DoD sources checked 7 November 2026
DoD 8140 and Security+ in 2026: what it means for your DoD job
DoD 8140 is the Defense Department’s program for qualifying its cyber workforce, and its manual, DoDM 8140.03, replaced the old 8570 manual on 15 February 2023. CompTIA Security+® still counts: version 3.0 of the DoD 8140 qualification matrix lists it for 30 work roles. Under 8140, though, a certification is one part of being qualified, and the level it covers depends on your work role.
- DoDM 8140.03 effective 15 Feb 2023
- Security+ listed for 30 work roles
- 9 months to qualify
- 20 hours of development a year
Written by the SecurityMocks team with AI assistance and checked against the sources below. Last reviewed 7 November 2026. This page explains public DoD documents; it isn’t compliance advice. Confirm your work role’s requirements with your command, supervisor or contracting officer.
What is DoD 8140?
DoD 8140 in one paragraph
DoD 8140 is a policy series, not a single rule. A directive sets up the framework, an instruction says how cyber positions are coded and tracked, and the manual says how people in those positions get qualified. The manual “incorporates and cancels” DoD 8570.01-M, so 8570 is no longer current policy. Since Executive Order 14347 (September 2025), the department may also use the secondary title Department of War, so the CIO’s office now publishes as the DoW CIO; the 8140 documents keep their DoD names.
How the DoD 8140 documents fit together
- DoDD 8140.01: the cyber workforce and its framework
- DoDI 8140.02: code and track positions
- DoDM 8140.03: qualify the people
- Qualification matrix: options per work role
What is the DoD Cyber Workforce Framework?
The DCWF is the department’s standard list of cyber work roles, each with a three-digit code, used to code every cyber position. A position can carry up to three work role codes, each at a proficiency level: basic, intermediate or advanced. The DoW CIO’s framework page groups the work roles into seven workforce elements.
- Cyberspace IT
- Cybersecurity
- Cyberspace effects
- Intelligence (cyberspace)
- Cyberspace enablers
- Software engineering
- Data and AI
DoD 8140 requirements
How you qualify under DoD 8140
Each work role has a qualification matrix. To be qualified, DoD civilians and service members must meet both the foundational and the resident requirements for their work role at its assigned level, then keep up continuous professional development (CPD).
-
Get designated
You’re coded to a work role and level. Guidance effective 1 September 2026 says both qualification clocks start when you receive a DoD 8140 letter of designation.
-
Foundational: 9 months
Meet one option from the matrix: a listed degree, approved training or a listed certification such as Security+. Experience is a conditional alternative.
-
Resident: 12 months
On-the-job qualification is always required, plus any environment-specific training your component sets. It runs at the same time as step 2.
-
CPD: 20 hours a year
From the fiscal year after you qualify, at least 20 hours of professional development a year. CE you earn for a certification counts toward it.
For now, the guidance leaves issuing the letter of designation to each component. Contractors are different: DoDM 8140.03 says they must meet the foundational requirement when they start cyber work, and need resident qualification only if the contract says so. Waivers for civilians and service members are capped at six months, with a narrow exception for combat deployments, and consecutive waivers aren’t allowed.
- Feb2025Deadline in DoDM 8140.03 for the cybersecurity workforce element to be qualified: two years after the manual took effect.
- Feb2026Deadline for the IT, cyber effects, intelligence and enabler elements: three years after, on 15 February 2026.
- 70%How much of a work role’s core task and knowledge, skills and abilities (KSA) content a certification must cover to be listed in its matrix.
- 5yrsMaximum age of a degree or approved training used to qualify, unless continuous cyber work can be shown.
