Hacker (Practical) | EC-Council | 3 | Intermediate |
| CHFI Computer Hacking Forensic Investigator | EC-Council | 3 | Intermediate |
| CISSP-ISSMP Information Systems Security Management Professional | ISC2 | 3 | Advanced |
| GCFE GIAC Certified Forensic Examiner | GIAC | 3 | Advanced |
| GRID GIAC Response and Industrial Defense | GIAC | 3 | Intermediate |
| GSNA GIAC Systems and Network Auditor | GIAC | 3 | Intermediate, Advanced |
| CBROPS CCNA CyberOps Associate | Cisco Systems | 2 | Intermediate, Advanced |
| CSC Cyber Secure Coder | Logical Operations, Inc. dba CERTNEXUS | 2 | Intermediate |
| DAWIA PM Advanced | Defense Acquisition University | 2 | Advanced |
| DAWIA PM Practioner | Defense Acquisition University | 2 | Intermediate |
| CCNA CISCO Certified Network Associate | Cisco Systems | 1 | Advanced |
| CCNP Enterprise Cisco Certified Network Professional | Cisco Systems | 1 | Advanced |
| CPTE Certified Penetration Testing Engineer | United America Technoloiges, LLC | 1 | Intermediate |
| DAWIA LCL Advanced | Defense Acquisition University | 1 | Advanced |
| DAWIA LCL Foundational | Defense Acquisition University | 1 | Intermediate |
| ECIH Certified Incident Handler | EC-Council | 1 | Intermediate |
| GPEN GIAC Penetration Tester | GIAC | 1 | Advanced |
| GREM GIAC Reverse Engineering Malware | GIAC | 1 | Advanced |
Certification Options by Work Role
34 work roles| Work role | Basic | Intermediate | Advanced |
|---|---|---|---|
| 211 Forensics Analyst Cyber Enablers | - | ||
| 212 Cyber Defense Forensics Analyst Cybersecurity | - | CHFIRCCE Level 1 | |
| 221 Cyber Crime Investigator Cyber Enablers | |||
| 411 Technical Support Specialist Cyber IT | |||
| 421 Database Administrator Cyber IT | - | ||
| 431 Knowledge Manager Cyber IT | - | - | |
| 441 Network Operations Specialist Cyber IT | CNDNetwork+ | ||
| 451 System Administrator Cyber IT | |||
| 511 Cyber Defense Analyst Cybersecurity | |||
| 521 Cyber Defense Infrastructure Support Specialist Cybersecurity | |||
| 531 Cyber Defense Incident Responder Cybersecurity | |||
| 541 Vulnerability Assessment Analyst Cybersecurity | |||
| 611 Authorizing Official/Designated Representative Cybersecurity | - | ||
| 612 Security Control Assessor Cybersecurity | - | ||
| 622 Secure Software Assessor Cybersecurity | |||
| 631 Information Systems Security Developer Cybersecurity | CISSP-ISSEPFITSP-D | ||
| 632 Systems Developer Cyber IT | CND | ||
| 641 Systems Requirements Planner Cyber IT | CND | ||
| 651 Enterprise Architect Cyber IT | CND | ||
| 652 Security Architect Cybersecurity | GCLDGISF | ||
| 661 Research & Development Specialist Cyber IT | - | ||
| 671 System Testing and Evaluation Specialist Cyber IT | CNDNetwork+ | ||
| 711 Cyber Instructional Curriculum Developer Cyber Enablers | - | - | |
| 712 Cyber Instructor Cyber Enablers | - | - | CISSO |
| 722 Information Systems Security Manager Cybersecurity | |||
| 723 COMSEC Manager Cybersecurity | - | ||
| 732 Privacy Compliance Manager Cyber Enablers | - | - | CISSOGSLC |
| 751 Cyber Workforce Developer and Manager Cyber Enablers | - | ||
| 752 Cyber Policy and Strategy Planner Cyber Enablers | - | ||
| 801 Program Manager Cyber Enablers | - | ||
| 802 IT Project Manager Cyber Enablers | - | ||
| 803 Product Support Manager Cyber Enablers | - | DAWIA LCL Foundational | |
| 804 IT Investment/Portfolio Manager Cyber Enablers | - | - | |
| 805 IT Program Auditor Cyber Enablers | - |
Certifications listed at a level also qualify the lower levels of the same work role. Work roles without a certification option in the matrix are not shown. Matrices for work roles marked tentative are still under review.
Frequently Asked Questions
Did DoD 8140 replace DoD 8570?→
Yes. DoD transitioned from the DoD 8570 Information Assurance Workforce Improvement Program when it released DoD Manual 8140.03, "Cyberspace Workforce Qualification and Management Program", on 15 February 2023. DoD keeps the 8570 information available as a transition reference, but the 8570 policy and standards are superseded for military and civilian personnel.
Does DoD 8140 still use IAT Level II and IAM levels?→
No. DoD 8570 used three levels within the IAT, IAM, and IASAE categories. DoD 8140 qualifies personnel for DoD Cyber Workforce Framework (DCWF) work roles at Basic, Intermediate, or Advanced proficiency, and DoD states there is no direct mapping between the 8570 categories and the DCWF work roles.
Is Security+ approved under DoD 8140?→
Yes. Matrix V2.1 lists CompTIA Security+ as a certification option for 19 work roles. Whether it qualifies a position depends on the work role and proficiency level assigned to that position.
Which certifications qualify for the most DoD 8140 work roles?→
In matrix V2.1, counted by work roles with the certification as a foundational option: GSEC (22), Security+ (19), SecurityX / CASP+ (17), CCSP (14), Cloud+ (14).
Are lifetime certifications accepted under DoD 8140?→
No. DoD states that "good for life" certifications are not valid under DoD 8140. Certifications must be kept current under each certifying organization's renewal rules.
How long do personnel have to qualify?→
The Matrix SOP requires foundational qualifications within 9 months of assignment and residential qualifications within 12 months. Residential qualification also requires at least 20 hours of continuous professional development each year.
How often is the qualification matrix updated?→
The Matrix SOP schedules quarterly refreshes, with updated matrices published at the end of each quarter.
Sources
- DoD 8140 CWQP: DoD 8570 IA Program Transition to DoD 8140 (7 August 2024)
- DoD 8140 Matrix and Repository SOP (19 April 2024)
- DoD 8140 Qualification Matrix V2.1 (XLSX)
- DoD Cyber Workforce: DoD 8140 Document Library
- DoDM 8140.03, Cyberspace Workforce Qualification and Management Program (15 February 2023)
- DFARS Part 239 Class Deviation 2026-O0024 (effective 1 February 2026)
Work roles and certification options from the DoD 8140 Qualification Matrix V2.1, excluding entries the matrix marks as pending validation. The matrix is the authoritative source; check the current version and your component's requirements for a specific position. This site is not affiliated with the Department of Defense.