DoD 8570 is dead. It’s been dead for a while. Its passing was slow and drawn out. Even today you’ll find instructors and training schools waxing lyrical about 8570 compliance, 8570 certifications, and IAM levels I, II, and III. But DoD 8570 hasn't been the governing policy for years. It was replaced by DoD 8140, a more granular and flexible scheme. 8140 is designed to be more task-focused, less certification-oriented, and allows for relevant experience to be considered. DoD 8140 is better.
DoD Manual 8140.03, “Cyberspace Workforce Qualification and Management Program,” replaced 8570 back in February 2023. If your team's training plan is still built around the old Information Assurance (IA) categories, it isn't just outdated; it's misaligned with how the Department qualifies people today. And, unlike a lot of policy updates, this one comes with a real timeline attached: DoD civilian employees and Service members assigned to a covered cyberspace work role have 9 months to reach foundational qualification and 12 months to reach resident, on-the-job qualification. Miss the window without an approved waiver, and that person is removed from their work role duties.
This isn't a paperwork exercise. It's an operational deadline with a personnel consequence. It's the kind of thing that turns “we should probably look into training” into a budgeted, scheduled priority.
What actually changed from 8570 to 8140
The old system sorted people into four broad Information Assurance categories, IAT, IAM, IASAE, and CND, and matched each one to a static table of approved certifications. If you held the right cert, you were compliant, full stop.
DoD 8140 works differently. Instead of a generic IA level, every covered position is mapped to a specific role in the DoD Cyber Workforce Framework (DCWF), such as Cyber Defense Analyst, Cyber Defense Incident Responder, Systems Security Analyst, and dozens of others. Each work role has its own foundational and resident qualification requirements, spelled out in the current Qualification Matrix (Version 2.1, effective September 19, 2025). This is part of the reason it’s taking time for IT schools to adjust to the new system. It was much easier to tell clients; you just need Security+ than to explain how their training programs mapped to specific tasks.
The distinction between the two systems matters more than it sounds like it should. Two people who both carried an “IAT Level II” badge under 8570 might now sit in completely different DCWF work roles under 8140, with different qualification paths and different approved credentials. A training pla
n built on the old category system isn't just dated, it can actively misroute people into the wrong qualification track.
The qualification clock, and what missing it actually costs
Here's the part that should get a training coordinator's attention. Per DoD M8140.03, Section 4.2, DoD civilian employees and Service members assigned to a cyberspace work role must achieve foundational qualification within 9 months and resident qualification within 12 months of that assignment. Miss it, and that person is removed from the work role, unless they are granted a waiver.
Waivers exist, but they're not easy to get. Waivers are capped at 6 months (with a narrow exception for personnel deployed to a combat environment), and consecutive waivers for the same person aren't authorized. A missed deadline must be resolved, not just extended indefinitely.
There's a second clock worth knowing about, separate from the individual one: DoD M8140.03 also set hard organizational deadlines. DoD Components had until February 15, 2025 (two years from the manual's effective date) to have every civilian and service member in the cybersecurity workforce element fully qualified. They had until February 15, 2026 (three years out) to do the same for personnel across the other four workforce elements (IT, cyberspace effects, intelligence, and cyber enabler).
Both of those dates have now passed. As of today, the entire DoD cyberspace workforce should already be operating under full 8140 qualifications. If your organization hasn't re-mapped positions from the old 8570 categories yet, you're behind a deadline that's already come and gone.
Who this actually applies to
Scope is where a lot of confusion creeps in, so it's worth being precise, and it's also where the timeline isn't uniform.
DoD civilian employees and Service members follow the 9-month / 12-month clock described above.
Contracted support personnel follow a different standard. Contractors must meet foundational qualification requirements at the commencement of cyberspace work and are not required to meet resident qualification requirements at all, unless the specific contract calls for it. For training coordinators managing a mixed civilian, military, and contractor workforce, that means tracking two different qualification clocks and knowing which applies to which person.
The workforce itself is organized into five elements: cybersecurity, cyberspace IT, cyberspace effects, intelligence (cyberspace), and cyberspace enabler. Which element a position falls under determines both its DCWF work role mapping and, historically, which of the two implementation deadlines above applied to it.
What to do this quarter
None of this requires a massive overhaul. It requires a specific, finite set of actions:
- Remap every covered position to its current DCWF work role, not its legacy 8570 IA category, using the current Qualification Matrix.
- Identify anyone inside their 9-month or 12-month window, and separately, confirm which contractors have met foundational qualification at commencement of work as required.
- Cross-reference existing training against 8140's actual requirements. A course that satisfied an 8570 requirement doesn't automatically satisfy the equivalent 8140 work-role requirement.
- Budget for continuing professional development, not just initial qualification. DoD 8140 requires a minimum of 20 hours per year of CPD to maintain a qualified work role, on top of any continuing-education requirements tied to a specific certification (CISSP's 3-year CPE cycle, CompTIA's 3-year renewal, and so on).
- Loop in procurement early if training will be sourced through a GSA Schedule vendor, especially now that the organizational implementation deadlines have already passed and any remaining gaps are compliance-overdue, not just upcoming.
The deadline doesn't wait for the training plan
DoD 8140 replaced 8570 with a system that's more complex and precise yet provides more flexibility for learned experience and specialization within the industry. The complexity makes it harder for training companies to explain how a student navigates DoD requirements, but as we learn to map 8140 to a role it forces us to better understand DoD requirements at a more granular level.
Coordinators still planning against the old 8570 categories are working from a map that stopped matching the territory years ago, and the Department's own implementation deadlines for full compliance have already passed. Mapping to the new system is harder than it was but it isn't complicated: remap positions to current DCWF work roles, confirm qualification status against the current matrix, and budget training accordingly for both civilian/military personnel and contractors under their respective clocks. It just needs to happen now, not eventually.
If you're not sure where your team stands against current 8140 requirements, that's worth a short conversation before it becomes an audit finding. And if you're an individual DoD civilian, service member, or contractor trying to figure out your own qualification path, TrainACE's DoD 8140-aligned courses map to DCWF work roles.
Leave Your Comment Here