What Is DoD 8140? Classification, Qualification, and Deadlines

DoD Directive 8140 is the Department of Defense policy that governs how every person in a cyber-related job — military, civilian, or contractor — is identified, qualified, and managed. If your position is coded to a cyber work role, 8140 sets the education, training, certifications, and on-the-job requirements you have to meet, the deadlines for meeting them, and what happens if you don’t.

What 8140 Replaced and Why It Changed

The prior standard, DoD 8570.01-M, focused almost entirely on information assurance. It mapped a short list of approved certifications to broad categories like Information Assurance Technician Levels I, II, and III. Hold the right certification for your category, and you were compliant.

8140 works differently in two ways. It defines the workforce by what people actually do, mapping each position to a specific work role with its own knowledge, skills, and abilities. And it offers multiple paths to qualification instead of one certification checkbox: education, approved training, or an accredited personnel certification, plus on-the-job requirements after you arrive in the role.¹ The goal, in DoD’s own phrasing, is demonstration of capability rather than proof that you passed a test.

DoDM 8140.03, released in February 2023, formally cancelled the old 8570 manual for military and civilian personnel. There is no direct crosswalk between the two programs. Certifications you earned under 8570 may still count, but only if the credential is current, actively maintained under the issuing organization’s renewal rules, and mapped to your assigned work role and proficiency level. “Good for Life” certifications that never required renewal are not valid under 8140.¹

How Your Position Gets Classified

Before you can figure out what qualifications you need, you need to know how your position is coded. That comes from the DoD Cyberspace Workforce Framework, or DCWF, which organizes every cyber-related position into seven workforce elements and 74 distinct work roles.²

The seven elements are Cyber IT, Cybersecurity, Cyberspace Effects, Intelligence (Cyber), Cyber Enablers, Software Engineering, and Data/Artificial Intelligence. Software Engineering and Data/AI are newer additions reflecting the expanding definition of cyber work.³ Within those elements, individual work roles get specific. A Cyber Defense Analyst and a Vulnerability Assessment Analyst both fall under Cybersecurity, but their duties and qualification requirements differ.

Every position coded to a work role also carries a proficiency level: Basic, Intermediate, or Advanced.⁴

Basic: Familiarity with core concepts and the ability to apply them with frequent, specific guidance.
Intermediate: Extensive knowledge of core concepts, handling non-routine situations with only periodic high-level guidance.
Advanced: Deep expertise, working with little or no guidance, often leading teams or developing new procedures.

The level is fixed to the billet, not the person. A slot coded Intermediate requires Intermediate-level qualifications no matter who fills it. Your work role and proficiency level together tell you which row of the DoD’s qualification matrix to read.⁵

How You Qualify

Qualification has two stages that run at the same time: foundational qualification and resident qualification.⁶

Foundational Qualification

This proves you have the baseline knowledge for your work role and proficiency level. You satisfy it through any one of three options.

Education is the first. A high school diploma or equivalent is required at minimum for all work roles at all proficiency levels, and many roles require more. When a degree is used to satisfy foundational qualification, it generally must have been conferred within the past five years, unless you can show continuous work in the relevant field.⁶

Training is the second: approved training programs, whether a single course or a series, covering at least 70 percent of the core task and knowledge content for your role at the applicable proficiency level.

The third option is a personnel certification. It must be industry-recognized and accredited to the ISO/IEC 17024 standard through a body such as ANSI or the National Commission for Certifying Agencies, and its content must align with at least 70 percent of the core tasks and knowledge areas for your role.

There is also an experience-based alternative. If you have been performing the actual tasks of a work role in a DoD environment, documented experience can substitute for the three standard options. This prevents a long-serving specialist from being forced to earn an entry-level certification after a paperwork move into a differently coded billet.

