DoD 8140 Certification Requirements: Pathways, Levels, and Deadlines

The DoD 8140 certification requirements chart is not one chart but a set of qualification matrices published on the DoD Cyber Exchange, and each matrix lists the approved certifications, degrees, and training programs for a specific cyber work role at a specific proficiency level.¹ To find what you need, you look up your assigned DoD Cyber Workforce Framework (DCWF) work role code, find your proficiency level, and read across the columns. There are 74 work roles in total, so the answer for a Cyber Defense Analyst (Code 511) is not the answer for a Systems Security Analyst (Code 461).²

How To Look Up Your Requirements

Start with your work role code. Your supervisor or human resources office can confirm which of the 74 DCWF codes applies to your position; every DoD position that involves cyberspace work is coded to one or more roles, and the code drives the qualification requirement.³

Once you have the code, pull the matrix from the DoD Cyber Exchange and find that role. Read across the columns for your proficiency level to see the approved certification, education, and training options. A blank cell means no option has been identified yet at that level, though a qualification approved at a higher level will satisfy a lower level’s requirement. Cells marked “TBD” mean the option is still being validated and may appear in a future update.¹

Before you enroll in any certification course or training program based on the chart, check with your organization’s workforce management office. Individual DoD components can impose requirements beyond what the matrix shows, and the matrices themselves are updated periodically.

The Three Qualification Pathways

The columns in the matrix reflect three pathways, and you only need to satisfy one to meet the foundational requirement for your role.⁴

The first is a commercial personnel certification — CompTIA Security+, CySA+, CISSP, and similar credentials — that has been mapped to your specific work role and proficiency level. The certification’s content must cover at least 70 percent of the core tasks and knowledge areas for that role.

The second is education: a post-secondary degree from an accredited institution in a discipline relevant to your work role. There is no blanket rule that a bachelor’s automatically covers one level or a master’s another; degree requirements are evaluated role by role in the matrix.

The third is a DoD-approved training program, either a single course or a series of courses, that covers at least 70 percent of the core task and knowledge content for the role at the appropriate proficiency level.

Proficiency Levels on the Chart

Every work role is split into three proficiency levels, and the level attached to your position determines which row of the matrix applies to you.⁴

Basic: familiarity with core concepts, applied with frequent, specific guidance.
Intermediate: extensive knowledge, performs in non-routine situations with periodic high-level guidance.
Advanced: in-depth understanding, works with little to no guidance, serves as a resource for others.

A qualification approved at the Advanced level counts at the Intermediate and Basic levels for the same role, but a Basic qualification does not roll up.⁵ Proficiency is tied to the position, not to rank or pay grade — a GS-12 civilian and an E-6 service member in the same role at the same level face identical requirements.

The Chart Only Covers Foundational Qualification

What the matrices show is the foundational qualification: proof of baseline knowledge. To be fully qualified in your work role, you also need residential qualification, which is on-the-job training covering the pertinent tasks and knowledge for the role, plus a formal period of supervised engagement before you’re cleared for unsupervised work.⁴ The certification proves you studied the material; the residential period proves you can apply it.

Documented work experience can substitute for foundational qualification, but only in limited circumstances: federal civilian employees who were already in a coded cyberspace position when DoDM 8140.03 took effect, or situations where no qualifying education, training, or certification exists yet for a role and level combination. Experience is a safety valve, not a general fallback.⁴

Rules That Affect What Counts

A degree used for foundational qualification must have been conferred within the past five years by an accredited institution. Older degrees still count, but only if you can demonstrate continuous work in a cyberspace role with no more than three consecutive years of lapse. Your component sets the process for documenting and verifying that continuity.⁴

DoDM 8140.03 recommends, though does not require, that components look to institutions holding the NSA Centers of Academic Excellence in Cybersecurity (NCAE-C) designation when evaluating education credentials.⁶

Contractors face a stricter rule than uniformed and civilian personnel: they must be fully qualified at the foundational level before starting work, with no grace period to earn credentials on the job. The contract’s performance work statement must identify the applicable DCWF work role and proficiency level. Contractors are generally not required to complete residential qualification unless the sponsoring component specifically requires it and the contract explains how.⁴

Deadlines and Consequences

The rollout is phased. The cybersecurity workforce element had the earliest deadlines. By February 15, 2026, all remaining workforce elements — cyberspace IT, cyberspace effects, intelligence (cyberspace), and cyberspace enablers — must meet both foundational and residential qualification requirements, and components must report on these elements through DoD 8140 key performance indicators.⁴

Miss the deadline and the consequence is concrete. Civilian employees and service members who fail to qualify for their assigned work role within stated timelines must be removed from duties associated with that role unless a component head grants a waiver. While working toward qualification, personnel can temporarily perform the role’s duties under direct supervision of a qualified individual. If direct supervision isn’t feasible and no waiver is granted, the person is reassigned.⁴

Keeping a Certification Current

The chart tells you what to earn. Keeping it is a separate obligation, and letting a certification lapse can knock out your foundational qualification and trigger the same removal-from-duties consequences.

CompTIA certifications, including Security+, CySA+, and PenTest+, renew on a three-year cycle through continuing education units and a renewal fee that runs from $75 for entry-level credentials like A+ up to $150 for most security-focused certifications.⁷ ISC2 credentials, including CISSP, SSCP, and CCSP, carry an annual maintenance fee of $135, due each year on the anniversary of the certification date.⁸ DoDM 8140.03 also requires continuous professional development once foundational and residential qualifications are complete, with the specifics set by your component.

Record every credential against your personnel file as soon as you earn it. Validation moves through agency databases and human resources systems on its own timeline, and a lag between earning a credential and having it recorded can flag you as non-compliant during an audit. Keep your certificates, transcripts, and training completion records in a form you can produce quickly.

1
Cyber Exchange. DoD 8140 Qualification Matrices
2
DoD COOL. DCWF Workforce Identification and Coding Guide
3
U.S. Department of Defense Chief Information Officer. Cyber Workforce Framework
4
DoD Chief Information Officer. DoDM 8140.03 Cyberspace Workforce Qualification and Management Program
5
DoD Cyber Exchange. DoD 8140 Proficiency Levels SOP
6
National Security Agency. National Centers of Academic Excellence in Cybersecurity
7
CompTIA. Continuing Education Renewal Fees
8
ISC2. ISC2 Annual Maintenance Fees – Frequently Asked Questions