Last updated 2026-07-05 — the article text's own revision date; dated evidence on this page carries its own check date. See the Citation Ledger at the foot for this page's sources.
If you are searching for DoD 8570 and 8140 certifications, the useful question is not 'which cert is best?' The useful question is: what is the current rule source for your situation?
For DoD civilian and military cyberspace workforce positions, DoDM 8140.03 is the controlling modern qualification manual. It became effective on February 15, 2023 and incorporates and cancels DoD 8570.01-M. For contractors, contract language can still point to the DFARS 252.239-7001 clause and DoD 8570.01-M. For everyone else, a blog-level baseline list is not enough. You need the exact work role, proficiency level, contract clause, and current official matrix.
Key takeaways
- DoD 8570.01-M is cancelled. DoDM 8140.03 replaced it, and there is no crosswalk between the two, so no certification satisfies an IAT or IAM level under 8140.
- Under 8140 you qualify for a specific work role at a specific proficiency level, not for a level.
- RoleMath has parsed the official qualification matrix (version V2.1, effective 2025-09-19): 327 foundational qualification options across 42 certifications and 44 work roles. It is a public download and needs no login.
- A certification satisfies the foundational element only. Resident on-the-job qualification and continuous professional development are separate requirements set by the employing component.
- Contract language is a separate question: DFARS 252.239-7001 can still reference DoD 8570.01-M for contractors, so check the contract as well as the manual.
What replaced DoD 8570
DoD 8570.01-M is cancelled. DoD Manual 8140.03 replaced it, and the two do not work the same way, which is why so much advice about this is wrong.
Under 8570 you qualified for an information assurance level — IAT Level II, IAM Level I and so on — and a certification mapped to a level. Under 8140 you qualify for a specific work role at a specific proficiency level, and a certification is one option for satisfying the foundational part of that qualification. There is no crosswalk between the two structures. The DoD did not translate IAT Level II into an 8140 equivalent, so nobody else can either.
That matters practically. If a job advert, a training provider or a chatbot tells you a certification "meets IAT Level II under 8140", it is describing a framework that no longer governs. The levels are real history, not current requirements.
How 8140 qualification actually works
Qualifying for a work role under DoDM 8140.03 has three parts, and a certification is only one of them:
- Foundational qualification. A certification, a degree, or completion of approved training. This is the part the certification matrix covers.
- Resident qualification. On-the-job qualification in the actual role, signed off by the employing component.
- Continuous professional development. Ongoing, with hours set by the component.
So passing an exam does not qualify you. It satisfies one element of three. Any source that presents a certification as the requirement has skipped two-thirds of the manual.
What the current matrix contains
The DoD publishes the qualification matrix as a spreadsheet. RoleMath has parsed version V2.1, effective 2025-09-19, into 327 qualification options covering 42 certifications across 44 work roles. It is a public download and needs no login.
Work roles are grouped into elements of the DoD Cyber Workforce Framework:
| Workforce element | Qualification options in the matrix |
|---|---|
| Cybersecurity | 138 |
| IT (Cyberspace) | 87 |
| Cyberspace Enablers | 68 |
| Software Engineering | 13 |
| Cyberspace Effects | 8 |
| Intelligence (Cyberspace) | 7 |
| Data/AI | 6 |
And each option is tied to a proficiency level, which is the part most summaries drop:
| Proficiency | Qualification options |
|---|---|
| Advanced | 157 |
| Intermediate | 132 |
| Basic | 38 |
A certification listed at Advanced proficiency for one work role does not carry to Basic proficiency in another. The pairing is the requirement, not the certification alone.
Which certifications appear most often
These are the certifications the matrix lists as a foundational option for the most work roles. Breadth here is not a ranking of difficulty or value — it means the credential is accepted against more roles.
