DoD 8140.01: Qualification Layers, Deadlines, and Certifications

DoD Directive 8140.01 requirements apply to anyone performing cyberspace work for the Department of Defense, and they boil down to this: your position gets coded to a specific work role and proficiency level, you have to meet foundational and residential qualifications for that role within set timelines, and you have to keep learning every year after that. The implementing manual, DoDM 8140.03, was signed on February 15, 2023, and the final department-wide compliance deadline for most workforce elements was February 2026.¹

Who Falls Under DoD 8140

Coverage is determined by what you do, not by your job title or pay system. If your position performs cyberspace work as identified in the DoD Cyber Workforce Framework, you fall under the directive whether you are a service member, a DoD civilian (including non-appropriated fund employees), a contractor, or a foreign national working for the department. The policy reaches across every pay system, from General Schedule to Cyber Excepted Service to the Defense Civilian Intelligence Personnel System.²

The framework organizes cyber work into seven workforce elements (cyberspace IT, cybersecurity, cyberspace effects, intelligence, cyberspace enablers, software engineering, and data/artificial intelligence) and 74 individual work roles.³ Every covered position gets mapped to one of those roles. That coding drives everything else: which qualifications you need, which timeline runs against you, and how your status is tracked.

Contractors work under a different rule than military and civilian employees. A contractor must meet the foundational qualification requirement before starting cyberspace work, not after. Residential (on-the-job) qualifications are not required of contractors unless the contract specifically says so.¹ Service members and civilians get time after assignment to become qualified; contractors do not.

The Two Layers of Qualification

To be considered fully qualified in your coded role, you need both a foundational qualification and a residential qualification. They cover different things.¹

Foundational Qualification

Foundational qualification proves you have the broad knowledge base for the role. You can satisfy it three ways, and any one is enough:

An accredited degree conferred within the past five years. If your degree is older but you have worked continuously in the relevant discipline since then, it still counts. Every work role at every level requires at least a high school diploma or equivalent; higher education thresholds vary by role and proficiency level.
An approved training program (one course or a set of courses) covering at least 70 percent of the core task and knowledge content for your role at your proficiency level, completed within the past five years, with the same continuous-work exception.
A professional certification accredited to ISO/IEC 17024 through a recognized body such as ANSI, with content aligned to at least 70 percent of the core tasks and knowledge areas for the role.

That flexibility is the meaningful change from the old 8570 program. Under 8570, you had to hold a specific certification. Under 8140, a relevant degree or approved training course can meet the foundational requirement instead of a certification.¹

Residential Qualification

Residential qualification is about demonstrating you can do the job in your actual environment. It centers on an on-the-job qualification process that covers the pertinent tasks and knowledge areas for your role. Individual DoD Components can add environment-specific pieces on top of that, such as familiarity with particular systems or command-specific procedures.¹

Proficiency Levels and Why They Matter

Every coded position carries one of three proficiency levels, and the level shapes what qualifies you.

Basic: you can apply fundamental concepts with frequent, specific guidance. You are still learning the role.
Intermediate: you have extensive knowledge and can handle non-routine situations with only periodic high-level guidance.
Advanced: you have deep expertise, work with little to no guidance, and serve as a resource for others.

The levels correspond to progressively higher cognitive demands. Basic-level workers remember and understand core concepts. Intermediate workers apply and analyze. Advanced workers evaluate and create.⁴ The level assigned to your position determines which foundational options and content thresholds apply to you, which is why a certification that qualifies you for a role at the basic level may not carry you at the intermediate or advanced level of the same role.

How Long You Have to Get Qualified

DoD civilians and service members assigned to a coded cyber work role must meet foundational qualification within nine months and residential qualification within twelve months. The two clocks run concurrently from the date of assignment, so both start the day you land in the position.¹

While you are working toward qualification, you can still perform your cyber duties, but only under the direct supervision of someone who is already qualified. If that supervision is not feasible and no waiver has been granted, you must be reassigned.¹

Beyond the individual timelines, the transition from 8570 to 8140 carried phased deadlines tied to workforce elements. Personnel in cybersecurity work roles had to be qualified within two years of February 15, 2023, meaning February 2025. All remaining workforce elements (cyberspace IT, cyberspace effects, intelligence, and cyberspace enablers) had a three-year deadline, putting full compliance at February 2026.¹

What Happens If You Miss the Deadline

If you fail to qualify within the stated timelines and no waiver is in place, you must be removed from duties associated with that work role.¹ In practice that can mean reassignment, loss of network access, or both.

Waivers exist, but they are intentionally hard to get. Only the head of a DoD Component or a delegated authority can grant one, and only under severe operational or personnel constraints. Each waiver requires written justification and a plan to resolve the underlying problem. Waivers cap at six months, with one exception: deployment to a combat environment pauses the clock until the person returns, and the six-month window begins at that point. Consecutive waivers for the same person are not allowed.¹

Continuing Professional Development

Full qualification does not end the process. Starting in the fiscal year after you complete both foundational and residential requirements, you owe a minimum of 20 hours per year of continuous professional development or education activities.¹

Qualifying activities are broad: coursework, seminars, workshops, cyber range exercises, webcasts, mentoring, self-study, passing professional exams, and publishing research all count. If you hold a professional certification with its own continuing education requirement, those credits count toward the 20-hour CPD minimum too, so you do not have to duplicate effort.¹

Paying for Your Certifications

DoD 8140 itself does not require the department to pay for your certifications, but several funding programs do.

Navy personnel can apply through Navy COOL for prepaid exam vouchers covering exam fees, recertification fees, and maintenance fees for approved credentials. Funding has to be approved before you take the exam, and Navy COOL does not cover training or study materials.⁵ Army personnel can use Credentialing Assistance, which as of March 2026 provides up to $2,000 per fiscal year for credential-related expenses including training, study materials, and exam fees. The combined total of Tuition Assistance and Credentialing Assistance cannot exceed $4,500 per fiscal year, and commissioned officers are no longer eligible for CA.⁶

For DoD civilian employees, funding for exam retests can be a matter of local bargaining between the agency and the relevant union.⁷ Specifics vary by Component and office, so check with your supervisor or Cyber Workforce Advisory Group representative about what your organization covers.

Finding the Right Certification for Your Role

The DoD publishes qualification matrices that map each of the 74 work roles to specific approved education programs, training courses, and personnel certifications at each proficiency level. They are available through the DoD Cyber Exchange and are updated as new certifications and training programs are evaluated.⁸ Check the current matrix for your specific work role and proficiency level before you pay for a certification or enroll in a course. Not every well-known credential aligns with every role, and a certification that fits one role at one level may not fit the same role at a higher level.

Keep your own records as you go: certification credentials, training completion documents, and education transcripts. Official tracking happens in DoD manpower systems, but when you move to a new command or contract, having the paperwork on hand keeps your qualification status from lapsing during the transition.

1
Department of Defense Chief Information Officer. DoDM 8140.03 – Cyberspace Workforce Qualification and Management Program
2
Department of Defense Cyber Exchange. DoD 8140 Cyber Workforce Qualification Program (CWQP)
3
Department of Defense Chief Information Officer. Cyber Workforce Framework
4
DoD Cyber Exchange. DoD 8140 Proficiency Levels SOP
5
Navy Credentialing Opportunities On-Line (COOL). Costs and Funding
6
Army Credentialing Assistance – DoD COOL. Costs and Funding – Credentialing Assistance
7
Cyber Exchange. DoD 8140 FAQ
8
Cyber Exchange. DoD 8140 Qualification Matrices