The baseline-certification era is over. Work roles, three qualification pathways, and deadlines that have already passed — how the new system works for programs and for your career.
For nearly two decades, DoD 8570.01-M defined cyber careers in the defense world: IAT and IAM levels, and a short list of baseline certifications — Security+, CISSP, CASP — that unlocked them. That era is over. The 8140 series (directive, instruction, and the 2023 qualification manual DoDM 8140.03) replaced it with the DoD Cyber Workforce Framework (DCWF) — and the compliance deadlines have now arrived.
| 8570 (old) | 8140 / DCWF (now) | |
|---|---|---|
| Unit of qualification | Position categories (IAT I–III, IAM I–III, IASAE) | 70+ DCWF work roles, each with a code |
| How you qualify | Baseline certification only | Three pathways: certification, education, or approved training |
| Depth | One level per position | Proficiency tiers per work role (basic / intermediate / advanced) |
| Source of truth | The old approved-certs chart | Qualification matrices on DoD Cyber Exchange (v2.1, Sept 2025) |
| Staying current | Cert CE cycles | Continuous professional development requirements |
February 15, 2025: civilian and military personnel in cybersecurity-element work roles had to be foundationally qualified under DoDM 8140.03. February 15, 2026: the requirement extended to the IT, cyber effects, intelligence, and enabler workforce elements — plus residential (environment-specific) qualification for the cybersecurity element. New hires get their own clocks: nine months to foundational qualification and twelve months to residential, from assignment date.
Contracts and task orders increasingly specify DCWF work-role codes instead of "IAT Level II." Your certifications still matter — but whether a given cert qualifies now depends on the work role's matrix entry, not the old chart. Security+ still appears widely at foundational tiers; advanced roles want more. When staffing cleared programs, the question changed from "is this person 8570 compliant?" to "is this person qualified for work role 461 at intermediate?" Check the matrix, not your memory.
The good news: certifications are no longer the only door. Degrees and approved training now count as qualification pathways, and hands-on experience finally has formal standing. The strategic move is to know your target work-role codes, qualify against them deliberately, and speak that language on your resume — teams staffing to 8140 search by work role. Pair that with a clearance and you're describing exactly what a program can bill you against. More on the clearance side in our clearance ladder guide.
This is the work we do every day. Tell us where your program stands and we'll give you a straight answer.
Talk to AusperThis site uses essential browser storage only. With your OK, we’d also use analytics cookies to understand which content is useful. No choice is required — “Essential only” changes nothing. Cookie policy