DoD 8140 and Security+: What Changed From 8570 (2026)

🕖Est. Reading Time: 16 minutes

Short answer: Security+ still counts under DoD 8140 for about 20 work roles, mostly at the Intermediate level. But 8140 changed how qualification works, and Security+ is only one piece of it. This guide explains what changed from 8570, which roles accept Security+, and how to check your own position.

I wrote this because I noticed a group of readers from government and defense networks working through our Security+ practice tests in order. I build Security+ study material; I’m not a DoD workforce manager. For this guide I went through the official DoD CIO, DoD Cyber Exchange, and CompTIA sources, and where I couldn’t confirm something, I say so.

Studying for Security+ right now? Start with our free Security+ practice tests organized by domain and subdomain.

Try our FREE CompTIA Security+ Practice Tests

What DoD 8140 is (and what happened to DoD 8570)

If you’ve been around government IT for a while, you probably learned the old system first. Under DoD 8570, positions fell into categories like IAT (Information Assurance Technical), IAM (Information Assurance Management), and IASAE, each with Levels I through III. Security+ famously satisfied IAT Level II, which is a big reason so many people in and around the military already have it.

That system is no longer policy. DoD Manual 8140.03, “Cyberspace Workforce Qualification and Management Program,” was signed on February 15, 2023, and it cancelled DoD 8570.01-M (DoD CIO, Cyber Workforce Development).

DoD 8140 is really a policy series, not one document. DoD Directive 8140.01 establishes the DoD Cyber Workforce Framework (DCWF), DoD Instruction 8140.02 covers how cyber positions are identified, tracked, and reported, and DoD Manual 8140.03 sets the qualification requirements. The manual is the part most learners care about, because it decides whether your certification counts.

You’ll also see “Department of War” and “DoW” on newer official pages, including the DoD CIO’s own cyber workforce site. Same department, same program. The policy is still referred to as DoD 8140.

DoD 8570 vs 8140: what actually changed

The biggest change is what the requirement attaches to.

Under 8570, the question was “Is this cert approved for IAT Level II?” Under 8140, the question is “Is this cert approved for my position’s work role, at my position’s proficiency level?”

The DCWF defines those work roles. Each one has a three-digit code (511 is Cyber Defense Analyst, 722 is Information Systems Security Manager, and so on) plus a list of tasks and KSAs (knowledge, skills, and abilities). Every cyber position is coded to a work role and a proficiency level: Basic, Intermediate, or Advanced. That coding belongs to the position, not to you, which is why two people with the same job title can end up with different requirements.

The scope is also much wider. 8570 was about the information assurance workforce. According to the DoD CIO, the DCWF now brings cyber IT, cybersecurity, cyber effects, cyber intelligence, cyber enablers, data and AI, and software engineering under one framework (DoD CIO).

	DoD 8570 (old)	DoD 8140 (current)
Governing document	DoD 8570.01-M	DoDM 8140.03, signed February 15, 2023
How jobs are grouped	IAT, IAM, IASAE, CSSP categories	DCWF work roles with three-digit codes
Levels	Level I, II, III	Basic, Intermediate, Advanced, set per work role
How you qualify	An approved baseline certification	A foundational option (education, training, or certification) plus residential, on-the-job qualification
Scope	Information assurance workforce	IT, cybersecurity, cyber effects, intelligence, enablers, data/AI, software engineering

One thing to know if you’re coming from the old system: there’s no official crosswalk from “IAT Level II” to an 8140 work role. A certification you earned under 8570 can still count, but only if it’s current and approved for your specific work role and level. The new codes aren’t renamed IAT levels, so don’t try to translate one into the other.

How DoD 8140 qualification works

This is where a lot of people get tripped up, so it’s worth slowing down. Qualification under 8140 has three pieces, and Security+ only covers the first one.

Foundational qualification. For each work role and proficiency level, DoD lists options in three areas: education, training, and personnel certification. You need one of them. For some roles, documented experience can serve as a conditional alternative (DoD CIO, sample work role qualification matrix). This is where Security+ lives.

Residential qualification. This is the on-the-job part. You show you can do the work in your actual mission environment, and your DoD component decides what that looks like. DoD marks it as always required, regardless of which foundational option you used.

Continuous professional development. This starts once you’ve finished both of the above. Training providers commonly describe the annual requirement as at least 20 hours of professional development, or whatever your certification’s own maintenance requires. Your component’s guidance is what counts here, so confirm the number with them.

Then there’s timing. Under DoDM 8140.03, DoD civilians and service members have nine months to meet foundational qualification and twelve months to meet residential qualification after being assigned to a coded position, and the two clocks run at the same time. The DoD CIO’s Supplemental Guidance for Cyber Workforce Management V1.1, effective September 1, 2026, ties the start of those clocks to the DoD 8140 letter of designation.

Contractors work differently. DoDM 8140.03 says contracted personnel must meet foundational qualification when they start the cyber work, and they don’t have to meet residential requirements unless the contract says so.

One more rule that matters a lot for exam planning: an option approved at a higher proficiency level also counts for the lower levels of the same work role. It never works the other way. If your position is coded Advanced, an Intermediate-level certification won’t cover it.

