DoD 8570 and 8140 certifications: check the work role

Last updated 2026-08-13 — the article text's own revision date; dated evidence on this page carries its own check date. See the Citation Ledger at the foot for this page's sources.

If a job posting, supervisor or contract says you need an "8570" or "8140" certification, do not begin by shopping for a class. First ask which official authority governs the position, which DCWF work role applies and what proficiency level is required.

DoDM 8140.03 applies to military, civilian and contractor personnel assigned to DoD Cyber Workforce Framework work roles. It uses work-role and proficiency requirements, not the retired 8570 information-assurance levels. A contractor must also read the controlling contract because it may add DFARS 252.239-7001 language that still references DoD 8570.01-M. Before choosing a credential, confirm the exact work-role code, proficiency level, contract terms and current official matrix.

Next decision

Capture the position's work-role code, proficiency level, qualification route, deadline and approval owner before comparing Security+ schedules and prices. Build my DoD 8140 Security+ requirement brief.

Key takeaways

• DoD 8570.01-M is cancelled. DoDM 8140.03 replaced it, and there is no crosswalk between the two, so no certification satisfies an IAT or IAM level under 8140.
• Under 8140 you qualify for a specific work role at a specific proficiency level, not for a level.
• Learnerside re-read the public Matrix V2.1 workbook on 2026-08-13: 426 certification-option rows, 60 certification acronyms and 45 work-role codes. These counts describe the workbook, not demand or credential value.
• A certification satisfies the foundational element only. Resident on-the-job qualification and continuous professional development are separate requirements set by the employing component.
• Contract language is a separate question: DFARS 252.239-7001 can still reference DoD 8570.01-M for contractors, so check the contract as well as the manual.

Start with the position requirement, not a certification list

Before comparing Security+ classes or any other training, collect five non-sensitive facts: the DCWF work-role code, required proficiency level, accepted foundational route, the person or document that controls the requirement, and the date by which it must be met. A job posting that only says "8570 compliant" is not enough to make a current 8140 decision.

Ask the workforce manager, supervisor or contracting authority to confirm those facts in writing. Then compare training by course version, schedule, total price, labs, voucher terms, cancellation policy and who actually delivers the class. Keep classified, controlled and confidential job details out of a public planning tool.

What replaced DoD 8570

DoD 8570.01-M is cancelled. DoD Manual 8140.03 replaced it, and the two do not work the same way, which is why so much advice about this is wrong.

Under 8570 you qualified for an information assurance level — IAT Level II, IAM Level I and so on — and a certification mapped to a level. Under 8140 you qualify for a specific work role at a specific proficiency level, and a certification is one option for satisfying the foundational part of that qualification. There is no crosswalk between the two structures. The DoD did not translate IAT Level II into an 8140 equivalent, so nobody else can either.

That matters practically. If a job advert, a training provider or a chatbot tells you a certification "meets IAT Level II under 8140", it is describing a framework that no longer governs. The levels are real history, not current requirements.

How 8140 qualification actually works

Qualifying for a work role under DoDM 8140.03 has three parts, and a certification is only one of them:

• Foundational qualification. A certification, a degree, or completion of approved training. This is the part the certification matrix covers.
• Resident qualification. On-the-job qualification in the actual role, signed off by the employing component.
• Continuous professional development. Ongoing, with hours set by the component.

So passing an exam does not by itself complete work-role qualification. It can satisfy the foundational element for a particular role and proficiency; the other qualification elements and any component-specific requirements still need to be confirmed.

What the current matrix contains

The DoD publishes the qualification matrix as a spreadsheet. Learnerside re-read the public V2.1 workbook on 2026-08-13. Its Certification Repository contains 426 work-role, certification, and proficiency rows covering 60 certification acronyms across 45 work-role codes. The workbook identifies V2.1 as effective 2025-09-19.

