Last updated: October 15, 2026. General information only. Confirm your requirement in the official DoD qualification matrices on cyber.mil.
Many job postings still say "DoD 8570 IAT Level II" when they ask for CompTIA CySA+, while newer ones mention "DoD 8140." They are related but not the same, and knowing the difference helps you read a posting correctly.
This article is part of our guide to what "DoD 8140 approved" means for CySA+.
DoD 8570 vs DoD 8140 at a glance
| DoD 8570 (older) | DoD 8140 (current) | |
|---|---|---|
| Governing document | DoD 8570.01-M | DoDM 8140.03, effective February 15, 2023 |
| How jobs are grouped | Broad categories such as IAT, IAM, IASAE and CSSP, each with levels | Individual DCWF work roles, each with Basic, Intermediate and Advanced levels |
| What qualifies you | An approved baseline certification, plus training on your computing environment | One foundational option approved for your role and level (education, training or certification), plus residential qualification |
| Where CySA+ appears | IAT Level II and several CSSP categories | Multiple work roles, often at the Advanced level |
What "IAT Level II" meant
IAT stands for Information Assurance Technical. Level II covered technicians working on network and computing environments, and CySA+ was one of the approved certifications for it, alongside Security+ and a few others. CySA+ also appeared in several CSSP (cybersecurity service provider) categories.
What changed with 8140
- Roles replace levels. Your requirement depends on your DCWF work role and proficiency level, not a generic IAT category.
- Certifications are one option among several. Education and training can count as foundational qualification for some roles.
- On-the-job qualification matters. Residential qualification is a separate requirement set by your organization.
- Timelines. People generally have a limited period to complete foundational qualification after being assigned to a role. Check DoDM 8140.03 and your component's policy for the details.
How to read a job posting
| The posting says | What to check |
|---|---|
| "IAT Level II" or "DoD 8570" | It likely uses the legacy language. Ask which DCWF work role and level the position maps to now |
| "DoD 8140 compliant" | Find the work role code and look it up in the qualification matrix |
| "CySA+ or equivalent" | Ask which other options the employer accepts for that role |
What this means if you hold CySA+
A CySA+ earned under the old program does not disappear. It remains a CompTIA certification valid for three years, and it is still listed as an approved option for several work roles. What matters is whether it is listed for your role at your level, so check the matrix. See the roles in CySA+ and DCWF work roles.
Get ready for CS0-004
If you are preparing for the current exam, our guide to CertMaster Study, Labs and Bundle options will help you choose.
Frequently asked questions
Is DoD 8570 dead?
DoDM 8140.03 replaced the 8570.01-M manual, but the old terms still appear in many postings and conversations.
Does CySA+ still satisfy IAT Level II?
IAT Level II is a legacy category. Under 8140, what counts is the work role and level in the qualification matrix.
Do I need to retake my certification because of the change?
Not necessarily. Check whether your certification is approved for your work role and level, and keep it current.
Where is the official list?
The DoDM 8140.03 qualification matrices are published on cyber.mil.
Written by an instructor who holds Security+, CySA+, PenTest+ and SecurityX. CertInstructor is an Authorized CompTIA Partner. We are not affiliated with the U.S. Department of Defense.
0件のコメント