Skip to content
8140 Compliance
CertificationsWork rolesMapperTimelineFor teams

DoD 8140 · DoDM 8140.03 · DCWF

STATUS: ACTION REQUIRED

Nine months to qualify.
Then they come off the role.

DoDM 8140.03 replaced DoD 8570 with work-role qualification built on the DoD Cyber Workforce Framework — 74 work roles, seven workforce elements, and a hard rule: newly assigned personnel reach foundational qualification within 9 months, or they're removed from the role. Find the certification your role requires, and beat the clock.

Find the cert for your roleCertify your whole team
Readiness statesQUALIFIED meets the requirementGAP a cert is neededAT-RISK deadline passed

The 8140 clock

How long do you have to get qualified?

Under DoDM 8140.03, DoD civilian and military personnel newly assigned to a cyber work role must achieve foundational qualification within 9 months of assignment (and resident, on-the-job qualification within 12 months). The clock restarts with every new assignment, so the requirement is continuous — and without an approved waiver, someone who misses the window comes off the role.

See the full timelineCheck my role →
  1. 01
    Dec 2005SUPERSEDED

    DoD 8570.01-M takes effect

    Legacy: Information Assurance Workforce Improvement Program

    The old program defined broad baseline certifications by functional level — IAT, IAM, and IASAE Levels I-III. These terms still appear in job postings and contracts today, but the policy has been superseded.

  2. 02
    Feb 2023IN EFFECT

    DoDM 8140.03 is issued

    Cyberspace Workforce Qualification and Management Program

    Effective 15 February 2023, DoDM 8140.03 replaced 8570.01-M with work-role-based qualification built on the DCWF, introduced Basic/Intermediate/Advanced proficiency, and established the 9-month foundational qualification clock.

  3. 03
    15 Feb 2025PASSED

    Cybersecurity element qualification deadline

    DCWF Cybersecurity workforce element

    Per DoDM 8140.03 Para 4.3.a.(1)(a) — within two years of the manual's effective date — all DoD civilians and Service members in Cybersecurity work roles had to be qualified. Grandfather waivers tied to this element (e.g., the CCNA Security waiver) expired the same day. Positions still citing 8570 had to move to 8140 work-role qualification.

  4. 04
    15 Feb 2026PASSED

    Remaining elements qualification deadline

    Cyberspace IT, Effects, Intelligence, Enablers

    Per DoDM 8140.03 Para 4.3.a.(1)(b) — within three years of the effective date — the IT, Effects, Intelligence, and Enabler elements reached their qualification deadline. (The manual's two- and three-year clauses do not separately name Software Engineering and Data/AI; confirm their schedule with your component.)

  5. 05
    ContinuousALWAYS ON

    The 9-month clock — for everyone newly assigned

    All DCWF work roles, ongoing

    Every DoD civilian or Service member newly assigned to a cyber work role has 9 months to reach foundational qualification (12 months for resident qualification), then at least 20 hours of continuous professional development per year to stay qualified. Contractor obligations continue to flow through DoD 8570 until the DFARS is updated to incorporate 8140 — so today's contracts still commonly require Security+ and other 8570 baselines.

By certification

Which certification do you need?

Start from the credential. Each page lists the DCWF work roles it satisfies and links to exam-ready practice on CertifHub.

View all certifications →
SY0-701Foundational

CompTIA Security+

The broadest-coverage baseline security certification. Under 8570 it satisfied IAT Level II and IAM Level I; under 8140 it remains a qualifying foundational option across many DCWF cybersecurity and IT work roles.

View role coverage
CS0-003Intermediate

CompTIA CySA+

A behavioral-analytics and threat-detection certification aimed at security operations and incident analysis roles — a common 8140 option for cyber defense work.

View role coverage
CAS-005Advanced

CompTIA SecurityX (formerly CASP+)

CompTIA's advanced, hands-on practitioner certification — rebranded from CASP+ to SecurityX. It maps to a wide range of advanced DCWF roles and the old 8570 IAT III / IAM II / IASAE tiers.

View role coverage
PT0-003Intermediate

CompTIA PenTest+

A penetration-testing and vulnerability-assessment certification covering planning, scanning, exploitation, and reporting — relevant to assessment-focused DCWF roles.

View role coverage
CISSPAdvanced

ISC2 CISSP

A broad, advanced information-security management certification. Across ISC2's portfolio, CISSP is accepted for a large share of DCWF work roles — particularly management, assessment, and architecture roles.

View role coverage
CISMAdvanced

ISACA CISM

Certified Information Security Manager — a management-tier certification mapping to oversight and security-management DCWF work roles.

View role coverage
CCNAFoundational

Cisco CCNA

Cisco Certified Network Associate — a foundational networking certification that DoD documents as a qualifying option for network and IT-support work roles at the Basic/Intermediate levels.

View role coverage
N10-009Foundational

CompTIA Network+

A foundational networking certification covering network implementation, operations, and security — relevant to IT and network-operations DCWF roles.

View role coverage

By work role

Find your DCWF work role

The DCWF organizes 74 work roles across seven workforce elements. Pick your role to see its accepted baseline certifications.