| Certification | Work roles it is listed for |
|---|---|
| GSEC | 25 |
| Security+ | 20 |
| SecurityX / CASP+ | 17 |
| Cloud+ | 15 |
| CCSP | 15 |
| GSLC | 14 |
| SSCP | 14 |
| CISM | 13 |
| CCISO | 11 |
| CISSP | 11 |
| CySA+ | 10 |
| PenTest+ | 10 |
Worked example: what Security+ actually covers
Security+ is the credential most often misdescribed, so here is exactly what the matrix says about it. It is listed as a foundational qualification option for 20 work roles, all at Intermediate proficiency:
| Work role code | Work role | Proficiency |
|---|---|---|
| 411 | Technical Support Specialist | Intermediate |
| 421 | Database Administrator | Intermediate |
| 431 | Knowledge Manager | Intermediate |
| 441 | Network Operations Specialist | Intermediate |
| 451 | System Administrator | Intermediate |
| 461 | Systems Security Analyst | Intermediate |
| 511 | Cyber Defense Analyst | Intermediate |
| 521 | Cyber Defense Infrastructure Support Specialist | Intermediate |
| 531 | Cyber Defense Incident Responder | Intermediate |
| 541 | Vulnerability Assessment Analyst | Intermediate |
| 612 | Security Control Assessor | Intermediate |
| 622 | Secure Software Assessor | Intermediate |
| 641 | Systems Requirements Planner | Intermediate |
| 661 | Research & Development Specialist | Intermediate |
| 671 | System Testing and Evaluation Specialist | Intermediate |
| 722 | Information Systems Security Manager | Intermediate |
| 751 | Cyber Workforce Developer and Manager | Intermediate |
| 752 | Cyber Policy and Strategy Planner | Intermediate |
| 802 | IT Project Manager | Intermediate |
| 805 | IT Program Auditor | Intermediate |
Notice what this list is not. It is not a level. It is not a guarantee that a given contract will accept Security+ — components set their own additional requirements. And it is not sufficient on its own, because foundational qualification is one element of three.
How to check your own requirement
1. Find the work role code in the position description or the contract. It is a three-digit code such as 511 (Cyber Defense Analyst) or 451 (System Administrator).
2. Find the proficiency level the position requires — Basic, Intermediate or Advanced.
3. Look up that code and level in the current matrix and read the foundational options listed for it. A certification you already hold may qualify for one level and not another.
4. Ask the employing component about the resident qualification and continuing-education requirements, because those are set locally and the matrix does not contain them.
If someone cannot tell you the work role code, they cannot tell you the requirement.
The bottom line
If you are in a DoD civilian or military cyberspace workforce position, do not buy a certification to satisfy an 8570 information assurance level: DoDM 8140.03 incorporated and cancelled DoD 8570.01-M, and there is no crosswalk from an IAT or IAM level into it. Contractors are the exception, and it is the first thing to check — DFARS 252.239-7001 can still point your contract at DoD 8570.01-M, so read the clause in the contract before you conclude the levels cannot apply to you.
Buy against a work role. Get the code and the proficiency level from the position, check the current matrix (version V2.1, effective 2025-09-19) for the foundational options that pair with them, and confirm the resident-qualification and continuing-education expectations with the employer. Security+ remains the broadest single option for cybersecurity work roles at Intermediate proficiency, which is why it is on so many adverts — but it is one element of a three-part qualification, not the qualification itself.
Frequently asked questions
Did DoD 8140 replace DoD 8570?
Yes for the modern DoD cyberspace workforce qualification program. DoDM 8140.03 became effective on February 15, 2023 and states that it incorporates and cancels DoD 8570.01-M. Contractor contracts can still reference 8570 through DFARS 252.239-7001, so the exact authority matters.
Is Security+ still a DoD baseline certification?
RoleMath has local candidate rows showing Security+ mapped to IAT Level II and IAM Level I, but those rows are unverified candidate mappings. Verify the current official matrix or contract before relying on that mapping.
What happened to the old IAT and IAM levels?
They belong to DoD 8570.01-M, which is cancelled. DoDM 8140.03 does not use them and the DoD published no crosswalk, so a level cannot be translated into an 8140 equivalent. If a job advert still names one, ask for the work role code and proficiency level instead — that is what the current matrix is organised around.
Do contractors follow 8570 or 8140?
Check the contract. DFARS 252.239-7001 still says contractor personnel need proper and current information-assurance certification in accordance with DoD 8570.01-M. Other roles may be governed through 8140 work-role qualification.
Does a DoD baseline certification create a job or pay outcome?
No. A credential can satisfy a requirement only when the current official authority accepts it for that role and level. It does not create employment, access, interviews, personal pay, or a fixed timeline.
How does AI affect DoD 8570 or 8140 planning?
AI does not decide the policy source. It changes the proof bar around the work: candidates should show how they verify AI-generated alerts, commands, incident notes, checklists, diagrams, and summaries against official sources and real tool output.
Related, with the cited detail
- Start the RoleMath planner
- Which cybersecurity certification first?
- CompTIA Security+ overview
- CompTIA CySA+ overview
- CompTIA SecurityX overview
- Google Cybersecurity vs Security+
- Cybersecurity analyst role
- SOC analyst role
- Network security engineer role
- How much tech jobs pay
- How to read a tech job description
- What employers ask for
- Will AI replace tech jobs?
- What we do not know