DoD 8140 approved certifications: why there is no single list anymore
On this page
Short answer
There is no longer one master list of “DoD 8140 approved certifications.” DoD 8140 replaced the fixed baseline chart from DoD 8570 with a qualification matrix organized by work role. Your certification only counts if it is listed for the specific work role your position is coded to — so the only answer that matters is the one you look up for your own role code.
CompTIA Security+ remains one of the most widely accepted certifications across foundational roles, which is why it is still the default first step for most people entering a DoD cyber position.
What actually changed from 8570 to 8140
If you have searched this topic before, you have probably seen a tidy grid with rows labeled IAT Level I, IAT Level II, IAM Level III and so on, each listing three or four certifications. That grid came from DoD 8570.01-M. It was simple, it was easy to republish, and it is no longer the governing structure.
The replacement framework — the DoD Cyber Workforce Qualification and Management Program, issued as DoD Manual 8140.03 — works differently in three ways that matter to you:
- Positions are coded to work roles, not levels. Instead of “IAT Level II,” a position is coded to a work role from the DoD Cyber Workforce Framework (DCWF) — something like Cyber Defense Analyst or Systems Administrator, each with its own identifier.
- Certification is one qualification path, not the only one. The manual recognizes education, training, certification and demonstrated experience. A certification is often the fastest path, but it is no longer structurally the only one.
- The approved options differ per work role. Two people in the same office can need different certifications, because their positions are coded to different roles. This is the single most common source of confusion — and the reason a blog list cannot answer your question.
Do not trust a copied list — including this page
Qualification matrices are updated. Any page that hands you a static table of “approved certs” is a snapshot of the day it was written, and most of them do not say which day that was. Use the official DoD Cyber Exchange matrix as the source of truth, and treat everything else — this article included — as orientation only. At the time of writing the current foundational qualification matrix is v2.1, effective 19 September 2025; check the version on the page against that before you rely on anything here.
How to find the answer for your own role
This takes about ten minutes and it is the only version of this task worth doing:
- Get your work role from your position description or your security manager. Do not guess it from your job title — titles and DCWF role codes frequently disagree, and the code is what the requirement attaches to.
- Look the role up in the qualification matrix on the DoD Cyber Exchange, which publishes the current qualification matrices.
- Check the proficiency level. Roles are qualified at basic, intermediate and advanced levels, and the accepted certifications differ between them.
- Confirm in writing with your security manager or contracting officer before you buy anything. On a contract, the requirement that binds you is the one written into the contract — which can be stricter than the baseline framework, and sometimes still cites 8570 language out of habit.
Where Security+ sits in all this
Security+ survived the transition well. It appears as an accepted option across a wide range of foundational work roles, it has no formal experience prerequisite, and it is vendor-neutral — which is why it remains the most common entry point into a DoD cyber position and why contractors keep listing it in job postings.
Two practical consequences that people discover too late:
| What people assume | What is actually true |
|---|---|
| “Security+ covers me for any cyber role.” | It covers a lot of foundational roles. Analyst, engineering and advanced roles frequently require something else on top, or instead. |
| “Once I pass, I am done.” | Security+ expires after three years. You renew through CompTIA’s continuing-education program or by passing a current exam — and the qualification only holds while the certification is active. |
The timing problem nobody warns you about
If a job offer or a clearance action is contingent on qualification, the constraint is rarely the exam itself — it is the sequence. Scheduling, taking the exam, and waiting for a result takes real calendar time, and a failed first attempt adds a full retake price plus more delay. That is why people in this situation care much more about what a second attempt costs than about saving twenty dollars on study material.
Bottom line
- Stop looking for “the 8140 list.” Look up your work role, at your proficiency level, in the current matrix.
- Confirm the requirement in writing with your security manager before you pay for an exam.
- Security+ is still the highest-leverage first certification for most people entering a DoD cyber position — just verify it is the right one for your role code rather than assuming.
Security+ question bank — join the waitlist
We are writing an adaptive Security+ bank now, built from the official exam objectives. Leave an email and we will tell you when it opens. Nothing else.
Keep reading
- How hard is Security+, really?Security+ is not technically deep — it is wide, and it assumes networking knowledge nobody tells you about. Here is what actually makes it hard, including the question format most people meet for the first time on exam day.
- How long does it take to study for Security+?Most people need six to twelve weeks for Security+, but the number of weeks is the wrong thing to plan around. Here is what actually determines the timeline, and the readiness signal that replaces counting.
- Network+ or Security+ first? A decision, not a ruleYou can take Security+ without Network+ — there are no prerequisites. Whether you should depends on one thing: how comfortable you are with networking fundamentals right now.