View all work roles →
CybersecurityCyberspace ITCyberspace EffectsCyberspace IntelligenceCyberspace EnablersSoftware EngineeringAI/Data

Cybersecurity

7 roles

Builds, secures, operates, and defends DoD systems — the element with the broadest certification overlap and the earliest 8140 enforcement.

Cyber Defense Analyst6 baseline certs511Cyber Defense Incident Responder4 baseline certs531Vulnerability Assessment Analyst4 baseline certs541Cyber Defense Infrastructure Support Specialist3 baseline certs521Security Control Assessor4 baseline certs612Information Systems Security Manager (ISSM)4 baseline certs722Information Systems Security Officer (ISSO)3 baseline certs—

Cyberspace IT

6 roles

Designs, builds, configures, and operates the IT systems and networks the mission runs on.

Systems Administrator4 baseline certs451Network Operations Specialist3 baseline certs441Database Administrator2 baseline certs421Technical Support Specialist5 baseline certs411Systems Developer2 baseline certs632Knowledge Manager1 baseline cert431

Cyberspace Effects

5 roles

Plans and executes offensive and defensive cyberspace operations to project power in or through cyberspace.

Exploitation Analyst4 baseline certs121Mission Assessment Specialist4 baseline certs112Target Developer4 baseline certs131Target Network Analyst4 baseline certs132Cyberspace Operator4 baseline certs—

Cyberspace Intelligence

6 roles

Collects, analyzes, and produces intelligence in and about the cyberspace domain.

All-Source Analyst4 baseline certs111Warning Analyst5 baseline certs141Multi-Disciplined Language Analyst0 baseline certs151All-Source Collection Manager2 baseline certs311All-Source Collection Requirements Manager2 baseline certs312Cyber Intelligence Planner3 baseline certs331

Cyberspace Enablers

5 roles

Acquisition, legal, training, and leadership roles that enable the cyber mission.

Cyber Legal Advisor0 baseline certs731Cyber Instructional Curriculum Developer0 baseline certs711Cyber Workforce Developer and Manager0 baseline certs751Cyber Policy and Strategy Planner0 baseline certs752Program Manager0 baseline certs801

Software Engineering

5 roles

Designs, develops, and sustains secure software and the systems that depend on it.

Software Developer0 baseline certs621DevSecOps Specialist0 baseline certs627Software/Cloud Architect0 baseline certs628Systems Security Analyst3 baseline certs461Secure Software Assessor2 baseline certs622

AI/Data

4 roles

Data science, data operations, and artificial intelligence roles — the newest additions to the DCWF.

Data Scientist0 baseline certs423Data Analyst0 baseline certs422Artificial Intelligence / Machine Learning (AI/ML) Specialist0 baseline certs623Data Architect0 baseline certs653

For individuals

You personally need to qualify

A contractor or service member with a 9-month clock. Map your work role to the certification that satisfies it, then get exam-ready with CertifHub practice exams.

Open the DCWF Cert Mapper

For teams & buyers

You're accountable for a whole team

An FSO, training director, or program manager keeping people billable. Uncertified heads are a compliance risk and lost billing. Get managed team readiness with periodic reporting.

Certify your team

Questions, answered

DoD 8140 frequently asked questions

What is DoD 8140 and how is it different from DoD 8570?
DoD 8140 is the current cyberspace workforce policy series (DoDD 8140.01, DoDI 8140.02, DoDM 8140.03). It replaced DoD 8570.01-M, moving from broad baseline-certification levels (IAT/IAM/IASAE I-III) to granular qualification by DCWF work role and proficiency level (Basic/Intermediate/Advanced). There is no one-to-one crosswalk between the two programs; your existing certification may carry over depending on your assigned work role and proficiency.
How long do I have to get qualified under 8140?
DoDM 8140.03 gives DoD personnel newly assigned to a cyber work role 9 months to achieve foundational qualification. Without an approved waiver, someone who does not qualify within that window is removed from the role. The clock restarts with each new assignment.
Does my old Security+ (or other 8570 cert) still count?
Often, yes — DoD states that certifications earned under 8570 may carry over to 8140 depending on the work role and proficiency level assigned to your position, provided the certification is current. Security+ remains one of the broadest qualifying certifications. Confirm your specific work role's accepted options in the DoD 8140 Qualification Matrix.
I'm a contractor — am I under 8570 or 8140?
Contractor personnel remain under DoD 8570 policy until the Defense Federal Acquisition Regulation Supplement (DFARS) is updated to authorize 8140 implementation for contractors. In practice that means many contracts still require 8570 baselines like Security+ (IAT II) today, while the workforce transitions to 8140 — so the certifications you need now largely overlap.
Which certification should an individual start with?
For most defensive cybersecurity roles, CompTIA Security+ (SY0-701) is the highest-leverage starting point: it satisfied 8570 IAT Level II and remains a qualifying foundational option for many DCWF cybersecurity roles at the Basic/Intermediate level. Use the DCWF Cert Mapper to match your specific work role.