article

DoD 8570 and 8140 certifications explained with sources

DoD 8570 and 8140 certifications explained with official 8140 policy, DFARS language, caveated cert examples, role evidence, AI context, and steps.

Build my personalized career plan

Last updated 2026-07-05 — the article text's own revision date; dated evidence on this page carries its own check date. See the Citation Ledger at the foot for this page's sources.

If you are searching for DoD 8570 and 8140 certifications, the useful question is not 'which cert is best?' The useful question is: what is the current rule source for your situation?

For DoD civilian and military cyberspace workforce positions, DoDM 8140.03 is the controlling modern qualification manual. It became effective on February 15, 2023 and incorporates and cancels DoD 8570.01-M. For contractors, contract language can still point to the DFARS 252.239-7001 clause and DoD 8570.01-M. For everyone else, a blog-level baseline list is not enough. You need the exact work role, proficiency level, contract clause, and current official matrix.

Key takeaways

  • DoD 8570.01-M is cancelled. DoDM 8140.03 replaced it, and there is no crosswalk between the two, so no certification satisfies an IAT or IAM level under 8140.
  • Under 8140 you qualify for a specific work role at a specific proficiency level, not for a level.
  • RoleMath has parsed the official qualification matrix (version V2.1, effective 2025-09-19): 327 foundational qualification options across 42 certifications and 44 work roles. It is a public download and needs no login.
  • A certification satisfies the foundational element only. Resident on-the-job qualification and continuous professional development are separate requirements set by the employing component.
  • Contract language is a separate question: DFARS 252.239-7001 can still reference DoD 8570.01-M for contractors, so check the contract as well as the manual.

What replaced DoD 8570

DoD 8570.01-M is cancelled. DoD Manual 8140.03 replaced it, and the two do not work the same way, which is why so much advice about this is wrong.

Under 8570 you qualified for an information assurance level — IAT Level II, IAM Level I and so on — and a certification mapped to a level. Under 8140 you qualify for a specific work role at a specific proficiency level, and a certification is one option for satisfying the foundational part of that qualification. There is no crosswalk between the two structures. The DoD did not translate IAT Level II into an 8140 equivalent, so nobody else can either.

That matters practically. If a job advert, a training provider or a chatbot tells you a certification "meets IAT Level II under 8140", it is describing a framework that no longer governs. The levels are real history, not current requirements.

How 8140 qualification actually works

Qualifying for a work role under DoDM 8140.03 has three parts, and a certification is only one of them:

  • Foundational qualification. A certification, a degree, or completion of approved training. This is the part the certification matrix covers.
  • Resident qualification. On-the-job qualification in the actual role, signed off by the employing component.
  • Continuous professional development. Ongoing, with hours set by the component.

So passing an exam does not qualify you. It satisfies one element of three. Any source that presents a certification as the requirement has skipped two-thirds of the manual.

What the current matrix contains

The DoD publishes the qualification matrix as a spreadsheet. RoleMath has parsed version V2.1, effective 2025-09-19, into 327 qualification options covering 42 certifications across 44 work roles. It is a public download and needs no login.

Work roles are grouped into elements of the DoD Cyber Workforce Framework:

Workforce elementQualification options in the matrix
Cybersecurity138
IT (Cyberspace)87
Cyberspace Enablers68
Software Engineering13
Cyberspace Effects8
Intelligence (Cyberspace)7
Data/AI6

And each option is tied to a proficiency level, which is the part most summaries drop:

ProficiencyQualification options
Advanced157
Intermediate132
Basic38

A certification listed at Advanced proficiency for one work role does not carry to Basic proficiency in another. The pairing is the requirement, not the certification alone.

Which certifications appear most often

These are the certifications the matrix lists as a foundational option for the most work roles. Breadth here is not a ranking of difficulty or value — it means the credential is accepted against more roles.