Where DoD 8140 stands in late 2026

Short version: the main foundational deadlines have passed, contractors were formally moved off 8570 this year, and the official qualification matrix is on version 2.1.

Deadlines. DoD rolled 8140 out in phases. Civilians and service members in the cybersecurity workforce element had to be qualified by February 15, 2025. The cyberspace IT, cyberspace effects, intelligence (cyberspace), and cyber enabler elements followed on February 15, 2026 (Cisco, citing the DoD timeline). Training providers such as SANS and GIAC list the residential qualification deadlines one year later for each group (February 15, 2026 and February 15, 2027) (GIAC). If you’re newly assigned to a coded position today, what matters is your own nine- and twelve-month clocks.

Contractors. This was the big change in 2026. For years, contractor requirements still pointed back to 8570 through DFARS clause 252.239-7001. A May 27, 2026 DoW CIO memo explains that a DFARS class deviation, effective February 1, 2026, removed the references to DoD Directive 8140.01, DoD 8570.01-M, and that clause. The memo directs DoD components to make sure contractor cyber personnel meet the qualification requirements of their DCWF work roles. In practice, that means your contract or task order is the document to read. It should be updated to name the work roles and proficiency levels you’re expected to meet.

The qualification matrix. The official list of what counts for each work role is the DoD 8140 Foundational Qualification Matrix. The current version is V2.1, effective September 19, 2025, and it covers the IT, cybersecurity, and cyber enabler work roles. DoD’s 8140 content now lives in the DoD 8140 Document Library on cyberworkforce.mil, and the older cyber.mil 8140 pages are reported to be sunsetting at the end of 2026. Bookmark the cyberworkforce.mil version.

Why Security+ comes up so often

I think there are two reasons, one historical and one practical.

The historical one is 8570. Security+ was the go-to IAT Level II certification for years, so a whole generation of government IT staff, hiring managers, and contract writers got used to seeing “Security+ required” in job descriptions. Habits like that don’t disappear just because the policy number changed.

The practical reason is that Security+ still covers an unusually wide spread of 8140 work roles. CompTIA says Security+ was one of the first certifications approved under 8140 and that it mapped to 20 different work roles, which it describes as among the highest of any certification or training option (CompTIA). A third-party reading of Qualification Matrix V2.1 lists Security+ at the Intermediate level for 19 work roles (CyberExperts).

That Intermediate placement matters more than it looks. Because a higher-level option also covers the lower levels of the same role, Security+ satisfies both Basic and Intermediate positions in those roles. So if you don’t yet know exactly which work role you’ll be coded into, or you expect to move between roles, Security+ is a sensible default. That flexibility is what keeps it at the top of so many lists.

Now the honest caveat. Security+ is not a universal 8140 pass. Positions coded Advanced generally need something else (CySA+, CISSP, or CISM, for example, depending on the role), and some work roles don’t list Security+ at all. If your position is coded Advanced, Security+ may still be a useful stepping stone for learning, but it won’t close the requirement on its own.

Which work roles typically accept Security+

I’m going to stay general here on purpose, because the answer for your position depends on its exact code and level. Both CompTIA’s DCWF alignment page and the V2.1 matrix list Security+ across roughly four clusters of work:

IT operations: Technical Support Specialist (411), Knowledge Manager (431), Network Operations Specialist (441), System Administrator (451)
Cyber defense: Cyber Defense Analyst (511), Cyber Defense Infrastructure Support Specialist (521), Cyber Defense Incident Responder (531), Vulnerability Assessment Analyst (541)
Assessment and security management: Security Control Assessor (612), Secure Software Assessor (622), Information Systems Security Manager (722)
Planning and program roles: Systems Requirements Planner (641), System Testing and Evaluation Specialist (671), Cyber Policy and Strategy Planner (752), IT Project Manager (802), IT Program Auditor (805)

If you’re a SOC analyst, a sysadmin, or a junior ISSO-type person on a DoD network, there’s a good chance your position falls into one of those buckets.

One thing I noticed while cross-checking: CompTIA’s page and the third-party matrix breakdown don’t agree on every role. A few roles appear on one list but not the other. That’s not a reason to panic. It’s a reason to treat the official matrix as the only source that settles your specific case.

Here’s how I’d check:

Ask your supervisor or cyber workforce program manager for your position’s primary work role code, any additional work roles, and the proficiency level for each.
Open the current Qualification Matrix from the DoD 8140 Document Library.
Find your work role and check whether Security+ is listed at your level or higher.
If it isn’t, look at the other options listed for that role before you spend money on a voucher.

Practical notes for government and contractor learners

Which Security+ exam version to take

Right now the bookable exam is SY0-701. CompTIA’s next version, Security+ V8 with exam code SY0-801, is expected to launch on or around November 17, 2026 (CompTIA Security+ V8). Several training providers report that CompTIA has set the English SY0-701 retirement for June 11, 2027, which would give you about seven months where both versions are available.

So which one should you take? If you’re already studying for SY0-701 and can realistically test before mid-2027, I’d stay with it. Switching to a brand-new exam mid-study usually costs more time than it saves, and early on there are fewer study materials for a new version. If your realistic test date is after June 2027, plan for SY0-801 from the start.

