Skip to content
8140 Compliance
CertificationsWork rolesMapperTimelineFor teams

Compliance timeline

DoD 8140 deadlines — and the clock that never stops

The phased element deadlines have passed, but 8140 qualification is continuous: every new assignment starts a fresh 9-month clock. Here's the full sequence.

Have the DoD 8140 deadlines passed?

Yes. Under DoDM 8140.03, the Cybersecurity workforce element had to be qualified by 15 February 2025 (within two years of the manual's effective date), and the Cyberspace IT, Effects, Intelligence, and Enabler elements by 15 February 2026 (within three years). Both dates are now past — and the rolling 9-month rule means new assignees are coming due all the time.

Under DoDM 8140.03, DoD civilian and military personnel newly assigned to a cyber work role must achieve foundational qualification within 9 months of assignment (and resident, on-the-job qualification within 12 months). The clock restarts with every new assignment, so the requirement is continuous — and without an approved waiver, someone who misses the window comes off the role.

Find my role's certGet a team compliant
  1. 01
    Dec 2005SUPERSEDED

    DoD 8570.01-M takes effect

    Legacy: Information Assurance Workforce Improvement Program

    The old program defined broad baseline certifications by functional level — IAT, IAM, and IASAE Levels I-III. These terms still appear in job postings and contracts today, but the policy has been superseded.

  2. 02
    Feb 2023IN EFFECT

    DoDM 8140.03 is issued

    Cyberspace Workforce Qualification and Management Program

    Effective 15 February 2023, DoDM 8140.03 replaced 8570.01-M with work-role-based qualification built on the DCWF, introduced Basic/Intermediate/Advanced proficiency, and established the 9-month foundational qualification clock.

  3. 03
    15 Feb 2025PASSED

    Cybersecurity element qualification deadline

    DCWF Cybersecurity workforce element

    Per DoDM 8140.03 Para 4.3.a.(1)(a) — within two years of the manual's effective date — all DoD civilians and Service members in Cybersecurity work roles had to be qualified. Grandfather waivers tied to this element (e.g., the CCNA Security waiver) expired the same day. Positions still citing 8570 had to move to 8140 work-role qualification.

  4. 04
    15 Feb 2026PASSED

    Remaining elements qualification deadline

    Cyberspace IT, Effects, Intelligence, Enablers

    Per DoDM 8140.03 Para 4.3.a.(1)(b) — within three years of the effective date — the IT, Effects, Intelligence, and Enabler elements reached their qualification deadline. (The manual's two- and three-year clauses do not separately name Software Engineering and Data/AI; confirm their schedule with your component.)

  5. 05
    ContinuousALWAYS ON

    The 9-month clock — for everyone newly assigned

    All DCWF work roles, ongoing

    Every DoD civilian or Service member newly assigned to a cyber work role has 9 months to reach foundational qualification (12 months for resident qualification), then at least 20 hours of continuous professional development per year to stay qualified. Contractor obligations continue to flow through DoD 8570 until the DFARS is updated to incorporate 8140 — so today's contracts still commonly require Security+ and other 8570 baselines.

Definitions

DoD 8140 terms, defined

Tight, quotable definitions of the terms that decide whether you're compliant.

DoD 8140
DoD 8140 is the U.S. Department of Defense's cyberspace workforce policy series (DoDD 8140.01, DoDI 8140.02, and DoDM 8140.03) that qualifies and manages every cyber position in the DoD by work role.
DCWF
The DoD Cyber Workforce Framework (DCWF) is the catalog of cyber work roles — each with a definition, tasks, and knowledge/skills/abilities — that DoD 8140 uses to qualify personnel. It spans seven workforce elements and 74 work roles.
Foundational qualification
Foundational qualification is the baseline you must reach to perform a DCWF work role — satisfied through an approved certification, training, education, or in some cases experience, as listed in the DoD 8140 Qualification Matrix for your role and proficiency level.
The 9-month rule
Under DoDM 8140.03, DoD civilian employees and Service members newly assigned to a cyber work role must achieve foundational qualification within 9 months of assignment (and resident/on-the-job qualification within 12 months); without a waiver, someone who does not qualify in time is removed from the role.

Questions

Deadlines & qualification FAQ

Have the DoD 8140 deadlines already passed?
Yes. Per DoDM 8140.03, the Cybersecurity workforce element had to be qualified within two years of the 15 February 2023 effective date (by 15 February 2025), and the Cyberspace IT, Effects, Intelligence, and Enabler elements within three years (by 15 February 2026). Both dates are now in the past, so positions must already be qualified.
What is the 9-month rule?
DoDM 8140.03 requires DoD civilian and military personnel newly assigned to a cyber work role to achieve foundational qualification within 9 months of assignment (and resident, on-the-job qualification within 12 months). Without an approved waiver — which must expire within 6 months and cannot be consecutively renewed — they are removed from the role.
How do you stay qualified after the deadline?
Qualification is not one-and-done. After meeting foundational and resident qualification, personnel complete a minimum of 20 hours of continuous professional development (CPD) per year, beginning the fiscal year after both are achieved, and keep any certifications current per the provider's rules.