Work roles are grouped into elements of the DoD Cyber Workforce Framework:

Each row is also tied to a proficiency level:

These are workbook-row counts, not people, openings, or a ranking of credentials. A certification listed at one proficiency for one work role does not become a universal qualification. The work-role, proficiency, and employing-component requirements must be read together.

Which certifications appear most often

These are the certification acronyms that occur against at least ten distinct work-role codes in the workbook checked 2026-08-13. Breadth is not a ranking of difficulty, quality, or career value.

Worked example: what Security+ actually covers

Security+ is the credential most often misdescribed, so here is exactly what the matrix says about it. It is listed as a foundational qualification option for 20 work roles, all at Intermediate proficiency:

Notice what this list is not. It is not a level. It is not a guarantee that a given contract will accept Security+ — components set their own additional requirements. And it is not sufficient on its own, because foundational qualification is one element of three.

How to check your own requirement

1. Find the work role code in the position description or the contract. It is a three-digit code such as 511 (Cyber Defense Analyst) or 451 (System Administrator).

2. Find the proficiency level the position requires — Basic, Intermediate or Advanced.

3. Look up that code and level in the current matrix and read the foundational options listed for it. For the same work role, a certification recorded at a higher proficiency also applies at lower proficiencies; the recorded level is not a ceiling. That cascade does not override component-specific or contract-specific requirements.

4. Ask the employing component about the resident qualification and continuing-education requirements, because those are set locally and the matrix does not contain them.

If the work-role code or proficiency is unclear, ask the requirement owner to resolve it before choosing training. Contractors should also ask the contracting authority to identify any additional controlling contract requirements. Do not assume a missing work-role code makes an explicit contract requirement inapplicable.

The bottom line

If you are military, civilian or contractor personnel assigned to a DCWF-coded position, do not buy a certification merely to satisfy an old 8570 information-assurance level. DoDM 8140.03 incorporated and cancelled DoD 8570.01-M. A contractor's controlling contract may additionally retain DFARS 252.239-7001 language that references DoD 8570.01-M.

Choose against the actual authority, not a generic baseline list. Get the work-role code and proficiency level, check the current official matrix for the foundational options paired with them, and confirm resident qualification, continuous professional development, and any component-specific requirements. Security+ appears against 20 work-role codes in the V2.1 workbook checked 2026-08-13, but that breadth does not make it the right or sufficient option for a particular position.

Frequently asked questions

Did DoD 8140 replace DoD 8570?

DoDM 8140.03 incorporated and cancelled DoD 8570.01-M for the DoD cyber workforce qualification program. It applies to military, civilian and contractor personnel assigned to DCWF-coded positions. A contractor's controlling contract may also retain DFARS 252.239-7001 language that references 8570, so both authorities must be checked.

Is Security+ still a DoD baseline certification?

In the Matrix V2.1 workbook checked 2026-08-13, Security+ appears against 20 work-role codes, each at Intermediate proficiency. That does not prove that a particular position or contract accepts it; verify the current matrix entry, contract, and component-specific requirements before relying on it.

What happened to the old IAT and IAM levels?

They belong to DoD 8570.01-M, which is cancelled. DoDM 8140.03 does not use them and the DoD published no crosswalk, so a level cannot be translated into an 8140 equivalent. If a job advert still names one, ask for the work role code and proficiency level instead — that is what the current matrix is organised around.

Do contractors follow 8570 or 8140?

Contractors assigned to DCWF-coded positions are within DoDM 8140.03's work-role qualification scope. Their controlling contract may additionally include DFARS 252.239-7001 language that references DoD 8570.01-M. Confirm the DCWF work-role and proficiency requirements, then read the contract for any additional obligation.

Does a DoD baseline certification create a job or pay outcome?

No. A credential can satisfy a requirement only when the current official authority accepts it for that role and level. It does not create employment, access, interviews, personal pay, or a fixed timeline.

Related, with the cited detail

• Build a DoD 8140 Security+ requirement brief
• DoD workforce training decision guide
• Which cybersecurity certification first?
• CompTIA Security+ overview
• What employers ask for