As far as I can tell, the 8140 matrix lists the Security+ certification itself, not a specific exam code. Either version earns you the same credential, valid for three years. Still, if your position is under a deadline, confirm with your workforce manager before you book. Also note that vouchers are tied to a specific exam version, so check which one you’re buying.

Keeping Security+ active

This part gets less attention than it should. A lapsed certification no longer counts toward your foundational qualification, so passing the exam is only the start.

Security+ is valid for three years from the date you pass. To renew through continuing education, CompTIA requires 50 CEUs (continuing education units) within that three-year cycle (CompTIA). There’s also an annual CE fee, which training sites list as $50 per year. Confirm the current amount in your CompTIA account. Some activities you’re probably already doing can count, including documented security work experience and relevant training. You can also renew by earning certain higher-level certifications.

If you’re in a coded DoD position, keep your CompTIA record and your organization’s records in sync. The 8140 reporting systems only know what someone has entered.

Talk to your workforce manager before you start

I know this sounds obvious, but a 15-minute conversation can save you weeks. Ask:

What’s my position’s work role code (or codes), and at what proficiency level?
Which foundational option does the organization expect or pay for? Some commands and agencies have voucher or training programs.
What does residential qualification look like here, and what’s my deadline?
For contractors: what does my contract or task order say about 8140 requirements?

The answers decide whether Security+ is the right certification for you at all, or just the first of two.

A Security+ study path that fits a busy schedule

Most people studying for a DoD requirement are doing it on top of a full-time job, often with a deadline attached. So the plan needs to work in short sessions. Here’s how I’d use the CSTrail material if I were in that position.

Take a baseline across all five SY0-701 domains. Start at the Security+ practice tests by domain and subdomain hub and do one test from each domain: General Security Concepts; Threats, Vulnerabilities, and Mitigations; Security Architecture; Security Operations; and Security Program Management and Oversight. Don’t worry about the score yet. You’re looking for where you’re weakest.
Work your weakest domain subdomain by subdomain. The hub is organized that way so you can drill into one objective at a time instead of re-reading everything.
Make the Practice Test of the Day a habit. It’s a short daily set, which is exactly the kind of thing you can do over coffee or between meetings. Based on what I saw in the analytics, some of you are already working through the archive in order, which is a perfectly good way to use it.
Read the rationale for every question, including the ones you got right. Security+ questions often have two answers that look reasonable. Knowing why one is MORE correct than the other is the actual skill being tested.
Practice judgment, not just recall. Security Operations is the heaviest domain on the upcoming V8 exam (27% according to CompTIA), and it’s mostly about deciding what to do first. The CSTrail Simulations give you branching incident scenarios where that kind of decision actually has consequences.
Finish with mixed sets before you book. Once your weakest domain stops being obviously weak, switch to mixed practice so you get used to jumping between topics the way the real exam does.

If your team is studying with CSTrail, I hope it’s helping.

So, is Security+ still the right move?

For most people in or heading into IT and cyber defense roles on DoD systems, I think it still is. It covers more 8140 work roles than almost anything else at that level, it’s the credential hiring managers already expect, and it’s a solid base for whatever comes next.

Just don’t assume. Find out your work role code and proficiency level first, check the current matrix, and then study with a clear target. If Security+ is on your list, the domain hub is a good place to start today.

Start the FREE Security+ Practice Tests

FAQ

Does Security+ satisfy DoD 8140? For many work roles, yes. Security+ is an approved foundational qualification option for roughly 20 DCWF work roles, mostly at the Intermediate level, which also covers Basic. It does not satisfy positions coded Advanced, and it’s only the foundational piece. You still need residential qualification and ongoing professional development.

Is Security+ still a DoD requirement? Not as a blanket rule. Under 8140, requirements are set per work role and proficiency level, and Security+ is one of several options for many roles. Your position description, contract, or workforce manager tells you whether it fits your case.

What’s the difference between DoD 8570 and DoD 8140? 8570 grouped jobs into broad categories like IAT and IAM, with Levels I to III, and relied mainly on baseline certifications. 8140 codes each position to a specific DCWF work role and a Basic, Intermediate, or Advanced level, and qualification combines a foundational option with on-the-job residential qualification.

Is IAT Level II still a thing? Not as DoD policy. DoDM 8140.03 cancelled 8570.01-M in 2023, and a DFARS class deviation effective February 1, 2026 removed the old contractor clause. You’ll still see the term in older job postings, though.

Do contractors have to follow DoD 8140? Yes. DoDM 8140.03 applies to contractors performing cyber work in coded positions, and they must be foundationally qualified when they start that work. Contracts are being updated to name the specific work roles and levels.

Should I take SY0-701 or wait for SY0-801? If you’re already studying for SY0-701 and can test before mid-2027, take SY0-701. Both earn the same Security+ certification. If your test date is after June 2027, plan for SY0-801.

Sources

Official (DoD / DoW CIO):

CompTIA:

Secondary (used where noted):

Security+ and DoD 8140: What Government and Defense Cyber Roles Need to Know