The DoD Cyber Exchange hosts the official qualification matrices, which list the exact certifications, training programs, and degrees that satisfy each work role at each proficiency level. That site is the authoritative reference and is updated as new credentials get approved.⁵

Resident Qualification

Resident qualification happens once you are in the position. It consists of on-the-job qualification — a structured period of supervised work in your assigned role — plus any environment-specific requirements your component adds. A qualified colleague observes and documents your performance until you can work unsupervised. The length and structure vary by work role, proficiency level, and organizational context.⁶

Deadlines and What Happens If You Miss Them

Military service members and DoD civilians have nine months from assignment to a cyber work role to meet foundational qualification, and twelve months to complete resident qualification. Both clocks start the day you begin the position and run concurrently.⁷

While you are working toward qualification, you can perform the role’s duties under the direct supervision of someone already qualified. If you miss the deadline without a waiver, you must be removed from the duties associated with the work role and reassigned. Waivers exist, but only an OSD or component head can grant one, and only when severe operational or personnel constraints justify it.⁶

A Cyber Workforce Program Manager or direct supervisor reviews submitted credentials for authenticity and relevance before workforce management systems get updated, and regular audits verify that records stay current.

Rules for Contractors

Contractors do not get the nine-month grace period. Under DoDM 8140.03, contracted support personnel must meet foundational qualification requirements at the time they begin cyberspace work. They have to arrive ready.⁶

Contractors are not required to complete resident qualification unless the contracting organization specifically writes it into the contract. There is one regulatory wrinkle to know about: the DFARS clause that enforces contractor certification requirements, 252.239-7001, still references the old 8570 standard.⁸ Until the Defense Federal Acquisition Regulation Supplement is updated, contractors technically remain under 8570 for contractual compliance, and in practice should be prepared to satisfy both frameworks depending on how their contract is written.

Position descriptions for civilian jobs that still reference 8570 should be updated, but the paperwork does not exempt anyone. New hires and current civilian employees must meet 8140 qualifications regardless of what the position description says.

Keeping Your Qualification Current

Qualifying once is not the end. After you achieve resident qualification, you must complete a minimum of 20 hours of Continuous Professional Development each year, starting in the fiscal year after you qualify. If your certification’s own renewal rules require more than 20 hours, the higher number applies.¹

CPD activities can include formal training courses, conference attendance, academic coursework, and similar professional development. Every hour must be documented in the appropriate workforce management system. Letting a certification lapse or falling behind on CPD hours can put you back in the same position as someone who never qualified: supervised duty or reassignment until you catch up.

Paying for Certifications

Several DoD programs help cover the cost of the certifications 8140 relies on. Which one applies depends on your branch and status.

The Army Credentialing Assistance program funds courses, exam fees, study materials, and recertification costs for credentials that lead to industry-recognized civilian certifications. As of March 2026, all Credentialing Assistance requests require supervisor or commander approval through ArmyIgnitED, and commissioned officers are no longer eligible.⁹

The Navy Credentials Program Office covers eligible credentialing exam fees, recertification fees, and maintenance fees for enlisted personnel. Funding has to be approved before you take the exam or enroll. The Navy program does not cover training, study materials, or exam preparation materials.¹⁰

The Air Force COOL program provides up to $4,500 in lifetime funding per airman for credentialing costs. Eligibility requires holding a 5 skill level in the relevant Air Force Specialty Code, passing the most recent fitness test, and supervisor approval.

Veterans and GI Bill beneficiaries have a separate route. The VA reimburses licensing and certification test fees up to $2,000 per test, with no limit on the number of tests, and pays for tests you fail. To claim reimbursement, submit VA Form 22-0803 after paying for the test, along with proof of payment. The test must be VA-approved, though you can submit an application for review if yours is not already on the list.¹¹

1
DoD Cyber Exchange. DoD 8140 Cyber Workforce Qualification Program
2
DoD CIO. Cyber Workforce Framework
3
Cyber Exchange. DoD Cyber Workforce Framework
4
DoD Cyber Exchange. DoD 8140 Proficiency Levels SOP
5
Cyber Exchange. DoD 8140 Qualification Matrices
6
Department of Defense Chief Information Officer. DoDM 8140.03 – Cyberspace Workforce Qualification and Management Program
7
Cyber Exchange. DoD 8140 FAQ
8
Acquisition.GOV. 252.239-7001 Information Assurance Contractor Training and Certification
9
Army COOL. Costs and Funding – Army Credentialing Assistance
10
Navy COOL. Navy COOL – Costs and Funding
11
U.S. Department of Veterans Affairs. Licensing and Certification Test Reimbursement