CertificationWork roles it is listed for
GSEC25
Security+20
SecurityX / CASP+17
Cloud+15
CCSP15
GSLC14
SSCP14
CISM13
CCISO11
CISSP11
CySA+10
PenTest+10

Worked example: what Security+ actually covers

Security+ is the credential most often misdescribed, so here is exactly what the matrix says about it. It is listed as a foundational qualification option for 20 work roles, all at Intermediate proficiency:

Work role codeWork roleProficiency
411Technical Support SpecialistIntermediate
421Database AdministratorIntermediate
431Knowledge ManagerIntermediate
441Network Operations SpecialistIntermediate
451System AdministratorIntermediate
461Systems Security AnalystIntermediate
511Cyber Defense AnalystIntermediate
521Cyber Defense Infrastructure Support SpecialistIntermediate
531Cyber Defense Incident ResponderIntermediate
541Vulnerability Assessment AnalystIntermediate
612Security Control AssessorIntermediate
622Secure Software AssessorIntermediate
641Systems Requirements PlannerIntermediate
661Research & Development SpecialistIntermediate
671System Testing and Evaluation SpecialistIntermediate
722Information Systems Security ManagerIntermediate
751Cyber Workforce Developer and ManagerIntermediate
752Cyber Policy and Strategy PlannerIntermediate
802IT Project ManagerIntermediate
805IT Program AuditorIntermediate

Notice what this list is not. It is not a level. It is not a guarantee that a given contract will accept Security+ — components set their own additional requirements. And it is not sufficient on its own, because foundational qualification is one element of three.

How to check your own requirement

1. Find the work role code in the position description or the contract. It is a three-digit code such as 511 (Cyber Defense Analyst) or 451 (System Administrator).

2. Find the proficiency level the position requires — Basic, Intermediate or Advanced.

3. Look up that code and level in the current matrix and read the foundational options listed for it. A certification you already hold may qualify for one level and not another.

4. Ask the employing component about the resident qualification and continuing-education requirements, because those are set locally and the matrix does not contain them.

If someone cannot tell you the work role code, they cannot tell you the requirement.

The bottom line

If you are in a DoD civilian or military cyberspace workforce position, do not buy a certification to satisfy an 8570 information assurance level: DoDM 8140.03 incorporated and cancelled DoD 8570.01-M, and there is no crosswalk from an IAT or IAM level into it. Contractors are the exception, and it is the first thing to check — DFARS 252.239-7001 can still point your contract at DoD 8570.01-M, so read the clause in the contract before you conclude the levels cannot apply to you.

Buy against a work role. Get the code and the proficiency level from the position, check the current matrix (version V2.1, effective 2025-09-19) for the foundational options that pair with them, and confirm the resident-qualification and continuing-education expectations with the employer. Security+ remains the broadest single option for cybersecurity work roles at Intermediate proficiency, which is why it is on so many adverts — but it is one element of a three-part qualification, not the qualification itself.

Frequently asked questions

Did DoD 8140 replace DoD 8570?

Yes for the modern DoD cyberspace workforce qualification program. DoDM 8140.03 became effective on February 15, 2023 and states that it incorporates and cancels DoD 8570.01-M. Contractor contracts can still reference 8570 through DFARS 252.239-7001, so the exact authority matters.

Is Security+ still a DoD baseline certification?

RoleMath has local candidate rows showing Security+ mapped to IAT Level II and IAM Level I, but those rows are unverified candidate mappings. Verify the current official matrix or contract before relying on that mapping.

What happened to the old IAT and IAM levels?

They belong to DoD 8570.01-M, which is cancelled. DoDM 8140.03 does not use them and the DoD published no crosswalk, so a level cannot be translated into an 8140 equivalent. If a job advert still names one, ask for the work role code and proficiency level instead — that is what the current matrix is organised around.

Do contractors follow 8570 or 8140?

Check the contract. DFARS 252.239-7001 still says contractor personnel need proper and current information-assurance certification in accordance with DoD 8570.01-M. Other roles may be governed through 8140 work-role qualification.

Does a DoD baseline certification create a job or pay outcome?

No. A credential can satisfy a requirement only when the current official authority accepts it for that role and level. It does not create employment, access, interviews, personal pay, or a fixed timeline.

How does AI affect DoD 8570 or 8140 planning?