DoD 8140 certification list
Where Security+ fits in DoD 8140
The DoD 8140 qualification matrix version 3.0, dated 5 October 2026, lists Security+ as a certification option for 30 work roles. The level shown is the highest it meets; the manual says a certification approved at a higher level also counts at the lower levels of that role.
| Code | Work role | Element | Security+ meets |
|---|---|---|---|
411 | Technical Support Specialist | IT | Basic |
431 | Knowledge Manager | IT | Basic |
441 | Network Operations Specialist | IT | Basic |
641 | Systems Requirements Planner | IT | Basic |
671 | System Testing and Evaluation Specialist | IT | Basic |
421 | Database Administrator | IT | Intermediate |
451 | System Administrator | IT | Intermediate |
661 | Research and Development Specialist | IT | Intermediate |
461 | Systems Security Analyst | Software engineering | Intermediate pending validation |
511 | Cyber Defense Analyst | Cybersecurity | Intermediate |
521 | Cyber Defense Infrastructure Support Specialist | Cybersecurity | Intermediate |
531 | Cyber Defense Incident Responder | Cybersecurity | Intermediate |
541 | Vulnerability Assessment Analyst | Cybersecurity | Intermediate |
612 | Security Control Assessor | Cybersecurity | Intermediate |
622 | Secure Software Assessor | Cybersecurity | Intermediate |
722 | Information Systems Security Manager | Cybersecurity | Intermediate |
Cyber enabler roles: listed up to advanced
The matrix also lists Security+ at the advanced level for these 14 roles, which it files under cyber enablers. Most other common IT certifications appear on these rows too.
- 211 Forensics Analyst
- 221 Cyber Crime Investigator
- 711 Cyber Instructional Curriculum Developer
- 712 Cyber Instructor
- 731 Cyber Legal Advisor
- 732 Privacy Compliance Manager
- 751 Cyber Workforce Developer and Manager
- 752 Cyber Policy and Strategy Planner
- 801 Program Manager
- 802 IT Project Manager
- 803 Product Support Manager
- 804 IT Investment/Portfolio Manager
- 805 IT Program Auditor
- 901 Executive Cyber Leader
Version 3.0 moved five roles down to basic
The v3.0 change log moves Security+ from intermediate to basic for roles 411, 431, 441, 641 and 671. The September 2026 guidance says your foundational requirements stay tied to the matrix version in effect when your qualification clock started.
CompTIA’s list is shorter and undated
CompTIA’s framework page lists 20 work roles for Security+, including COMSEC Manager (723), which v3.0 doesn’t list for it. The “30 work roles” it mentions covers all seven CompTIA certifications, not Security+ alone. Where the two differ, go by the DoD matrix.
No exam code in the matrix
The matrix names the certification, not an exam version. Army COOL lists both SY0-701 and SY0-801 for Security+ and marks it approved for the 8140 program.
DoD 8570 vs 8140
Old IAT and IAM levels vs 8140 work roles
We found no public DoD crosswalk from the 8570 IAT and IAM levels to 8140 work roles. DoDM 8140.03 doesn’t mention those levels at all, the DCWF coding guide leaves crosswalks to individual components, and the 8570 baseline list now sits behind a DoD sign-in. The DoD’s 8140 FAQ says only that all 8570 certifications carried over and were aligned to the appropriate work role and proficiency level.
| 8570-era idea | What DoD 8140 uses instead |
|---|---|
| A category and level, such as “IAT II” | A DCWF work role code (up to three per position), each with a proficiency level: basic, intermediate or advanced. |
| One baseline certification list | A qualification matrix for each work role, with education, training and certification options and a conditional experience alternative. |
| Holding the certification | Foundational qualification plus on-the-job resident qualification, for DoD civilians and service members. |
| Keeping the certification’s CE | CE is still needed to keep the certification current, and at least 20 hours of CPD a year is added on top; CE earned for a certification counts toward the CPD. |
| DFARS clause 252.239-7001 in contracts | Removed by a DFARS class deviation that took effect on 1 February 2026. Components must make sure contractors meet the requirements for their DCWF work roles and update contracts. |
| 8570-approved certifications | All carried over, each aligned to a work role and proficiency level. |
The May 2026 memo says more detailed implementation guidance for contractors is still being developed, so check your contract and ask your contracting officer how the requirements apply to you.
Decision table
“My job ad says…”: is Security+ enough?
Find the closest wording to your job ad. Answers come from the v3.0 matrix and DoDM 8140.03; your component or contract can add requirements on top.
| The ad says | Is Security+ enough? | What else you need |
|---|---|---|
| “IAT Level II” or “8570 compliant” | Can’t tell yet That’s 8570 wording, which DoDM 8140.03 doesn’t use. | Ask HR or the recruiter for the DCWF work role code and proficiency level, then find that row in the matrix. |
| Cybersecurity role 511, 521, 531, 541, 612, 622 or 722 at basic or intermediate | Yes for the foundational part. | On-the-job qualification within 12 months (civilians and military), then 20 hours of CPD a year. |
| One of those roles at advanced | No Security+ isn’t listed at advanced for them. | Another listed option, such as CySA+ (511, 531, 541, 612), CISSP or CISM (612, 722) or CISSP-ISSEP (521, 612, 622). |
| IT role 421, 451 or 661, up to intermediate | Yes | Resident qualification and CPD, as above. |
| IT role 411, 431, 441, 641 or 671 at basic | Yes | Resident qualification and CPD. |
| IT role 411, 431, 441, 641 or 671 at intermediate | Not in v3.0 unless your clock started under an earlier matrix. | Ask your cyber workforce program manager which matrix version applies, or pick an option listed at intermediate. |
| Enabler role, such as 801 Program Manager or 802 IT Project Manager | Yes up to advanced. | Resident qualification and CPD. |
| Contractor: “must meet DoDM 8140.03 for work role X” | Check row X in the matrix. | Have it on day one. Resident qualification only if the contract requires it. |
Security+ CE for DoD
Keeping Security+ active for DoD 8140
Two clocks run at once: CompTIA’s three-year renewal cycle and the DoD’s yearly CPD hours. CompTIA says a DoD role needs the CE requirements met to stay compliant.
- 50CEUs to renew Security+ in each three-year cycle, according to DoD COOL and CompTIA.
- 3yrsHow long Security+ stays valid from the date you earn it before it must be renewed.
- 20hrsMinimum CPD a year under DoDM 8140.03. Your Security+ CE counts toward it.
- 2011CompTIA says the DoD hasn’t recognized good-for-life certifications since 1 January 2011.
Missing CPD resets your qualification
The September 2026 guidance voids foundational qualification if you skip your annual CPD or are re-coded to a different work role or level. You then requalify against the current matrix.
Your CE fee may be covered
CompTIA says DoD components can buy CE tokens in bulk for employees. The fee itself is $150 per three-year cycle (checked 7 November 2026). Ask your manager or component point of contact.
Printable checklist
Checklist for new DoD hires and contractors
Six things to settle in your first weeks. Each one maps to a requirement in DoDM 8140.03 or the September 2026 guidance.
- Get your work role codes and levels in writing
- Note your letter of designation date
- Find your rows in the current matrix
- Confirm your foundational option
- Ask how resident qualification is run
- Plan 20 CPD hours and your CE dates
Contractors: also ask your contracting officer which work roles and levels the performance work statement names, and whether it requires resident qualification. The DoD 8140 FAQ says DoD components shouldn’t pay for contractors to get or keep required certifications.
On a deadline
How to prepare for Security+ fast
Nine months sounds like plenty until a start date or a contract is waiting. If Security+ is your foundational option, aim to book the exam well inside your window.
-
Take a baseline
Sit a free Security+ practice test cold, in exam mode, to see your weakest domains.
-
Fix the gaps
Work through practice questions by domain, starting with the lowest bar.
-
Rehearse the real thing
Use full-length SY0-801 practice exams: 90 questions, 90 minutes, PBQs first.