AI does not decide the policy source. It changes the proof bar around the work: candidates should show how they verify AI-generated alerts, commands, incident notes, checklists, diagrams, and summaries against official sources and real tool output.

Related, with the cited detail

Evidence behind this article

RoleMath turns this article into a small decision report: official credential facts, occupation context, and AI workflow evidence.

Mapped roles: IT Security Operations Specialist, Network Security Engineer, Cybersecurity Analyst, SOC Analyst, Help Desk Technician

Pay by metro

IT Security Operations Specialist maps to Information Security Analysts.
MetroMedian payCost-adjusted
San Jose, CA$176,120$159,496
Raleigh, NC$143,640$146,337
Seattle, WA$161,780$145,573
Network Security Engineer maps to Computer Occupations, All Other.
MetroMedian payCost-adjusted
San Jose, CA$184,430$167,021
Denver, CO$160,520$151,746
Lexington Park, MD$144,680$143,589

Occupation-level metro medians only; not credential salary, personal pay, or a placement claim. OEWS 2025-05 + BEA RPP 2024. Sources: U.S. Bureau of Economic Analysis Regional Price Parities, U.S. Bureau of Labor Statistics May 2025 OEWS Current Tables

AI impact context

  • IT Security Operations Specialist: roughly 24% of recorded usage looked like augmentation vs 76% automation-style (Anthropic Economic Index; usage signal, not a job-loss prediction). Sampled AI-language terms include Anthropic, LLM, OpenAI, machine learning. Descriptive Claude usage data, not employment demand, not job loss, and not a personal forecast; CC-BY attribution required.
  • Network Security Engineer: roughly 36% of recorded usage looked like augmentation vs 64% automation-style (Anthropic Economic Index; usage signal, not a job-loss prediction). Sampled AI-language terms include LLM. Descriptive Claude usage data, not employment demand, not job loss, and not a personal forecast; CC-BY attribution required.
  • Cybersecurity Analyst: roughly 24% of recorded usage looked like augmentation vs 76% automation-style (Anthropic Economic Index; usage signal, not a job-loss prediction). Sampled AI-language terms include Anthropic, OpenAI, machine learning. Descriptive Claude usage data, not employment demand, not job loss, and not a personal forecast; CC-BY attribution required.

Sources: Anthropic Economic Index report: Cadences (release 2026-06-26), Canaries in the Coal Mine - recent employment effects of AI (working paper), Felten Raj and Seamans - AI Occupational Exposure (AIOE) index, GPTs are GPTs: An early look at the labor market impact potential of LLMs (Science 2024), OECD Employment Outlook 2023 - Artificial Intelligence and the Labour Market

What we verified about these certifications

Certifications referenced in this evidence packet: Cisco Certified Network Associate; CompTIA A+; CompTIA CySA+; CompTIA Network+; CompTIA Security+; CompTIA SecurityX; ISC2 CISSP - Certified Information Systems Security Professional.

No certification shown here is treated as salary, job, ROI, or pass-rate proof. Sources: Cisco official credential page, CompTIA official credential page, CompTIA official credential page, CompTIA official credential page, CompTIA official credential page

Core source records

This table lists the page’s core content records and their checked dates where recorded. Claim-specific citations appear beside the relevant text and may not be repeated here.

IDSupportsSourceChecked
CIT-01DCWF work-role structure and proficiency levels.https://public.cyber.mil/wid/dcwf/Date not recorded
CIT-02Contractor requirements can still reference DoD 8570.01-M through contract language.https://www.acquisition.gov/dfars/252.239-7001-information-assurance-contractor-training-and-certificationDate not recorded
CIT-03DoD 8570.01-M is cancelled and DoDM 8140.03 governs cyber workforce qualification.https://dl.dod.cyber.mil/wp-content/uploads/cyber-workforce/pdf/unclass-dod-manual-8140_03.pdfDate not recorded
CIT-04The certification-to-work-role options, counts, proficiency levels and workforce elements on this page.https://dl.dod.cyber.mil/wp-content/uploads/8140/xls/(U)%202025-09-19_DoD8140MatrixV2.1.xlsxDate not recorded

Ready to turn this decision into a plan?

RoleMath planner