-
Book it
Pass 750 on two different mocks, then book. Check Security+ exam cost and vouchers first.
SY0-801 is expected to launch on or around 17 November 2026, and SY0-701 retires in English on 11 June 2027. See SY0-801 vs SY0-701 to choose, our Security+ study plan for a week-by-week schedule, and the CompTIA certification path if your role needs CySA+ next.
FAQ
DoD 8140 and Security+ questions
What is DoD 8140?
DoD 8140 is the Defense Department’s policy series for identifying, tracking and qualifying its cyber workforce. Its manual, DoDM 8140.03, took effect on 15 February 2023 and cancelled the 8570 manual. Each cyber position is coded to a work role and proficiency level, and each work role has its own list of qualifying options.
Does Security+ meet DoD 8140 requirements?
For many roles, yes. Version 3.0 of the DoD 8140 qualification matrix lists Security+ for 30 work roles: at basic or intermediate for IT, cybersecurity and software engineering roles, and at advanced for cyber enabler roles. It covers only the foundational part; DoD civilians and service members also need on-the-job qualification.
What is the difference between DoD 8570 and 8140?
8140 codes each position to a work role and proficiency level instead of an 8570 category and level. It accepts education, training or certification for each role, and adds on-the-job qualification and 20 hours a year of professional development. The DoD says every 8570 certification carried over to 8140.
What is an IAT Level II certification now?
IAT Level II is an 8570 label, and DoDM 8140.03 doesn’t use it. The DoD says 8570 certifications were aligned to 8140 work roles and levels, but the public 8140 documents include no IAT-to-work-role crosswalk. If an ad asks for IAT II, ask which work role and level the position is coded to.
Is CISSP IAT Level III?
IAT Level III is also an 8570 label, so under 8140 the answer depends on the work role. Version 3.0 of the matrix lists CISSP at advanced for roles such as Security Control Assessor (612) and Information Systems Security Manager (722). Check the row for your own work role and level.
How long do I have to get qualified under DoD 8140?
DoD civilians and service members have 9 months for foundational qualification and 12 months for resident qualification, running at the same time. Guidance effective 1 September 2026 says both start when you’re issued a DoD 8140 letter of designation. Contractors must meet the foundational requirement when they start cyber work.
Checked 7 November 2026
Sources
DoD, DoD COOL and CompTIA pages, fetched on that date. The DoD Cyber Exchange pages that DoDM 8140.03 points to now ask for a DoD sign-in, so we read the same documents on the DoW CIO’s public site.
- DoDM 8140.03, Cyberspace Workforce Qualification and Management Program (effective 15 February 2023; the same file is in the DoD 8140 document library)
- DoD 8140 FAQ, DoW CIO Workforce Innovation Directorate
- DoD 8140 document library (matrix v3.0 posted 23 October 2026)
- DoD 8140 qualification matrix v3.0 (spreadsheet, dated 5 October 2026)
- DoD 8140 qualification matrix v3.0 change logs (spreadsheet)
- DoD 8140 Supplemental Guidance for Cyber Workforce Management v1.1 (effective 1 September 2026)
- DoW CIO memo: Implementation of cyberspace workforce policy requirements for contractors (27 May 2026)
- Sample DCWF work role qualification matrix
- DCWF Military and Civilian Workforce Identification and Coding Guide v1.6 (August 2025)
- Department Cyber Workforce Framework (DCWF)
- Executive Order 14347, Restoring the United States Department of War (5 September 2025)
- Army COOL: CompTIA Security+ (updated 2 November 2026)
- DoW Civilian COOL: CompTIA Security+
- CompTIA: certifications alignment to work role frameworks
- CompTIA: Department of Defense (DoD) CE information
- CompTIA: continuing education renewal fees
- CompTIA: Security+ renewal, 50 CEUs
Need Security+ for a DoD role?
Start with free Mock Test 1 in exam mode. Your domain bars show where to spend the time you have before your deadline.
